v0.2.0 — Bounded requests, subpath support and security hardening

v0.2.0 — bounded requests and subpath support

2026-10-30 · Source release / 源码正式版

继续复用 bg6cq/speedtest@57e2c9af911d8c392b16b6167249444b7b1107ed；不重写测速引擎或 Worker，不加入结果数据库、全站日额度或个人收款码。

Changes

• HAProxy connection/request limits and trusted PROXY v2 to a loopback Apache/FPM backend.
• Atomic payload slots with owner-only release and expiry; a 12-request payload ceiling reserves four of the 16 PHP workers for control work.
• Existing per-address 2/5min and 5/12h quotas retained. Wider IPv6-prefix/global short windows reduce address-rotation abuse without applying the five-test quota to an entire /64.
• Redis TIME/deadline checks reject stale queued Lua operations before writes. This fixes the reproduced delayed-admission/ghost-quota failure, not arbitrary exactly-once delivery.
• Optional /speedtest/ routes and path-scoped session cookies, without changing upstream relative URLs.
• Fixed image/extension inputs, fresh exact-image scan and inventory checks, CI browser/failure tests, and opt-in checksummed database export for offline deployment audits.

Upgrade notes

1. Review and rebuild all three images. Do not overlay the public loopback Compose directly on a private production deployment.
2. Update the page, PHP, Lua scripts and Redis ACL together. Custom callers must send X-Speedtest-Action: start; the unchanged upstream Worker is still driven by the page.
3. Redis restart clears quotas/sessions because persistence remains disabled. Schedule a maintenance window and preserve a rollback checkpoint.
4. Recheck actual client addresses, TLS identity/renewal, old routes and any co-hosted application. Never expose the plaintext PROXY backend or trust arbitrary forwarding headers.

Evidence and limits

See the security audit for scope, commands, passed checks and residual risk. CI includes native Docker and a real Chromium Worker; loopback throttling is functional evidence only.

Still unverified: representative wired-gigabit saturation and shared-network impact, broad real-device compatibility, production-scale shared-prefix fairness, and exact hard interruption at 12/14 seconds under blocked I/O. FPM timeout/lease bounds are not a substitute for those claims. A valid single test can still saturate its link. No claim of “zero vulnerabilities,” DDoS resistance or production-security certification is made.

Public source and release assets contain a nonpayable donation placeholder, not the maintainer's payment image, private CA, keys, cookies, campus authentication or private deployment configuration.

Release verification

Merged source checks: https://github.com/Tak1naa/SpeedTest/actions/runs/41070344941 . The attached audit addendum records exact-image scan provenance, the blocked stale curl candidate, verified 8.23.0 rebuild, rollback/integrity behavior and remaining risks.

The tarball contains public source only; SHA256SUMS is attached. Rebuild cached installations with docker compose build --pull --no-cache and run the fresh exact-image scan. Do not deploy the public loopback Compose over a private production configuration.

Final production follow-up

The maintainer confirmed post-maintenance mobile IPv6 no certificate warning, full /speedtest/ completion and a normal /cycle/ page. Independent strict TLS, exact-image/29-host-file/17-runtime-file, ACL/privacy, renewal-rehearsal and unchanged co-tenant identity checks passed. The maintenance checkpoint is committed and the rollback timer is stopped. No OW/PVE or CycleRoute container restart and no ingress-range change were made.

The attached FINAL_VERIFICATION_v0.2.0.json and its checksum supersede the mobile-pending state in the original audit addendum, which is retained unchanged as publication-time evidence. No throughput numbers were supplied by this final confirmation. Wired gigabit saturation, shared-network impact and the other documented unverified/mitigated risks remain open.

v0.1.0 — First standard source release

v0.1.0 — First standard source release

首个非预发布源码正式版。This is a source release, not a production-security certification or a gigabit performance guarantee.

