Repository navigation
Releases: netresearch/typo3_http_guard
Release list
v0.1.4
Changes
- Merge pull request #20 from netresearch/test/dns-readiness-20261018
- Merge pull request #19 from netresearch/release/v0.1.4
- Merge pull request #18 from netresearch/test/close-adapter-mutation-gaps-20261018
- Merge pull request #17 from netresearch/chore/bestpractices-20261018
- Merge pull request #16 from netresearch/docs/branding-and-publication-20261018
Installation
composer require netresearch/nr-http-guardPublication status
- TER: extensions.typo3.org/extension/nr_http_guard — 0.1.4 verified
- Packagist: packagist.org/packages/netresearch/nr-http-guard — 0.1.4 verified
- Documentation: render pending — will appear at docs.typo3.org/p/netresearch/nr-http-guard/0.1/en-us/
Security
All release artifacts are signed with Sigstore keyless signing.
Verify signatures
cosign verify-blob \
--bundle nr-http-guard-0.1.4.zip.sigstore.json \
--certificate-identity-regexp "https://github.com/netresearch/.*" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
nr-http-guard-0.1.4.zipVerify checksums
sha256sum -c checksums.txtSoftware Bill of Materials (SBOM)
SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.
v0.1.3
HTTP Guard 0.1.3 is an alpha packaging correction. @CybotTM aligned GitHub, Composer and TER packages in #15. Independently downloaded packages from all three channels now contain the same 177 files. Both documentation .editorconfig files remain in the repository and are excluded from installable packages.
Release verification reads the two explicit exclusions from the selected immutable source. The previous 0.1.2 canonical archive remains byte-for-byte reproducible with its original 179 files. Two maintained regression tests cover source selection and rejection of symlinked packaging metadata; all 120 Build tests pass in CI.
Installation
composer require netresearch/nr-http-guardPublication status
- TER: extensions.typo3.org/extension/nr_http_guard — 0.1.3 verified
- Packagist: packagist.org/packages/netresearch/nr-http-guard — 0.1.3 verified
- Documentation: render pending — will appear at docs.typo3.org/p/netresearch/nr-http-guard/0.1/en-us/
Security
All release artifacts are signed with Sigstore keyless signing.
Verify signatures
cosign verify-blob \
--bundle nr-http-guard-0.1.3.zip.sigstore.json \
--certificate-identity-regexp "https://github.com/netresearch/.*" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
nr-http-guard-0.1.3.zipVerify checksums
sha256sum -c checksums.txtSoftware Bill of Materials (SBOM)
SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.
Contributors
Assets 12
v0.1.2
Highlights
HTTP Guard adds plug-and-play SSRF protection to TYPO3's registered HTTP client (RequestFactory). Its default policy blocks private, loopback, cloud metadata and special-purpose destinations, checks DNS answers and redirects, and pins permitted connections to verified addresses. The security core, TYPO3 integration, policy data and English/German manuals ship in one extension, including for classic TER installations.
Version 0.1.2 remains an alpha. PR #12, maintained by @CybotTM, strengthens malformed authority, DNS and runtime-input handling and transfer cleanup. It also completes the applicable assessment corrections and consolidates maintained documentation, tests and tooling under Documentation/, Tests/ and Build/.
The manual restores all 14 original architecture decision records, retaining their complete historical proposals, and adds accepted ADRs for the single extension, public RequestFactory boundary, controlled DNS resolution and single-use cURL factory. Both language versions are included in the package. Historical proposals and executed verification results remain explicitly distinguished.
The repository now runs shared style, level 10 static analysis, architecture, fuzz, policy-performance and whole-file mutation checks. This release also permits Symfony Console 8 in compatible dependency graphs (PR #10), corrects coverage source mapping (PR #11), and corrects archive-provenance verification (PR #9). @renovate[bot] contributed the dependency update.
The guarded path covers the registered TYPO3 HTTP client and HTTP Guard's own factories. Independent cURL calls, sockets and unrelated SDK clients need their own integration. Hosted documentation and OpenSSF registration retain their separately reported provider states.
Installation
composer require netresearch/nr-http-guardPublication status
- TER: extensions.typo3.org/extension/nr_http_guard — 0.1.2 verified
- Packagist: packagist.org/packages/netresearch/nr-http-guard — 0.1.2 verified
- Documentation: render pending — will appear at docs.typo3.org/p/netresearch/nr-http-guard/0.1/en-us/
Security
All release artifacts are signed with Sigstore keyless signing.
