shoney.arickathil
53485a748c
Compared §F3c-net's forks against gofiber v3's client (fasthttp + Go crypto/tls/x509, .dev/reference/fiber). Two gaps my defaults had vs Go, now locked as decisions 5 and 6: - (5) bounded handshake deadline: the blocking model would let a stalled server hang the shard's one thread indefinitely (the DoS DoTimeout closes). connect_tls now bounds connect+handshake via non-blocking connect+poll + SO_RCVTIMEO/SNDTIMEO, default WO_TLS_HANDSHAKE_MS (10s); expiry traps WO_T_IO. _dl variant + park handshake stay follow-ups - (6) chain hardening: signatures+validity+SAN alone let a leaf act as a CA. Now every non-leaf must assert basicConstraints CA:TRUE (+pathLen) and the leaf must carry EKU serverAuth — what Go's crypto/x509 enforces - acceptance criteria added (stalled-server timeout; leaf-as-CA + no-EKU rejected); connect_tls bullet, frontmatter review_pending, status NEXT PLAN updated to six locked forks Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> (cherry picked from commit 9662cd8b040f417b4886dae9ce97b70083e24e40) |
||
|---|---|---|
| .. | ||
| databasev2 | ||
| jarvis | ||
| language-runtime-database | ||
| porch | ||
| runtime-v2 | ||
| wmux | ||
| 00-status.md | ||
| board-views.md | ||