novox/mesh-catalog
3
0
Fork 0
Code Issues Pull Requests 3 Packages Projects Releases Wiki Activity

Protect the address the builder sends its registry password to

Browse Source 
`at` was settable. A node setting could point the builder's package binding at
any host, and the builder sends its registry credential there as basic auth — so
a setting meant for a port was a way to hand the password to somebody else.

novox/hq 04-ISSUES/085
This commit is contained in:
jschoubben
2026-09-22 21:56:51 +02:00
parent d63f006cb8
commit b2e29871fd
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/builder/module.json
+1
View File
@@ -49,6 +49,7 @@
"protected": [ "protected": [
"provision", "provision",
"from", "from",
"at",
"as" "as"
], ],
"content": "{\"provision\": \"package-registry\", \"from\": \"gitea\", \"at\": \"127.0.0.1\", \"as\": \"mesh-builder\", \"serves\": {\"scheme\": \"http\", \"port\": 3000, \"npm-path\": \"/api/packages/novox/npm/\"}}\n" "content": "{\"provision\": \"package-registry\", \"from\": \"gitea\", \"at\": \"127.0.0.1\", \"as\": \"mesh-builder\", \"serves\": {\"scheme\": \"http\", \"port\": 3000, \"npm-path\": \"/api/packages/novox/npm/\"}}\n"