🧊 Coldkeep v1.10.2 — Validation & Security Hardening

[franchoy]

Coldkeep v1.10.2 — Validation & Security Hardening

Release Type

Stabilization / security hardening release.

Summary

Coldkeep v1.10.2 is the second release in the v1.10 Reliability Freeze, CI Hardening & Correctness Burn-down train.

This release hardens Coldkeep’s validation and security posture around filesystem boundaries, stored paths, restore destinations, symlink-sensitive writes, temporary-file cleanup, environment/config parsing, PostgreSQL DSN construction, Go/toolchain CVE exposure, and security-sensitive script arguments.

This release does not add product features. It does not start engine extraction. It does not change the default database backend. It does not introduce daemon/API/UI work, packed-storage redesign, GC reachability changes, or broad restore/recovery rewrites.

---

Highlights

• Added central path-safety primitives.
• Validated container filenames before filesystem joins.
• Rejected unsafe stored/snapshot paths.
• Hardened restore destination containment.
• Blocked symlink-sensitive restore write escapes.
• Hardened restore temp/rename/cleanup behavior.
• Hardened environment/config parsing.
• Centralized and hardened PostgreSQL DSN construction.
• Remediated Go/toolchain CVE exposure.
• Hardened security-sensitive script arguments.
• Completed mandatory pre-release checklist execution.
• Merged through PR with CI green.
• Codacy confirmed no new issues added after follow-up fixes.

---

Security and Validation Improvements

Path Safety

v1.10.2 adds shared path-safety primitives and applies them across security-sensitive boundaries.

Covered behavior includes rejection of:

• empty unsafe path values,
• path traversal such as ..,
• Unix absolute paths where relative paths are required,
• Windows-drive paths,
• UNC-like paths,
• NUL-containing values,
• unsafe container filenames,
• unsafe stored/snapshot logical paths.

Valid nested relative paths remain supported where appropriate.

Container Filename Trust Boundary

Container filenames are now validated before being joined with trusted filesystem roots.

Rejected filename classes include:

• path separators,
• traversal names,
• absolute paths,
• Windows-drive paths,
• UNC-like names,
• NUL bytes,
• empty or invalid filename components.

Stored / Snapshot Path Traversal Rejection

Stored and snapshot logical paths are validated as safe relative paths.

This prevents unsafe stored metadata from representing paths that escape intended boundaries during later operations.

Restore Destination Safety

Restore target construction now verifies output paths remain inside the selected restore destination root before writing.

Unsafe restore paths fail deterministically before filesystem writes.

Symlink-Sensitive Restore Write Safety

Restore writes now reject unsafe symlink participation at restore boundaries.

This prevents lexically safe paths from escaping the destination root through symlinked parent directories or symlinked final targets.

Temp / Rename / Cleanup Safety

Restore temp cleanup now includes ownership/scope guards so cleanup only removes restore-owned temporary artifacts in the destination parent directory.

This reduces risk from unsafe cleanup paths and partial write states.

Environment / Config Parsing

Environment-derived configuration is now parsed more strictly and deterministically.

Hardened behavior includes:

• strict integer parsing,
• rejection of partial-token integer parsing,
• whitespace-only explicit values rejected where invalid,
• deterministic setting-name errors,
• malformed explicit boolean values rejected,
• invalid enum values rejected instead of silently falling back,
• NUL validation for path-like environment values.

PostgreSQL DSN / Options Construction

PostgreSQL DSN construction is now centralized and validated.

This hardens:

• component escaping,
• sslmode allowlist validation,
• port validation,
• NUL rejection,
• database name overrides,
• option-injection prevention,
• benchmark/test call paths that construct PostgreSQL DSNs.

SQLite/local non-PostgreSQL behavior remains unaffected.

Go / Toolchain CVE Remediation

Phase 9 remediated Go/toolchain CVE exposure.

Before remediation:

• vulnerability scan found 22 reachable Go standard-library vulnerabilities on Go 1.23.1.

After remediation:

• govulncheck ./... reported no vulnerabilities found.

Script Argument Validation

Security-sensitive scripts now validate path-like, identifier-like, and executable-like arguments before filesystem or shell operations.

