eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: complete host opening audit

Browse source
This commit is contained in:
Eric Wendland 2026-07-05 18:23:12 +02:00
commit 8e3b45db1b
2 changed files with 17 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/production-readiness-roadmap.md
View file

@ -176,13 +176,13 @@ Goal: finish the authorization and remote-input audit before deployment.
- `[x]` Oversized messages are rejected without state mutation.
- `[x]` Tests cover oversized payload denial for representative protocols.
- `[ ]` Audit host-opening paths.
- `[x]` Audit host-opening paths.
Acceptance criteria:
- `[ ]` TCP forwarding remains loopback-only unless a later ADR expands it.
- `[ ]` Unix forwarding rejects unsafe paths.
- `[ ]` SSH proxy connects only to the intended local SSH endpoint.
- `[ ]` Overlay TUN setup remains explicit opt-in.
- `[ ]` Docs state host access risks and recovery commands.
- `[x]` TCP forwarding remains loopback-only unless a later ADR expands it.
- `[x]` Unix forwarding rejects unsafe paths.
- `[x]` SSH proxy connects only to the intended local SSH endpoint.
- `[x]` Overlay TUN setup remains explicit opt-in.
- `[x]` Docs state host access risks and recovery commands.
## Phase 5: Production Cryptography Boundary