fix: security audit F5–F7 + Pi CI races (bundle) #12

Merged

sirius merged 6 commits from feat/audit-fixes-bundle into main

2026-09-11 00:41:40 +00:00

sirius commented

2026-09-11 00:35:51 +00:00

Owner

Summary

One PR instead of #8 #9 #10 #11. Does not merge to main — Lance merges.

Replaces:

#8 CI serialize + valid XMR fixture after F4 checksums
#9 F5 wallet RPC HTTP Digest + 1 MiB read cap (was unmergeable vs current main)
#10 F6 /wipe also drops payments; non-forensic docs
#11 F7 redact HS logs; Arti cache/state 0700

Already on main from earlier merges: F1 conjunctive receipts, F2 AEAD AAD, F3 invite binding, F4 XMR checksums.

Conflict resolution

#9 was based on 2b42864 (pre-F1–F4). Kept sha3 and md-5. Threat model: Digest login and conjunctive verified. Wallet tests: F1 matcher + F5 digest/cap.

Proof

cargo test --locked: 122 passed, 3 ignored (live Tor).
cargo clippy --locked --all-targets -- -D warnings: clean.

## Summary One PR instead of #8 #9 #10 #11. Does **not** merge to `main` — Lance merges. Replaces: - #8 CI serialize + valid XMR fixture after F4 checksums - #9 F5 wallet RPC HTTP Digest + 1 MiB read cap (was unmergeable vs current main) - #10 F6 `/wipe` also drops `payments`; non-forensic docs - #11 F7 redact HS logs; Arti cache/state `0700` Already on `main` from earlier merges: F1 conjunctive receipts, F2 AEAD AAD, F3 invite binding, F4 XMR checksums. ## Conflict resolution #9 was based on `2b42864` (pre-F1–F4). Kept `sha3` **and** `md-5`. Threat model: Digest login **and** conjunctive `verified`. Wallet tests: F1 matcher + F5 digest/cap. ## Proof `cargo test --locked`: 122 passed, 3 ignored (live Tor). `cargo clippy --locked --all-targets -- -D warnings`: clean.

sirius added 6 commits 2026-09-11 00:35:52 +00:00

fix(ci): serialize Pi jobs; valid XMR fixture after F4

ci / test (pull_request) Successful in 2m49s

Details

bfd28fce6b

Overlapping Actions used a fixed docker name onionwire-ci (Conflict)
and OOM-killed with 137. Unique run_id names + one-at-a-time
concurrency. F1 ingest test still used 8+B*94 which F4 checksums reject.

[verified] feat(wallet): require RPC digest login and cap reads

ci / test (pull_request) Successful in 3m8s

Details

125aafb816

Refuse unauthenticated ONIONWIRE_WALLET_RPC, speak HTTP Digest like
monero-wallet-rpc --rpc-login, cap responses at 1 MiB, and reject
.onion RPC URLs instead of half-dialing them over TCP.

fix(store): drop payments on /wipe; document non-forensic

ci / test (pull_request) Successful in 3m1s

Details

45c105de8a

/wipe now deletes payments as well as chat, checkpoints WAL, and
enables sqlite secure_delete (flash still not crypto-shred).

[verified] fix(hs): redact onion in publish logs; cache 0700

ci / test (pull_request) Successful in 3m0s

Details

424002c0f5

wait_until_published now logs HsId via safelog, not the locator.
Store and client_config mkdir Arti cache/state 0700. Arti
dangerously_trust_everyone stays on storage only.

Merge remote-tracking branch 'origin/wt/t_792593f3' into feat/audit-fixes-bundle 39e7b3bf16

Merge F5 wallet digest RPC onto audit bundle

ci / test (pull_request) Successful in 3m33s

Details

08ced86a34

Keep sha3 (F4 checksums) and md-5 (HTTP Digest). Threat model: digest login
plus conjunctive verified receipts. Wallet tests: F1 matcher fixtures plus
F5 digest/cap coverage.