29 lines
2.8 KiB
Markdown
29 lines
2.8 KiB
Markdown
# RustProxy 0.25.2 release audit
|
|
|
|
RustProxy 0.25.2 is a focused backup-integrity and resumed-admin-session hardening release. It does not change the SQLite schema or saved configuration format.
|
|
|
|
## Backup and restore
|
|
|
|
| Requirement | Status | Evidence |
|
|
| --- | --- | --- |
|
|
| Create a full encrypted backup while RustProxy is running | IMPLEMENTED | `backup create` no longer requires ownership of `process.lock`; SQLite is captured with `VACUUM INTO` and validated before archiving. |
|
|
| Keep offline behavior deterministic | IMPLEMENTED | When the service is stopped, the CLI still acquires and holds the data-directory lock during backup. |
|
|
| Preserve Certbot-style internal symlinks | IMPLEMENTED | Archive version 2 records file/directory/symlink entry type and restores validated relative symlink targets as symlinks. |
|
|
| Prevent symlink escape | IMPLEMENTED | Absolute or lexically escaping targets are rejected; the staged tree is canonicalized and every link must resolve inside it before archive creation/activation. |
|
|
| Reject dangling backup symlinks | IMPLEMENTED | Live snapshot validation requires every staged symlink target to exist. |
|
|
| Keep configured certificate files coherent with the DB snapshot | IMPLEMENTED | Certificate files referenced by the exact SQLite snapshot are required to exist as regular files in the staged filesystem snapshot; capture retries on concurrent rotation. |
|
|
| Restore older backups | IMPLEMENTED | Archive version 1 remains accepted; version-1 entries continue to deserialize as regular files. |
|
|
| Restore safely | IMPLEMENTED | Restore still requires the service to be stopped, verifies authenticated encryption, manifest/checksums, SQLite/Secret Store state, stages privately, then atomically activates. |
|
|
|
|
## Administration origin recovery
|
|
|
|
The administration server's Host, externally visible scheme/authority, Origin, request-marker and CSRF validation is unchanged. The authenticated browser shell now recognizes only `auth.invalid_origin` during startup/session revalidation and performs at most one reload of the current same-origin URL. A successful session check clears the recovery marker; a repeated failure is surfaced normally instead of looping.
|
|
|
|
This addresses browser-restored/BFCache-style tabs where a manual refresh previously repaired the page without weakening the server trust boundary.
|
|
|
|
## Verification gates
|
|
|
|
Rust-independent source, documentation, web-contract and release-smoke checks are part of the release tree. Backup tests include a simulated live process lock and round-trip of a Certbot-style `live/fullchain.pem -> ../../archive/...` symlink, plus escaping/absolute-link rejection.
|
|
|
|
Compiler-enabled `cargo fmt --all`, `cargo check --locked --all-targets` and `cargo test --locked --all-targets` remain mandatory on a release host with the Rust toolchain installed.
|