Hardened behavior includes rejection of:

• empty and whitespace-only identifiers,
• shell metacharacters,
• path traversal,
• absolute paths where relative paths are required,
• binary paths containing ..,
• missing or invalid executable paths where applicable.

Invalid script inputs exit with code 1 and deterministic diagnostic errors.

---

Fixed / Covered Remediation Areas

v1.10.2 covered the validation/security hardening rows tracked in the v1.10.2 release inventory, including:

• central path safety,
• container filename validation,
• stored/snapshot path traversal rejection,
• restore destination safety,
• symlink policy and regression coverage,
• temp/rename/cleanup safety,
• environment parsing hardening,
• PostgreSQL DSN/options hardening,
• Go/toolchain CVE remediation,
• security-sensitive script argument validation.

Known covered matrix rows include:

• CK-110-M083 — temp / rename / cleanup safety.
• CK-110-M013 — environment parsing hardening.
• CK-110-M012 — PostgreSQL DSN / options construction.
• CK-110-M009 — Go/toolchain CVE remediation.
• CK-110-M043 — security-sensitive script argument validation.

---

Validation

Implementation Phase Validation

Across the v1.10.2 implementation phases, validation included:

• gofmt on changed Go files,
• targeted path-safety tests,
• targeted container filename tests,
• targeted stored/snapshot path traversal tests,
• targeted restore destination tests,
• targeted symlink restore tests,
• targeted temp/rename/cleanup tests,
• targeted environment/config parsing tests,
• targeted PostgreSQL DSN/options tests,
• govulncheck ./...,
• go vet ./...,
• go test ./...,
• go test -race ./....

Mandatory Pre-Release Checklist

Mandatory pre-release execution completed green under the approved v1.10.2 constraints.

Executed checklist sections:

• sections 1–3,
• sections 5–11,
• sections 15–18.

Approved adaptation:

• Step 8 clean-install checks were run without volume deletion.

Skipped by instruction:

• Step 4,
• historical sections 12–14.

Gate outcomes:

• formatting checks passed,
• shell linting passed,
• matrix validation passed,
• golangci-lint passed,
• go vet passed,
• race tests passed,
• build passed,
• CI audit passed,
• CI-equivalent matrix passed for plain and aes-gcm, including smoke,
• snapshot release gate passed,
• doctor/bootstrap behavior checks passed,
• CLI contract checks passed,
• batch contract checks passed,
• physical-file lifecycle checks passed,
• snapshot retention manual lifecycle gate passed,
• v1.7 compatibility gate passed with a supplied v1.7.0 binary artifact.

Pull Request Validation

The pull request completed with:

• CI green,
• Codacy reporting no new issues added after follow-up fixes,
• merge completed into main.

---

Compatibility Notes

This release intentionally makes unsafe or malformed inputs fail earlier and more strictly.

Scripts, automation, test fixtures, or manual workflows that relied on malformed values, unsafe path shapes, unescaped PostgreSQL DSN components, unsafe script arguments, or silent env/config fallback behavior may need adjustment.

Expected valid usage remains supported.

---

Documentation and Tracking

v1.10.2 added or updated release tracking documentation for:

• phase baseline and scope,
• path-safety phase notes,
• symlink policy,
• temp/rename/cleanup hardening,
• environment parsing hardening,
• PostgreSQL DSN hardening,
• toolchain CVE remediation,
• script argument validation,
• test inventory,
• phase status,
• checklist,
• release validation evidence.

---

Out of Scope

The following work is intentionally deferred to later v1.10.x releases:

• packed-storage metadata integrity,
• GC correctness and reachability corrections,
• full restore/recovery rewrite,
• Codacy passive integration and scanner suppression policy,
• critical-path coverage gates,
• full filesystem abstraction,
• full filesystem fault injection framework,
• engine extraction,
• catalog abstraction,
• network/NAS/cloud expansion.

---

Release-Train Context

v1.10.2 belongs to the v1.10 stabilization train, whose purpose is to turn the v1.9 functionally complete system into a trust-complete baseline before engine extraction begins in v1.11.

The v1.10 train remains fixes-only: correctness, validation, recovery safety, scanner triage, CI improvement, and regression hardening only.

---

This discussion was created from the release 🧊 Coldkeep v1.10.2 — Validation & Security Hardening.