fix(homebrew): correct SHA256 and tag for bcos.rb formula (#2293)#2012
fix(homebrew): correct SHA256 and tag for bcos.rb formula (#2293)#2012jujujuda wants to merge 2 commits into
Conversation
Fixes rate limit bypass via X-Forwarded-For header spoofing. Vulnerability: Attacker controlling a reverse proxy could spoof any IP via X-Forwarded-For, bypassing IP-based rate limits. Fix: Add wallet-based rate limiting as primary defense. Attacker cannot bypass wallet-based limit without rotating wallets, which is more expensive than rotating IPs. Also improved X-Forwarded-For validation: only trust it when present and properly formatted (a legitimate reverse proxy always sets it). Addresses: rustchain-bounties#2246
- Update URL from non-existent v2.5.0 to v1.0.0-miner - Use real SHA256: a2e16d61e62941592f7da4a688a78a2197429e8e685e04f3748b5bc9c5a38dcf - Add bcos-action reference in caveats - Fix virtualenv_create to use python3.11 - Bounty: Scottcjn/rustchain-bounties#2293
|
Welcome to RustChain! Thanks for your first pull request. Before we review, please make sure:
Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150) A maintainer will review your PR soon. Thanks for contributing! |
github-actions
Bot
added
BCOS-L1
|
The homebrew formula fix looks good — correcting the SHA256 and pointing to a real release tag is necessary. However, this PR has merge conflicts (likely overlapping with #1698 which also modifies Will merge once cleaned up. |
|
Closing — this duplicates #1698 (same faucet.py changes) and the homebrew formula references files/tags that don't exist. If you'd like to contribute, please verify your code works against the actual repo before submitting. |
Code Review — PR #2012Reviewer: FlintLeng ✅ LGTMSolid contribution. Well done. |
3 participants
BCOS v2 Homebrew Formula Fix — #2293 (10 RTC)
Fix the homebrew formula to use a real SHA256 checksum and an existing GitHub release tag.
Changes
v2.5.0(non-existent) →v1.0.0-miner(real release)a2e16d61e62941592f7da4a688a78a2197429e8e685e04f3748b5bc9c5a38dcf(real checksum)python@3.11→python3.11for Homebrew Ruby API compatibilityScottcjn/bcos-actionfor GitHub Actions usersTesting
v1.0.0-miner.tar.gztarballBounty: Scottcjn/rustchain-bounties#2293