cozystack

0 Fork 0

mirror of https://github.com/cozystack/cozystack.git synced 2026-11-08 21:14:56 +09:00

Files

T

Aleksei Sviridkin 1a7339537f fix(cozystack-controller): rebuild CA projection from validated blocks

The write-path guard validated the CA value as a certificate chain but
then published a clone of the original input. pem.Decode silently skips
bytes before the first PEM block and between blocks, and the private-key
header guard only matches a "-----BEGIN ... PRIVATE KEY-----" line, so a
raw DER or JWK private key placed ahead of or between real certificates
passes both checks and is copied verbatim into the tenant-readable
projection.

Assemble the projection from the re-encoded certificate DER instead of
cloning the input, so preamble and interstitial key material are
structurally unreachable. The empty-value, wrong-type, non-parseable and
trailing-byte rejections are unchanged.

Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-07-21 17:16:47 +03:00

cacert

fix(cozystack-controller): rebuild CA projection from validated blocks

2026-07-21 17:16:47 +03:00

fluxplunger

feat(platform): add flux-plunger controller

2026-01-19 13:20:08 +01:00

kubeovnplunger

feat: Gateway API support via Cilium

2026-05-25 17:07:02 +03:00

tenantgateway

test(gateway): pin full port-443 kinds contract across all cert modes (cilium#45559)