2.8 KiB
Verification report - RustProxy 0.28.2
Scope
RustProxy 0.28.2 hardens the 0.28.1 external-certificate workflow. Absolute certificate/key paths are validated across the configured and resolved parent chains, the final file is opened with O_NOFOLLOW, POSIX ACL read access is supported without requiring an exact chmod value, private keys may not be world-readable, and external certificate/key files may not be group/world-writable. The packaged systemd service explicitly keeps /etc/letsencrypt and /etc/ssl read-only while normal Unix permissions/ACLs remain authoritative for access.
Certificate automation is also narrowed. SQLite schema 9 adds per-Key-ID grants: new Certificate API tokens require explicit certificate IDs, are reload-only by default, cannot call the global all-certificate reload endpoint, and require an explicit deploy grant before POST /api/certificates/deploy is accepted. Credentials from earlier releases migrate to reload-only wildcard compatibility grants and should be rotated to explicit IDs.
The release retains the 0.28.0 GeoIP direct-source/MMDB hot reload, listener protocol badges, cache Via/narrow invalidation, Security-editor layout and ACME runtime reporting. COLD cache format 3 and saved proxy configuration format remain unchanged.
Verification
| Check | Result |
|---|---|
| Source/static contracts | PASS - tools/checks/check_source.py |
| Documentation/index/link checks | PASS - tools/checks/docs_check.py |
| Browser-side JavaScript syntax/UI contracts | PASS - ./dev.sh test pre-Cargo stages |
| SQLite schema-9 migration and release smoke | PASS - tools/checks/release_smoke.py, including legacy-token grant migration |
| Docker Agent Go tests | PASS - go test ./... |
| Shell/Python/JSON syntax checks | PASS - release/static checks plus explicit shell/JSON validation |
cargo fmt/check/test |
NOT VERIFIED - Rust/Cargo are not installed in this verification environment; ./dev.sh test exits 127 only after all pre-Cargo gates pass |
| Live Certbot ACL + targeted API reload | NOT VERIFIED - requires a compiled binary and host certificate material |
| Live HTTP/2 + HTTP/3 protocol tests | NOT VERIFIED - requires a compiled binary and QUIC-capable runtime |
Security regression coverage
The source tests include Certbot-style live/ -> archive/ symlink refresh behavior, acceptance of ACL-style group-mask bits, rejection of group/world-writable or world-readable private-key modes, and rejection of writable non-sticky parent directories. Administration tests cover targeted certificate-ID grants, denial of global reload for Certificate API tokens, rejection of non-allowlisted certificate IDs and independent token revocation.
See V0.28.2_IMPLEMENTATION.md for the operator ACL example and migration behavior.