oriolrius/pki-manager-web v3.4.1

v3.4.1 — krl-client security hardening

on GitHub

Security hardening (krl-client)

Two defense-in-depth fixes for the krl-client host agent, from the v3.4.0 pre-release review. Neither is exploitable under default settings — both require a compromised backend or the explicit --insecure flag — and the guaranteed revocation floor (the bare, TLS-served, CA-signed public KRL + short cert TTLs) is unaffected. This is a monorepo patch bump 3.4.0 → 3.4.1.

Fixes

• Bounded KRL response body ([TASK-174]) — medium. The 200 response body is now read through a size-limited reader and fails closed (exit 2) when it exceeds the ceiling, instead of an unbounded io.ReadAll. This prevents a compromised/malicious endpoint (or a MITM under --insecure) from streaming an oversized body and OOM-killing the agent, which runs as root from cron/systemd. New documented flag --max-response-bytes (env KRL_CLIENT_MAX_RESPONSE_BYTES / config key max-response-bytes, default 8 MiB).

• Insecure-TLS runtime warning ([TASK-176]) — low. When TLS verification is disabled (--insecure), the client now emits a WARN (event=insecure_tls) on every run — surfacing even under --quiet — so a host is never silently left unverified.

Both changes ship with regression tests; the README and the krl-client(8) man page are updated. Release artifacts (static linux/amd64 binary, SHA-256 checksums, keyless cosign signature, SPDX SBOM) and their verification steps are unchanged from v3.4.0.

Still queued: TASK-175 (bind anti-rollback to the CA-signed KRL header number rather than the unsigned envelope field) — low severity, deferred until the KRL-parsing path is next touched.

Full Changelog: v3.4.0...v3.4.1