Update all repository URLs from git.sr.ht to https://code.lewman.com/agglutino/ Replace git clone instructions with fossil clone/open equivalents in README and USAGE docs. Add fossil version control section to AGENTS.md with common commands. leaf check-in: 3d5d067e83 user: andrew tags: dev, trunk

Add BSD-3-Clause license identifier to shell scripts, systemd service, tmac file, and markdown documentation for consistent license metadata across the repository. check-in: 7e2d836da2 user: sourcehut@lewman.us tags: dev, trunk

The VLA-to-fixed-buffer change left snprintf using the old runtime buf_len variable instead of the fixed array size. If the domain name exceeded the buffer, this would cause a stack buffer overflow. Use sizeof(url) for the size limit and remove the now-unused buf_len. check-in: 20193c5ea1 user: sourcehut@lewman.us tags: dev, trunk

Address findings #4-#18 (excluding #7, a false positive in C23):

- #4: Validate strtoul return values in argument parsing (errno, endptr, range checks for port, slug size, buffer size) - #5: Distinguish EEXIST from real errors in create_directory - #6: Check mkdir return value for output directory creation - #9: Fix %d format specifier to %zd for ssize_t - #10: Pass buffer size to get_date to prevent buffer overflows - #11: Reduce socket timeout from 5s to 2s for basic rate limiting - #12: Replace VLA in handle_connection with fixed-size buffer - #13: Check fprintf return values when writing homograph warnings - #14: Clear sa_flags instead of SA_RESTART for graceful shutdown - #15: Stack-allocate connection struct in dispatch_connection, removing all free(c) calls in handle_connection - #16: Document ownership invariant for default string literals instead of using strdup (avoids leaks when overridden by optarg) - #17: Remove duplicate #include <unistd.h> - #18: Add const qualifiers to create_directory/save_to_file params, remove unreachable break after return

Also removes security.html (internal audit report, not for public repo). check-in: c3327a743f user: sourcehut@lewman.us tags: dev, trunk

Each of the 18 findings now includes a remote exploitability badge (remotely exploitable, remotely triggerable/needs local access, or not remote) and 9 findings have concrete proof-of-concept commands.

2 findings are remotely exploitable (#8 homograph bypass, #11 DoS), 3 are remotely triggerable requiring local FS access (#1-3 TOCTOU/ permissions), and 13 are not remotely exploitable. check-in: eed708a1d1 user: sourcehut@lewman.us tags: dev, trunk

Standalone HTML report with 18 findings (3 high, 7 medium, 7 low, 2 info) covering TOCTOU symlink races, missing file permission control, integer truncation via strtoul, VLA usage, and more. Includes PoC demonstrations for each finding. check-in: 6270dba6ac user: sourcehut@lewman.us tags: dev, trunk

- Remove duplicate #include <netinet/in.h> - Fix asctime_r return check: compare to NULL instead of 0 - Replace MSG_WAITALL with manual recv() loop to avoid 5-second timeout delay on every paste - Simplify count_utf8_chars to lead-byte counting (function is only called after validate_utf8 confirms valid input) - Narrow detect_homographs to skip Greek reserved/punctuation range U+0380-U+0390 - Write errors to stderr instead of stdout check-in: 0a75accef4 user: sourcehut@lewman.us tags: dev, trunk

Validate port must be between 1024-65535 in main.c before casting from strtoul() to uint16_t. Prevents silent truncation when users provide port values > 65535. Updated validate_settings() to enforce non-privileged ports (> 1024). check-in: f371b73e9b user: sourcehut@lewman.us tags: dev, trunk

- More useful default for testing/development

- localhost URLs work correctly when accessed locally

- Users can still override with -d flag check-in: 7a73d1e759 user: sourcehut@lewman.us tags: dev, trunk

- arc4random_buf() is always used on OpenBSD, never reaches /dev/urandom

- Provides compatibility for code changes and other platforms

- Documents why this is included despite currently being unused path check-in: 764894b888 user: sourcehut@lewman.us tags: dev, trunk

- Loop until all bytes are sent for error messages and URL responses

- Prevents truncated output to client on network congestion

- Proper signedness handling to avoid warnings check-in: da6939942b user: sourcehut@lewman.us tags: dev, trunk

- Reverse DNS lookup was removed in commit 41ff886

- pledge() no longer includes 'dns' promise

- Cleans up dead code and saves pledge slot check-in: 8384eec39d user: sourcehut@lewman.us tags: dev, trunk

- Replaced getnameinfo() reverse DNS lookup with direct IP usage

- Fixes 30-90 second delays when DNS is slow or unresponsive

- Single-threaded server was blocking on hostname resolution check-in: 0e7332b4c9 user: sourcehut@lewman.us tags: dev, trunk

- Close connection immediately if SO_RCVTIMEO or SO_SNDTIMEO setup fails

- Change error check from '!= 0' to idiomatic '== -1'

- Add specific error messages for send vs receive timeouts check-in: 4e9b1fc33e user: sourcehut@lewman.us tags: dev, trunk

- Add MAX_DOMAIN_LEN constant (256 chars, per RFC 1035)

- Validate domain length in validate_settings()

- Prevents VLA stack overflow and integer overflow in set_domain_name() check-in: 38e61ab008 user: sourcehut@lewman.us tags: dev, trunk

Add comment explaining that getnameinfo() performs blocking reverse DNS lookup which may delay connection handling if DNS is slow.

