fix: anonymise the maintainer's own host addresses across the repo - #22
Merged
Conversation
A repo-wide sweep found the maintainer's real LAN and Zima Net
addresses in docs, API examples, the session-auth tool and 11 test
files — 29 occurrences of 5 values, published since v1.0.0. None of
them is needed: every site wants "a host on the LAN", not that host.
192.168.1.143 -> 192.168.1.100 17x own ZimaCube
192.168.1.167 -> 192.168.1.100 7x own test ZimaCube
192.168.1.147 -> 192.168.1.101 1x own second host
10.126.126.243 -> 10.126.126.20 1x own Zima Net client address
10.126.126.1 -> 10.126.126.10 3x own Zima Net server address
RFC 5737 documentation addresses were considered and rejected: they
are public space, and these tests and examples exist precisely to
exercise RFC 1918 LAN semantics. The replacements stay private-range
and belong to nobody.
One assertion did not fall to the textual replacement because it
spells the address as separate bytes — `[]byte{192, 168, 1, 143}` in
flush_linux_test.go. `go test ./...` caught it; that it did is worth
noting, since it means the assertion is not tautological.
.public-data-allow records the values that are deliberately public
(invented test addresses; the copyright holder and the security
contact where a licence and a disclosure policy require them), each
scoped to its file where a file scope applies.
Not in this commit: BUG-BOUNTY.md (PR #20) and internal/audit/audit.go
(PR #21) carry the last two findings. With all three applied the
sweep reports clean — verified by merging the branches locally:
"check-public-data: clean", exit 0.
Verified: go build ./..., go vet ./..., go test ./... all pass.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GRUX9ZKesnvfMooL7UFPtX
chicohaager
added a commit
that referenced
this pull request
Sep 5, 2026
… SBOM Version stamps moved to 1.0.25: VERSION, README release block and Docker Hub example, Dockerfile usage comment, docs/openapi.yaml, the UI cache-busters and mod-store/zfw.yaml. Checksums in mod-store/zfw.yaml are taken from dist/*.sha256 of the build that produces the published assets, not typed. That build ran with SOURCE_DATE_EPOCH=1788616346, and this commit carries exactly that committer date, so `git checkout v1.0.25 && sh build.sh` reproduces the assets byte for byte without any override — reproducibility holds per commit, and the tag points at this one. One more input: cyclonedx-gomod stamps the main component with the version from the nearest git tag, so the assets were built with the v1.0.25 tag already on this commit — the tag is part of the reproducibility contract, not just a label. Two more inputs surfaced when the CI build of the first tag was compared with the local one — identical content, different checksums: file modes followed the build host's umask (002 here, 022 on the runner), and the SBOM records cyclonedx-gomod's own binary hash, which carried the install host's paths. build.sh now sets umask 022 and normalises every packed mode, and the tool is installed with -trimpath on both sides, so the CI build of this tag carries the same checksums as the assets below. amd64 5fd760a1d23e3b3c70a81680f98f2422ec4af6b807c26513ce22d6c00b358bc3 arm64 1039d46959566f8065ba9499eb2ff0e5a7ea9080e8a45b80b7107aa47e20c80c Verified on the shipped payload rather than the build log: the daemon unpacked out of dist/zfw-amd64.raw reports go1.27.1 and carries the version string 1.0.25 (and no other 1.0.2x); the README inside the tarball leads with the v1.0.25 release block; sbom.json is inside the tarball; the bundled BUG-BOUNTY.md passes the private-data scan. What ships (since v1.0.24): #23 Exposure/Audit judged from rules.json, per-rule and IPv6 docker events visible; #24 Go 1.27.1 pinned via go.mod and used by every CI job, ECDSA key parsing via ParseUncompressedPublicKey, SBOM step repaired; #19–#22 LICENSE file, maintainer's host addresses and username removed from docs, API examples and the shipped M8 finding. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GRUX9ZKesnvfMooL7UFPtX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A repo-wide sweep — the one that should have run before every publication and did not — found the maintainer's real host addresses in 29 places across 15 files, public since v1.0.0: documentation, the OpenAPI examples,
tools/check-session-auth.pyand eleven test files.192.168.1.143192.168.1.100192.168.1.167192.168.1.100192.168.1.147192.168.1.10110.126.126.24310.126.126.2010.126.126.110.126.126.10Why not RFC 5737.
203.0.113.0/24and friends are public address space, and these tests and examples exist precisely to exercise RFC 1918 LAN semantics — a firewall rule that treats a documentation address as "the LAN" would be testing the wrong thing. The replacements stay private-range and belong to nobody.One that a textual replacement could not reach.
internal/conntrack/flush_linux_test.gospells the expected address as separate bytes —[]byte{192, 168, 1, 143}— so it survived the sweep andgo test ./...failed on it. Worth stating plainly: that the test failed is the good news, it means the assertion is not tautological. Fixed, and a follow-up grep for the same shape (\{ *192, *168, *1, *(143|147|167) *\}) returns nothing..public-data-allowrecords what is deliberately public, so the check can reach zero rather than being ignored: the invented addresses in the test suite, and the copyright holder and security contact in the files where a licence and a disclosure policy require them — each scoped to its file where a file scope applies.Verification
go build ./...,go vet ./...,go test ./...— all pass.BUG-BOUNTY.md) and fix(audit): remove the maintainer's username from the shipped M8 finding #21 (internal/audit/audit.go), which branch off the same master.clean — no usernames, home paths, private host addresses or e-mail addresses found, exit 0.Not fixed here: the values remain in git history. Rewriting it for RFC 1918 addresses is not worth the disruption; "gone from the tree" is not "gone from the repo", and this PR does not claim otherwise.
🤖 Generated with Claude Code
https://claude.ai/code/session_01GRUX9ZKesnvfMooL7UFPtX