5 Commits

Include renames

Author	SHA1	Message	Date
marvin	5b80885207	fix: validate image name before building registry path ... The user-supplied image/name argument was interpolated unsanitized into registry/{name}/initrd, so a name containing '../' (e.g. 'slim run ../../.ssh/authorized_keys') escaped the XDG data dir and let slim create directories and read/write files at attacker-chosen locations. validate_image_name now rejects empty names, '.', '..' and anything outside [A-Za-z0-9._:-] at the registry_dir chokepoint used by both build and run, plus a defense-in-depth containment check that the resolved path stays under the registry root. Fixes sec-2 from the code review.	2026-08-26 20:11:57 +00:00
hulthe	d517ab6a1a	Fix minor issues	2026-08-26 21:45:26 +02:00
marvin	8dd5267bb4	fix: read rootfs inside podman unshare, always unmount, fail on qemu errors ... - build: the rootless overlay mount only exists inside podman unshare's user namespace; run the vmlinuz check/copy and the find|cpio pipeline there, streaming cpio's stdout to the parent for gzipping (also drops the initrd.tmp round-trip and excludes vmlinuz from the archive) - build: unmount the image on all code paths, not just success - run: treat timeout's exit 124 as the expected smoke-test timeout and error on any other non-zero status (a missing qemu binary no longer reports success) Fixes bug-1, bug-2, bug-3 from the code review.	2026-08-25 20:45:29 +00:00
marvin	b9b5e3942b	slim-rs v1: initrd build, qemu run, gitea actions	2026-08-25 20:10:03 +00:00
marvin	f7ca39117a	slim-rs v1: initrd build + qemu run via podman image mount	2026-08-25 19:53:47 +00:00