Verify signatures
cosign verify-blob \
--bundle nr-http-guard-0.1.2.zip.sigstore.json \
--certificate-identity-regexp "https://github.com/netresearch/.*" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
nr-http-guard-0.1.2.zipVerify checksums
sha256sum -c checksums.txtSoftware Bill of Materials (SBOM)
SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.
Contributors
Assets 12
v0.1.1
Highlights
HTTP Guard adds plug-and-play SSRF protection to TYPO3's standard HTTP client (RequestFactory). Install and activate the extension to protect existing calls through the registered factory, without rewriting callers or configuring a custom policy.
The default enforce mode blocks private, loopback, cloud metadata and special-purpose destinations before a connection starts. This protects applications that fetch URLs from user input, imports or external payloads. DNS results and redirect targets are checked, and permitted connections are pinned to verified IP addresses. Internal integrations require clients explicitly bound to trusted endpoint profiles.
The security core, TYPO3 integration, address rules and English/German manuals ship in one extension. Version 0.1.1 is an alpha for evaluation. The protected path covers the registered TYPO3 HTTP client and clients created through HTTP Guard's factories. Direct cURL calls, custom sockets, early bootstrap requests and unrelated SDK clients require separate integration. Independent human security review and an operator pilot remain outstanding for production acceptance.
For 0.1.1, @CybotTM corrected the shared sign-off check's CI event gating. The original signed 0.1.0 tag remains unchanged; its release gate stopped before GitHub artifact and TER publication.
Installation
composer require netresearch/nr-http-guard:^0.1Classic installations need no separate HTTP Guard library. Use the TER package for Extension Manager installation or ZIP import. GitHub release archives contain an enclosing nr-http-guard/ directory; copy its contents into the extension directory for manual installation.
Publication status
- TER: extensions.typo3.org/extension/nr_http_guard — 0.1.1 verified
- Packagist: packagist.org/packages/netresearch/nr-http-guard — 0.1.1 verified
- Documentation: registered; main and 0.1 remain Awaiting Approval in TYPO3 Intercept. The hosted manuals are not yet available; the versioned manual is expected at docs.typo3.org/p/netresearch/nr-http-guard/0.1/en-us/.
English and German manuals are included in the package. The English and German sources are available now.
Security
The two source archives, two SBOMs and checksums.txt are signed with Sigstore keyless signing. Independent verification passed for all five blob signatures and four checksum targets, with the signed checksum file preserved. The GitHub ZIP, TAR and TER package each contain the same 131 canonical files, matching every file path and hash.
One signed SLSA-v1 provenance statement contains the two GitHub archive subjects, bound to tag v0.1.1, source commit 3997089a259b6b919eed4e6c3bf7f6715b948ad1 and the resolved reusable signer workflow. These checks do not establish SLSA level 3 certification.
Verify signatures
Download this release's payloads and signature bundles:
gh release download v0.1.1 \
--repo netresearch/typo3_http_guard \
--dir http-guard-0.1.1
cd http-guard-0.1.1cosign verify-blob \
--bundle nr-http-guard-0.1.1.zip.sigstore.json \
--certificate-identity "https://github.com/netresearch/typo3-ci-workflows/.github/workflows/release-typo3-extension.yml@refs/heads/main" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
nr-http-guard-0.1.1.zipThe same command verifies the TAR, either SBOM or checksums.txt when both filenames are replaced with that payload's name and matching .sigstore.json bundle.
Verify checksums
Verify the checksum file's signature first, then check its four payload entries without changing the file:
cosign verify-blob \
--bundle checksums.txt.sigstore.json \
--certificate-identity "https://github.com/netresearch/typo3-ci-workflows/.github/workflows/release-typo3-extension.yml@refs/heads/main" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
checksums.txt
sha256sum -c checksums.txtSoftware Bill of Materials (SBOM)
SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.
Download the SPDX SBOM or CycloneDX SBOM. These signed documents are supplemental repository inventories; they do not provide a resolved PHP/TYPO3 runtime dependency graph or an archive-only file inventory. The archive provenance statement does not attest the SBOMs.
Workflow verification
The original publishing workflow published the release and registry packages, then finished with a failure because its attestation-verification command combined mutually exclusive GitHub CLI flags. Independent verification of the published artifacts passed. The corrected verification workflow was merged in PR #9. Its trusted verifier reads the released source as immutable package data.
The verification-only workflow run passed for the existing v0.1.1 release against its original publisher. Both publishing jobs were skipped, and all ten existing asset IDs and digests remain unchanged.