Included

• Bilingual Chinese/English README, real desktop/mobile/support-dialog screenshots, and a non-payable public support placeholder.
• CONTRIBUTING and SECURITY policies, issue/PR templates, private vulnerability reporting, dependency update configuration, repository description and Topics.
• A public v0.2.0 milestone and issue-backed roadmap for compatibility, failure handling, installation boundaries, abuse resistance, supply-chain evidence and performance/recovery testing.
• Patched PHP 8.3.36 base digest and minimum-runtime gate, disabled unused upload-progress tracking, and a Redis health-timeout 503 fix.
• Read-only, commit-pinned GitHub Actions: source/static checks, PHP lint, real Lua admission races, public container build/start, Chromium Worker/cancel/quota/release, strict TLS/error checks, and sanitized screenshot artifacts.

Preserved

The upstream LibreSpeed/bg6cq measurement engine, Worker, endpoint paths, original attribution and LGPL-3.0 license. Default public-source listeners remain loopback-only. No private production configuration, credentials, certificates or personal payment QR code is included.

Verification and limitations

Local available offline/Lua/static checks and PHP checks in the official 8.3.36 runtime passed. Local ShellCheck was explicitly skipped; CI installs and requires it. The interface screenshots were visually reviewed; they show the idle public template, not fabricated measurements. Full Docker/Chromium evidence is linked below.

Throttled loopback measurements are functional evidence, not real-world throughput. Public deployment still requires reviewed TLS, routing/firewall and client-IP boundaries, request-level abuse protection, fresh dependency scans and representative load/recovery testing. See SECURITY.md. Open roadmap issues remain open.

The historical v0.1 prerelease is retained unchanged. Verify the attached source archive using SHA256SUMS before extraction.

Development and review: #8

Release commit: 199c3aa6ab41465705c8263bd48c8ef8256cd950.

• PR checks
• Main-branch checks
• v0.1.0 tag checks

Attached archive SHA256: 50a72388052870de53318b719e041187176c2ea6ab85bde7af65d567d3e57de1. All 109 files were compared byte-for-byte with the release tag before upload.

v0.1 — 校园 IPv4 试运行

v0.1 · 校园 IPv4 试运行

首个公开版本，基于 bg6cq/speedtest@57e2c9af911d8c392b16b6167249444b7b1107ed。保留上游测速引擎与 Worker，增加中文界面、隐私与支持弹窗、Redis 原子会话保护，以及可本机验证的 Compose 配置。

本版内容

• 全站同时一个测速会话；每 IP 五分钟最多两次、滚动十二小时最多五次；无全站日流量限额。
• 保留原测速 URL，支持取消/结束释放、阶段截止、有界上传与下载流量保护。
• 不启用 telemetry、结果数据库、结果分享及 ISP 查询。
• 公开配置默认仅回环可达；官方 PHP / Redis 基础镜像，Redis 扩展固定 6.1.0。
• 不公开个人收款码：捐助弹窗使用居中的无支付功能占位图。密钥、私有证书、生产拓扑和校园认证配置未公开；生产站点未改动。

验证

对应源码提交已通过 GitHub Actions 的离线契约/PHP 检查、官方基础镜像构建、Compose 启动、TLS 健康、占位图和异常 Host 拒绝测试。本机隔离实例的真实 Worker、取消/重测、竞争准入拒绝、Cookie/锁释放，以及 Chrome/Firefox 手机与桌面宽度的占位图弹窗检查通过。凭据扫描无检出；不代表完整安全认证。

已知边界

这是 prerelease，不是完成所有公众上线验收。千兆有线满载/寝室真实终端影响、校园认证自然失效后的自动恢复仍待验证；外部 IPv6 与默认可信证书暂缓。Redis 非持久化，重启会重置次数；单会话仍可占满共享线路。

公开配置是脱敏后的通用导出，不能覆盖现有生产部署；镜像移动标签不保证字节复现，生产需自行审核、固定 digest 并重新扫描。部署、许可及完整范围见 README、UPSTREAM、VALIDATION 和 CHANGELOG。

附带源码包只由本次 Git 标签生成；SHA256 文件用于下载完整性核对，不是数字签名。保留上游 LGPL-3.0 许可证。