v2.31.0-dev2 4b72742

2026-04-02

4b72742Merge pull request #154 from bnema/feat/http-ca-onboarding-hardening merge GPG Unverifiedtag v2.31.0-dev2bnema
ed50492fix: address PR review findings for HTTP CA onboarding hardening GPG Verifiedbrice
d69dfa0test: harden HTTP onboarding coverage GPG Verifiedbrice

2026-04-01

0b996abtest direct HTTP onboarding HEAD routes GPG Verifiedbrice
7fff706refactor: reuse trusted-or-local helper in HTTPS redirect GPG Verifiedbrice
6521b77fix: simplify onboarding redirect link handling GPG Verifiedbrice
39cdcd8docs: clarify HTTP onboarding comment intent GPG Verifiedbrice
29b9578refactor: consolidate RemoteAddr/trust helpers and host-port mapping GPG Verifiedbrice
8739892fix: remove unnecessary fmt.Sprintf around constant string GPG Verifiedbrice
6c74ee7http: add comment for ignored Atoi error, add request logging to onboarding gate GPG Verifiedbrice
ef180bcdocs: explain internal CA onboarding and client trust setup GPG Verifiedbrice
956a990feat(http): restrict direct HTTP to CA onboarding GPG Verifiedbrice
f0b7906fix(http): derive public redirect URLs from request host GPG Verifiedbrice
aab20abfix(onboarding): correct public URLs and client trust guidance GPG Verifiedbrice
67f96d9Merge pull request #153 from bnema/feat/internal-ca-ondemand-tls merge GPG Unverifiedtag v2.31.0-devbnema
937d56dfix(app): handle error from srv.Shutdown in closeStarted cleanup GPG Verifiedbrice
b1d7815fix(pki): derive cache expiry from real leaf NotAfter; extract validateLoadedIntermediate GPG Verifiedbrice

2026-03-31

29dcc3bfix: address CodeRabbit review findings GPG Verifiedbrice
2604a62fix: harden PKI lifecycle, middleware coverage, and startup cleanup GPG Verifiedbrice
67e87d2fix: address all findings from deep code review GPG Verifiedbrice
a6947b2feat(server): add custom TLS certs, HTTPS redirect, and atomic intermediate store GPG Verifiedbrice

2026-03-30

5bf3a89refactor(pki): simplify after code review GPG Verifiedbrice
450331cfix(pki): add control character check to domain validation GPG Verifiedbrice
63f113efeat(server): add tls_port=0 opt-out and use unprivileged default ports GPG Verifiedbrice

2026-03-29

30b9539security(pki): harden internal CA and onboarding endpoints GPG Verifiedbnema
6cb035cfix(pki): use append in RootFingerprint to satisfy gosec G602 GPG Verifiedbrice
d623483chore: fix import ordering and add MinVersion to test TLS clients GPG Verifiedbrice
32363a8refactor(pki): simplify after code review GPG Verifiedbrice
dddcd1achore: fix lint issues in onboarding handler and ca CLI GPG Verifiedbrice
000e12atest(pki): add TLS handshake integration tests GPG Verifiedbrice
14736d4feat(pki): wire internal CA into server — dual HTTP/HTTPS handler chains, on-demand TLS GPG Verifiedbrice
1659415refactor: remove deprecated TLS config fields, forceHSTS, and self-signed cert generation GPG Verifiedbrice
848492cfeat(cli): add gordon ca export/install/info commands GPG Verifiedbrice
923d96ffeat(pki): add CA onboarding HTTP handler with cert download and landing page GPG Verifiedbrice
ad80185feat(pki): implement use case service with cert cache, allowlist, and renewal GPG Verifiedbrice
1c01096feat(pki): add trust store wrapper and iOS mobileconfig generation GPG Verifiedbrice
b939cf1feat(pki): implement CA adapter with root, intermediate, and leaf issuance GPG Verifiedbrice
2242016feat(pki): add CertificateAuthority boundary interface GPG Verifiedbrice
cce6418deps: add go.step.sm/crypto and smallstep/truststore for internal CA GPG Verifiedbrice
1983e1bfix(security): add missing FOWNER and DAC_OVERRIDE capabilities GPG Verifiedtag v2.30.1brice

2026-03-28

3ef732bdocs: remove stale password auth references GPG Verifiedbrice
06c2247docs: add missing CLI docs and fix broken wiki links GPG Verifiedbrice
83e8199docs(cli): update index for v2.30.0 GPG Verifiedbrice
3ee801cMerge pull request #151 from bnema/security/hardening-production merge GPG Unverifiedtag v2.30.0tag v2.30.0-pre7bnema
c5f57f6test: add ProxyCIDRAllowlist coverage for redirect listener bypass GPG Verifiedbrice
5a1e21dfix: address CodeRabbit review findings on security hardening GPG Verifiedbrice

2026-03-27

552aacarefactor: deduplicate CIDR allowlist code and clean up GPG Verifiedbnema
66e4d1bfix: address CodeRabbit review feedback GPG Verifiedbnema
bcbd4d9security: harden production deployment defaults GPG Verifiedbnema
851aaceMerge pull request #150 from bnema/fix/registry-prune-space-reclaimed merge GPG Unverifiedbnema

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 7

Tags 106

↑↓ moveenter openesc close