Fix compiler warning for ignored write() return value by explicitly casting to void with explanatory comment. check-in: f151b8b483 user: sourcehut@lewman.us tags: dev, trunk

Send a clear error message to clients when they provide non-UTF-8 data, rather than silently closing the connection. This improves UX by letting users know why their paste was rejected. check-in: c897b89e6e user: sourcehut@lewman.us tags: dev, trunk

Create scripts/openrc/ directory with OpenRC service support:

- agglutino: OpenRC init script - Uses standard OpenRC framework with openrc-run - Configurable via /etc/conf.d/agglutino - Supports user switching and working directory setup - Includes start_pre() for directory creation

- openrc.md: Complete OpenRC setup guide - Installation instructions for Gentoo, Alpine, Artix - User creation with useradd/adduser per distro - Distribution-specific notes (package installation) - nginx and lighttpd configuration examples - Troubleshooting tips

- Update USAGE.md: Add OpenRC section to service documentation - Copy-paste commands for quick setup - Link to detailed openrc.md - OpenRC-specific management commands

Now supports all major init systems: - OpenBSD: scripts/openbsd/ (rc.d) - FreeBSD: scripts/freebsd/ (rc.d) - systemd: scripts/systemd/ (Linux) - OpenRC: scripts/openrc/ (Gentoo, Alpine, Artix) check-in: 845e274277 user: sourcehut@lewman.us tags: dev, trunk

Create scripts/freebsd/ directory with FreeBSD service support:

- agglutino: rc.d script for FreeBSD service management - Uses standard rc.subr framework - Configurable via sysrc - Supports user switching with -u flag

- freebsd.md: Complete FreeBSD setup guide - Installation instructions - User/directory setup with pw command - nginx and Apache configuration for FreeBSD - Jail setup guide for additional isolation - pf firewall example

- Update USAGE.md: Add FreeBSD section to service documentation - Copy-paste commands for quick setup - Link to detailed freebsd.md - FreeBSD-specific management commands

Now supports all major BSD variants: - OpenBSD: scripts/openbsd/ - FreeBSD: scripts/freebsd/ Plus Linux: scripts/systemd/ check-in: 4c3e4ca549 user: sourcehut@lewman.us tags: dev, trunk

Create scripts/systemd/ directory with Linux service support:

- agglutino.service: Full systemd service with security hardening - ProtectSystem, ProtectHome, PrivateTmp, NoNewPrivileges - RestrictSUIDSGID, RestrictRealtime, MemoryDenyWriteExecute - Automatic restart on failure, journal logging

- systemd.md: Complete Linux setup guide (renamed from README.linux.md) - User/directory creation instructions - systemd management commands - nginx and Apache configuration examples - Troubleshooting tips

- Update USAGE.md: Reference new scripts/systemd/ location - Copy-paste commands for quick setup - Link to detailed systemd.md

This complements the existing OpenBSD rc.d support, providing first-class service integration for both platforms. check-in: 2f042c6732 user: sourcehut@lewman.us tags: dev, trunk

This reverts commit dc6a52c783fa262af4f8abefb294a412b09b8eb6. check-in: dc87a2c476 user: sourcehut@lewman.us tags: dev, trunk

Create scripts/systemd/ directory with Linux service support:

- agglutino.service: Full systemd service with security hardening - ProtectSystem, ProtectHome, PrivateTmp, NoNewPrivileges - RestrictSUIDSGID, RestrictRealtime, MemoryDenyWriteExecute - Automatic restart on failure, journal logging

- README.linux.md: Complete Linux setup guide - User/directory creation instructions - systemd management commands - nginx and Apache configuration examples - Troubleshooting tips

- Update USAGE.md: Reference new scripts/systemd/ location - Copy-paste commands for quick setup - Link to detailed README.linux.md

This complements the existing OpenBSD rc.d support, providing first-class service integration for both platforms. check-in: fe477604ad user: sourcehut@lewman.us tags: dev, trunk

- Create openbsd/agglutino.rc: rc.d script for rcctl management - Create openbsd/README.OpenBSD: complete OpenBSD setup guide - Update USAGE.md with OpenBSD rcctl and systemd service sections - Move service configuration before web server config for clarity - Remove duplicate systemd section

Users can now easily manage agglutino via OpenBSD's rcctl: rcctl enable agglutino rcctl start agglutino rcctl stop agglutino check-in: 35409b48bf user: sourcehut@lewman.us tags: dev, trunk

README.md: - Emphasize OpenBSD as primary development platform - State Unix-like compatibility as the goal - Remove excessive client/server usage details - Add concise quick start section - Link to new USAGE.md for detailed instructions - Maintain security features overview - Reduced from 365 lines to ~80 lines

USAGE.md (new): - Extract all usage documentation from README.md - Client usage with examples and aliases - Server usage with all command line options - Web server configuration examples (OpenBSD httpd, nginx) - systemd service example - Build options for different compilers

