Add secure conduit transport for send and receive #6

Merged

ober merged 83 commits from conduit-implementation into master 2026-09-24 13:18:15 -04:00

Conversation 0 Commits 83 Files changed 34 +4043 -48

ober commented 2026-09-23 18:25:25 -04:00

Owner

Copy link

Implements the versioned conduit transport for shell send/receive:

• Noise_NNpsk0 with independent channel/PSK capabilities and bounded authenticated framing.
• Streaming zstd archive codec with recursive directory and empty-directory support.
• Descriptor-relative staging/publication, no-replace semantics, limits, cancellation, and cleanup.
• Bounded relay registration/admission state machine and websocket transport.
• Native Noise/zstd bindings, protocol vectors, archive/staging/security tests, and local/relay E2E coverage.
• Exact locked dependency provenance and source archive control-character validation.

Validation: make test; make security; make lint; make verify; make e2e; make e2e-relay.

Implements the versioned conduit transport for shell send/receive: - Noise_NNpsk0 with independent channel/PSK capabilities and bounded authenticated framing. - Streaming zstd archive codec with recursive directory and empty-directory support. - Descriptor-relative staging/publication, no-replace semantics, limits, cancellation, and cleanup. - Bounded relay registration/admission state machine and websocket transport. - Native Noise/zstd bindings, protocol vectors, archive/staging/security tests, and local/relay E2E coverage. - Exact locked dependency provenance and source archive control-character validation. Validation: make test; make security; make lint; make verify; make e2e; make e2e-relay.

