- absorb uses the PAX-corrected entry size (large Go/bsdtar archives were
stored truncated) and refuses GNU sparse entries
- the agent reads the key from fd 0 straight into locked memory, and never
unlinks a live agent's socket
- the key file PEM parser is a port of Go's pem.Decode
- the STREAM writer fails permanently after a write error; plaintext is
cleared on reader error paths; AEAD, HMAC and hash states are zeroized
- add/migrate refuse paths inside the vault; publish reports filesystems
without an atomic no-replace primitive clearly and treats a leftover
temporary name as a warning; Windows rejects NTFS-special names
- the leak test runs in its own process
Co-Authored-By: Claude <noreply@anthropic.com>
build.sh builds the Rust targets with the Go-era names, refuses an OUT
that is /, $HOME or the tree, checks static linking and names the Go
targets Rust cannot build. packaging/package.sh builds and inspects
packages without signing or publishing; repo.sh reuses it. Seven fuzz
targets (one found a URL-parser panic, fixed here with a regression
test), cargo-deny policy, CI for lint, tests on Linux/macOS/Windows,
cross builds with qemu runs, supply chain and fuzzing. Compatibility
specification and security notes.
Co-Authored-By: Claude <noreply@anthropic.com>
Andy DixonandClaude