792b320257
P0 - Critical: - config.py: add _mask() credential-redaction helper, SETTINGS_SCHEMA_VERSION, plaintext-storage warning; corrupt settings.json backed up before defaults - gost_util.py: pin SHA256 for gost_3.2.6_windows_amd64.zip; verify before extraction; _add_defender_exclusion now logs warning on failure - firewall.py: add emergency_disengage() for atexit/signal use - service.py: register fw_emergency_disengage via atexit + SIGTERM/SIGINT; stop() calls emergency_disengage if thread hangs past 15s timeout - app.py: wrap main() in top-level except with CTk error dialog + log - LICENSE: add MIT license file P1 - Important: - app.py: switch to RotatingFileHandler (5 MB / 3 backups) - config.py: settings_version + migrate(); save_settings() writes .bak before overwrite; _is_safe_https_url() strips RFC-1918 sources/ip_check_url - service.py: threading.Lock on _settings; _signal_handler; graceful stop - requirements.txt: pin exact versions; add cryptography==48.0.0 - .gitignore: add settings.json, credential JSON files, screenshot noise - tray.py, dns_leak.py, gost_util.py: replace bare except:pass with logging - CHANGELOG.md: document all session changes P2 - Nice to have: - .github/workflows/test.yml: CI on Python 3.10/3.11/3.12 windows-latest - run.py: --version / -V flag - docs/OPERATOR_RUNBOOK.md: emergency disengage, proxy leak, GOST, settings Tests: 47/47 passed (python -m unittest discover -s tests -v) Co-authored-by: Cursor <cursoragent@cursor.com>
2.7 KiB
2.7 KiB
Changelog
All meaningful changes to this repository should be recorded here.
Unreleased — 2026-05-21 (Audit remediation P0/P1/P2)
Security (P0)
- Secrets at rest: Added
_mask()helper inconfig.pyto redact credentials from any debug log output. AddedSETTINGS_SCHEMA_VERSIONand prominent plaintext-storage warning. - GOST integrity:
gost_util.pynow verifies the downloaded release zip against a pinned SHA256 (GOST_RELEASE_ZIP_SHA256) before extraction. Supply-chain swap raisesRuntimeError. - Kill-switch recovery:
firewall.pyexposesemergency_disengage().service.pyregisters it viaatexitandsignal.SIGTERM/SIGINTso a crash cannot leave outbound traffic permanently blocked.
Reliability (P0/P1)
- Top-level exception handler:
app.pymain()now catches unhandled exceptions, shows atkinter.messageboxerror dialog, logs to file, and re-raises. - Log rotation:
app.pyswitches from bareFileHandlertoRotatingFileHandler(5 MB max, 3 backups). - Settings migration:
config.pygainssettings_versionfield,migrate()function, and safe corrupt-file backup (settings.json.corrupt) on parse failure. - Settings backup:
save_settings()copiessettings.json → settings.json.bakbefore overwriting. - Graceful shutdown:
service.pystop()callsfw_emergency_disengage()if the thread does not exit within 15 s. - Thread safety:
ChainService._settingsreads/writes guarded bythreading.Lock. - Input / URL validation:
sanitize_settings()now validatessourcesandip_check_urlagainst an RFC-1918 / link-local block-list; unsafe entries are removed with a warning.
CI / Distribution (P0/P1/P2)
- GitHub Actions CI added:
.github/workflows/test.ymlrunscompileall+unittest discoveron Python 3.10 / 3.11 / 3.12 onwindows-latest. - LICENSE: MIT license added to repo root.
- requirements.txt: All four runtime dependencies pinned to exact versions;
cryptographyadded for future Fernet-based secret storage. .gitignore: Addedsettings.json,*.jsoncredential files, and screenshot noise.--versionflag:run.pynow supports--version/-V.
Documentation (P1/P2)
docs/OPERATOR_RUNBOOK.md: Emergency firewall disengage, proxy leak, empty pool, GOST quarantine, and settings-restore instructions.- Bare
except: passcleanup: Key silent-failure sites intray.py,dns_leak.py, andgost_util.pynow log awarningordebugmessage instead of swallowing errors.
2026-05-20 - Gitea Stewardship Import
- Verified README and wiki coverage.
- Added standard stewardship documentation where missing.
- Established security, contribution, release, and provenance expectations.