zynk/zynk - [xw3.org]

zynk/zynk

Fork 0

Commit graph

Author	SHA1	Message	Date
hanez	72f7812630	Secure file ops, TLS hardening, input validation, security docs. (0.40.7) - Added secure_state_open(): hardened file open with O_CLOEXEC, O_NOFOLLOW, mode 0600, regular-file and ownership checks. Prevents symlink attacks, TOCTOU races, and world-writable temp files. - Replaced all fopen() calls for temp state files with secure_state_open() + fdopen() across hot reload, compile-restart, and rebuild paths. - Hardened TLS initialization: enforces minimum TLS 1.2, disables compression, checks SSL_CTX_set_default_verify_paths() return value. - CMake compiler/linker hardening: -Wformat=2, -Wstrict-prototypes, -fstack-protector-strong, _FORTIFY_SOURCE=3, RELRO, noexecstack. - Added !calc input validation: max 256 chars, numeric-only characters. - Added !stock symbol validation: alphanumerics plus .-^= only. - Fixed !quit, !reload, !restart to require channel context (DMs rejected). - Fixed log timestamp format: %y (2-digit) to %Y (4-digit year). - Fixed asprintf return value check in !forecast error paths. - Fixed !reload fork-in-place mode: only saves TLS state when exec_new=1. - Cleaned up reload state file on failure and in fork child. - Fixed git SSH-to-HTTPS URL conversion in !gitlog and !changelog. - AI plan mode no longer passes --dangerously-skip-permissions. - Added IRC buffer overflow protection: oversized lines are dropped. - Added doc comments to ZYNK_RELOAD_FILE, secure_state_open(), RateLimitEntry, and rate_limits.	2026-07-24 03:21:49 +02:00
hanez	739e3622b5	Commit links for !gitlog, full changelog link for !changelog, CMake, multi-file refactor - !gitlog now shows a link to each commit in the repository, using the git remote URL converted from SSH/SCP to HTTPS - !changelog now shows a 'Full changelog: <url>' link to CHANGELOG.md in the repository as the last message after all entries - Removed 'full' keyword from !gitlog and !changelog (previously showed full commit messages and complete changelog entries) - Switched build system from Make to CMake with feature toggles (-DWITH_<FEATURE>=ON/OFF) - Refactored single-file codebase into dedicated header files: each command now lives in its own cmd_*.h file, with separate modules for database (db.h), IRC protocol (irc.h), networking (net.h), TLS (tls.h), and AI (ai.h) - Updated README.md to reflect the simplified !gitlog and !changelog syntax and the new CMake build instructions (0.40.0)	2026-07-23 01:46:37 +02:00

Author

SHA1

Message

Date

hanez

72f7812630

Secure file ops, TLS hardening, input validation, security docs. (0.40.7)

- Added secure_state_open(): hardened file open with O_CLOEXEC, O_NOFOLLOW,
  mode 0600, regular-file and ownership checks. Prevents symlink attacks,
  TOCTOU races, and world-writable temp files.
- Replaced all fopen() calls for temp state files with secure_state_open()
  + fdopen() across hot reload, compile-restart, and rebuild paths.
- Hardened TLS initialization: enforces minimum TLS 1.2, disables
  compression, checks SSL_CTX_set_default_verify_paths() return value.
- CMake compiler/linker hardening: -Wformat=2, -Wstrict-prototypes,
  -fstack-protector-strong, _FORTIFY_SOURCE=3, RELRO, noexecstack.
- Added !calc input validation: max 256 chars, numeric-only characters.
- Added !stock symbol validation: alphanumerics plus .-^= only.
- Fixed !quit, !reload, !restart to require channel context (DMs rejected).
- Fixed log timestamp format: %y (2-digit) to %Y (4-digit year).
- Fixed asprintf return value check in !forecast error paths.
- Fixed !reload fork-in-place mode: only saves TLS state when exec_new=1.
- Cleaned up reload state file on failure and in fork child.
- Fixed git SSH-to-HTTPS URL conversion in !gitlog and !changelog.
- AI plan mode no longer passes --dangerously-skip-permissions.
- Added IRC buffer overflow protection: oversized lines are dropped.
- Added doc comments to ZYNK_RELOAD_FILE, secure_state_open(),
  RateLimitEntry, and rate_limits.

2026-07-24 03:21:49 +02:00

hanez

739e3622b5

Commit links for !gitlog, full changelog link for !changelog, CMake, multi-file refactor

- !gitlog now shows a link to each commit in the repository, using the
  git remote URL converted from SSH/SCP to HTTPS
- !changelog now shows a 'Full changelog: <url>' link to CHANGELOG.md
  in the repository as the last message after all entries
- Removed 'full' keyword from !gitlog and !changelog (previously showed
  full commit messages and complete changelog entries)
- Switched build system from Make to CMake with feature toggles
  (-DWITH_<FEATURE>=ON/OFF)
- Refactored single-file codebase into dedicated header files: each
  command now lives in its own cmd_*.h file, with separate modules for
  database (db.h), IRC protocol (irc.h), networking (net.h), TLS (tls.h),
  and AI (ai.h)
- Updated README.md to reflect the simplified !gitlog and !changelog
  syntax and the new CMake build instructions

(0.40.0)

2026-07-23 01:46:37 +02:00

2 commits