ober added 59 commits 2026-09-23 18:25:25 -04:00

Add conduit capability and bounded protocol core b2b4e9e4c0

Add transitional conduit client framing 13e74c3e36

Expose shell-facing conduit send and receive contract 2055507841

Add bounded conduit archive pack and staging 5a0e92f77b

Add native Noise and streaming zstd conduit binding 2ab562bfe6

Integrate conduit native build and TLS WebSocket transport 87aa16ec46

Wire conduit client to native Noise and receiver capabilities 60f34b997a

Fix TLS WebSocket header parser binding 927bcf1394

Avoid conduit archive export collision 196b6231d7

Define receiver capability compatibility export ab5aa1ee67

Stream bounded conduit archives over Noise frames ea31973261

Format conduit native binding 86c57de9ba

Bump wormhole version for conduit transfer f95b4572f3

Stream conduit archive through zstd on receive 3c1104404e

Add network conduit relay entrypoint 9347f3a316

Support configured relay listen address 3bda66633f

Harden conduit relay state and endpoint streaming b0dc20dfa5

Add conduit relay network adapter and CLI command b839accf1f

Run conduit relay through packaged binary 1c07b02fe0

Package conduit native library with macOS binary a833418aed

Add conduit archive path validation boundary b05f44a305

Expire idle conduit registrations in network relay bb2b3d22b5

Limit conduit relay connections per source IP 4de6410a02

Add bounded conduit file staging publication ef17e937d5

Bump conduit release version 560529ebbf

Harden conduit relay frame validation and I/O locking 8c9ac96d1f

Stream conduit archives through bounded staging 67517560a4

Stage conduit trees before no-replace publication ec4a73437b

Use FreeBSD renameat2 for directory no-replace publication 128fa7ae6a

Bound archive writes to native conduit frame size 7b0a369a35

Reject malformed conduit control frames 07e6d4f1ba

Run Jerboa tests with explicit unsafe prelude b3479e1a97

Run end-to-end scripts with explicit unsafe prelude 5cfe5edd1f

Honor relay quota configuration 062714f1a0

Add receive transfer limit and prompt options 603e322f2e

Interpret receive byte limits literally 7327c4a3b1

Synchronize conduit version output ad0996a486

Enforce conduit limits and transfer timeouts beef4a1f57

Support global conduit cancellation a18cad3cb5

Enforce relay connection quota on joins 23d6dcdefd

Recheck source size on pinned descriptor ea05a2321d

Clean failed private staging directories 10d8e7c0a5

Use monotonic relay expiry time 6964f8c92e

Separate relay waiting and active expiry limits 43d1ebc0d4

Handle empty directory transfers with zero file bytes ffeccc6d9e

Keep conduit options within protocol limits 870622f9a0

Support explicit leading-dash source paths 94fd385c1e

Add canonical conduit codec vectors cee080c2a5

Test canonical conduit codec vectors 03411219be

Bound relay upgrade and registration deadlines d4ca6f591a

Use timeout result helper for relay registration 067ee339b2

Clean up timed out relay sockets b893f0349b

Test conduit relay quotas and pairing 0cd79376d5

Rate limit relay registrations per source 0e46a51ca7

Document relay registration rate limits 4e60a9cff1

Expire relay registration rate windows ecc5ac8202

Clean up failed conduit handshakes a0ca8f03a0

Close sockets when relay channels expire e29ec6f7f7

Reject control characters in archive paths 2d25b1a89a

ober added 1 commit 2026-09-23 18:26:38 -04:00

Use available Jerboa release toolchain 39e0046932

ober added 1 commit 2026-09-23 18:29:22 -04:00

Bootstrap native source without sibling checkout bec29281c3

ober added 1 commit 2026-09-23 18:31:38 -04:00

Point native build at sparse source manifest f905fa082a

ober added 1 commit 2026-09-23 18:45:20 -04:00

Recognize FreeBSD errno symbol bfb1dd46d4

ober added 1 commit 2026-09-23 19:16:20 -04:00

Permit conduit Rust runtime overlap on FreeBSD a5ba3f6b42

ober added 1 commit 2026-09-23 19:27:54 -04:00

Fail closed when FreeBSD lacks exclusive rename 0cd881116b

ober added 3 commits 2026-09-23 20:24:37 -04:00

Pin conduit source reads to directory descriptors 19b3900db8

Allow bounded relay queue above frame size b1ef8c8020

Wire conduit relay policy configuration 22b2a4e3c0

ober added 1 commit 2026-09-23 20:56:55 -04:00

Account for in-flight relay queue bytes 8e7f33a3d2

ober added 1 commit 2026-09-23 20:58:01 -04:00

Harden conduit client lifecycle and metadata checks 3ba278b897

ober added 1 commit 2026-09-23 20:59:18 -04:00

Harden conduit archive framing validation 067fd4265b

ober added 1 commit 2026-09-23 21:08:40 -04:00

Reject invalid WebSocket upgrade and text frames 351c8e4540

ober added 1 commit 2026-09-23 21:11:47 -04:00

Pin conduit source traversal to directory descriptors 8dab25d409

ober added 1 commit 2026-09-23 22:59:46 -04:00

Test conduit archive malformed path encodings 7a13d472c0

ober added 1 commit 2026-09-23 23:16:16 -04:00

Reject conduit path collisions and oversized accepts c826a7b6f1

ober added 1 commit 2026-09-23 23:24:34 -04:00

Enforce conduit application state transitions b0bfc0debf

ober added 1 commit 2026-09-23 23:39:45 -04:00

Test conduit terminal transition rejection 64d59943f3

ober added 1 commit 2026-09-23 23:52:26 -04:00

Test websocket adversarial frame limits 559e9beb71

ober added 1 commit 2026-09-23 23:54:57 -04:00

Test staging permission and cleanup safety 50ab2afbae

ober added 1 commit 2026-09-24 00:01:18 -04:00

Fix dilation relay test bootstrap 6a4a23fd52

ober added 1 commit 2026-09-24 00:05:08 -04:00

Fix dilation soak relay bootstrap e3b089af3b

ober added 1 commit 2026-09-24 12:30:56 -04:00

Fix relay expiry timer and rename conduit endpoint d7e0bd9628

ober force-pushed conduit-implementation from d7e0bd9628 to 7dcac301e5 2026-09-24 12:39:27 -04:00 Compare

ober added 1 commit 2026-09-24 12:54:35 -04:00

Retry CI after Forgejo runner failure 63d7693673

ober scheduled this pull request to auto merge when all checks succeed 2026-09-24 13:17:58 -04:00

ober merged commit d50f5de082 into master 2026-09-24 13:18:15 -04:00

ober referenced this pull request from a commit 2026-09-24 13:18:16 -04:00

Merge pull request #6

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ober/jerboa-wormhole!6

No description provided.