Jeremie Fraeys 7efe8bbfbf native: security hardening, research trustworthiness, and CVE mitigations ... Security Fixes: - CVE-2024-45339: Add O_EXCL flag to temp file creation in storage_write_entries() Prevents symlink attacks on predictable .tmp file paths - CVE-2025-47290: Use openat_nofollow() in storage_open() Closes TOCTOU race condition via path_sanitizer infrastructure - CVE-2025-0838: Add MAX_BATCH_SIZE=10000 to add_tasks() Prevents integer overflow in batch operations Research Trustworthiness (dataset_hash): - Deterministic file ordering: std::sort after collect_files() - Recursive directory traversal: depth-limited with cycle detection - Documented exclusions: hidden files and special files noted in API Bug Fixes: - R1: storage_init path validation for non-existent directories - R2: safe_strncpy return value check before strcat - R3: parallel_hash 256-file cap replaced with std::vector - R4: wire qi_compact_index/qi_rebuild_index stubs - R5: CompletionLatch race condition fix (hold mutex during decrement) - R6: ARMv8 SHA256 transform fix (save abcd_pre before vsha256hq_u32) - R7: fuzz_index_storage header format fix - R8: enforce null termination in add_tasks/update_tasks - R9: use 64 bytes (not 65) in combined hash to exclude null terminator - R10: status field persistence in save() New Tests: - test_recursive_dataset.cpp: Verify deterministic recursive hashing - test_storage_symlink_resistance.cpp: Verify CVE-2024-45339 fix - test_queue_index_batch_limit.cpp: Verify CVE-2025-0838 fix - test_sha256_arm_kat.cpp: ARMv8 known-answer tests - test_storage_init_new_dir.cpp: F1 verification - test_parallel_hash_large_dir.cpp: F3 verification - test_queue_index_compact.cpp: F4 verification All 8 native tests passing. Library ready for research lab deployment.		2026-02-21 13:33:45 -05:00
..
api-server	security: implement comprehensive secrets protection	2026-02-18 16:18:09 -05:00
configlint	ci: align workflows, build scripts, and docs with current architecture	2026-01-05 12:34:23 -05:00
data_manager	refactor(dependency-hygiene): Move path functions from config to storage	2026-02-17 21:15:23 -05:00
db-utils	ci: align workflows, build scripts, and docs with current architecture	2026-01-05 12:34:23 -05:00
errors	feat: implement research-grade maintainability phases 1,3,4,7	2026-02-18 15:27:50 -05:00
gen-keys	feat: implement Argon2id hashing and Ed25519 manifest signing	2026-02-19 15:34:20 -05:00
performance-regression-detector	chore(build): update build system, scripts, and additional tests	2026-02-12 12:05:55 -05:00
profiler	chore(build): update build system, scripts, and additional tests	2026-02-12 12:05:55 -05:00
tui	native: security hardening, research trustworthiness, and CVE mitigations	2026-02-21 13:33:45 -05:00
user_manager	feat: implement Argon2id hashing and Ed25519 manifest signing	2026-02-19 15:34:20 -05:00
worker	feat(worker): add integrity checks, snapshot staging, and prewarm support	2026-01-05 12:31:13 -05:00