BaaRai 65bdc5d73c fix(auth): keep the JWT signing key in a dedicated volume ...

The server wrote jwt.key to the executable's directory, /app in the
image, so it lived in the container's writable layer and every container
rebuild generated a new key and signed all users out.

- ARTEX_JWT_KEY_DIR selects the key directory (default: config.BaseDir(),
  unchanged for non-Docker installs). docker-compose.yml sets it to
  /app/keys and bind-mounts ./keys there; the Dockerfile declares the
  volume. The key stays out of data/, which the file manager browses.
- loadOrCreateJWTKey creates the directory (0700). When keyDir/jwt.key is
  missing it migrates dataDir/jwt.key, then BaseDir()/jwt.key (mode 0600,
  old file removed), otherwise generates a new key. An existing key is
  never overwritten; a short one is now a startup error.
- .gitignore and .dockerignore exclude keys/.
- README and CHANGELOG updated; the 0.5.0 known issue is removed.

2026-11-04 09:18:11 +01:00

..

benchmark

fix(auth): keep the JWT signing key in a dedicated volume

2026-11-04 09:18:11 +01:00

poc/php2shell

feat(skill): php2shell - gated session.upload_progress LFI-to-RCE skill with vendored PoCs

2026-10-21 14:52:40 +02:00

submission_review

feat: pre-submission report review (validate against program rules)

2026-10-12 08:09:57 +02:00

backup.sh

fix(backup): reject --keep 0 so the new dump is never pruned

2026-11-03 23:18:45 +01:00

posture_check.py

feat: refusal-posture probe for LLM profiles

2026-10-12 07:01:40 +02:00