This makes the README more focused and approachable while moving detailed usage to a dedicated file. check-in: 23f77bdc5b user: sourcehut@lewman.us tags: dev, trunk

- Change default compiler from 'cc' to 'clang' for better C23 support - Clang provides superior diagnostics and faster compilation - Add 'make gcc' convenience target for GCC builds - Add 'make gcc-debug' convenience target for GCC debug builds - Users can still override with 'make CC=gcc' or any other compiler

Rationale: - Clang has better C23 feature support and more helpful error messages - Both compilers are supported; clang is just the new default - Maintains flexibility for users who prefer GCC check-in: 68ed9a4dee user: sourcehut@lewman.us tags: dev, trunk

- Mark C23 migration as COMPLETE (2025-02-27) - Document all C23 features implemented: nullptr, static_assert, auto, constexpr, [[nodiscard]], [[maybe_unused]] - Mark secure build options as COMPLETE - Update priority order to reflect completed work - Add completion note with security audit results check-in: 49fc45347c user: sourcehut@lewman.us tags: dev, trunk

Modernize codebase to use C23 features: - [[nodiscard]] on security-critical functions - nullptr instead of NULL - static_assert for compile-time validations - auto keyword for type inference - constexpr for compile-time constants - [[maybe_unused]] for clean unused parameter handling

All changes maintain backward compatibility and pass all tests. check-in: 8c9b5b338f user: sourcehut@lewman.us tags: dev, trunk

Replace (void)sig cast with [[maybe_unused]] attribute on the signal handler parameter. This is the modern C23 way to indicate intentionally unused parameters:

- signal_handler([[maybe_unused]] int sig)

Benefits: - More explicit and self-documenting than (void) casts - Follows C23 standard attribute syntax - Cleaner code without workarounds

Compile-tested and all 4 Unicode tests pass. leaf check-in: ec46f16a81 user: sourcehut@lewman.us tags: origin/c23-upgrade, trunk

Replace runtime const variables with C23 constexpr for true compile-time constants that can be used in constant expressions:

Buffer size limits: - MIN_BUFFER_LEN = 1024 (1KB minimum) - MAX_BUFFER_LEN = 131072 (128KB maximum) - MIN_SLUG_LEN = 1 - MAX_SLUG_LEN = 64

Path calculation constants: - SLUG_DIR_EXTRA = 2 (1 slash + null terminator) - FILE_PATH_EXTRA = 3 (2 slashes + null terminator) - TEST_FILE_EXTRA = 25 (room for "/.agglutino_test_XXXXXX")

Benefits: - True compile-time constants usable in static_assert and array bounds - No runtime storage overhead - Updated static_assert to use constexpr names for clarity - Replaced magic numbers (2, 3, 25) with named constants

Compile-tested and all 4 Unicode tests pass. check-in: 6f588434e9 user: sourcehut@lewman.us tags: origin/c23-upgrade, trunk

Replace explicit type declarations with 'auto' (C23) where types are obvious from context, improving code clarity without sacrificing safety:

- set_domain_name(): len and b variables - handle_connection(): content_len and buf_len for URL formatting - create_directory(): dir_len, slug_len, and len for path calculations - save_to_file(): dir_len, slug_len, file_len, and len for path calculations

Keep explicit size_t for integer literals (extra) to avoid sign conversion warnings and maintain clarity.

The 'auto' keyword uses typeof internally to infer types from initializers, ensuring type safety while reducing visual noise in size calculations.

Compile-tested and all 4 Unicode tests pass. check-in: d2741d0f7e user: sourcehut@lewman.us tags: origin/c23-upgrade, trunk

Add static_assert with descriptive messages to validate compile-time assumptions and catch configuration errors early:

- Buffer constraints: MAX_BUFFER_LEN > MIN_BUFFER_LEN (128KB > 1KB) - Slug constraints: MAX_SLUG_LEN > MIN_SLUG_LEN (64 > 1) - Type safety: sizeof(size_t) >= 4 bytes for arithmetic - Path safety: PATH_MAX > 100 for reasonable path operations - Network safety: INET6_ADDRSTRLEN >= 46 for full IPv6 addresses

These assertions trigger compile-time errors with clear messages if any platform violates these assumptions, preventing runtime failures.

Compile-tested and all 4 Unicode tests pass. check-in: 04d5fc6457 user: sourcehut@lewman.us tags: origin/c23-upgrade, trunk

Replace all uses of NULL macro with C23 nullptr keyword: - Pointer initializations (result, rp, ip, slug, etc.) - Comparison checks (user_name, userdata, output, etc.) - Standard library calls (sigaction, select, getnameinfo) - OpenBSD sandbox functions (unveil, pledge) - strtoul calls in main.c

nullptr has type nullptr_t and only converts to pointer types, making it safer than NULL which could be 0 or (void*)0.

All 27 occurrences converted. No functional changes. Compile-tested and all 4 Unicode tests pass. check-in: bbe29ff0cb user: sourcehut@lewman.us tags: origin/c23-upgrade, trunk