The audit.jsonl file (containing usernames, actions, timestamps) was
not included in the PurgeScope.ALL destruction steps. An adversary
with filesystem access after a failed or partial purge could recover
operational evidence. Added destroy_audit_log step after temp files,
before config deletion.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Fix 3 missing CSRF tokens on admin user delete/reset and account
key delete forms (were broken — CSRFProtect rejected submissions)
- Fix trust store path traversal: untrust_key() now validates
fingerprint format ([0-9a-f]{32}) and checks resolved path
- Fix chain key rotation: old key is now revoked after rotation
record, preventing compromised old keys from appending records
- Fix SSRF in deadman webhook: block private/internal IP targets
- Fix logout CSRF: /logout is now POST-only with CSRF token,
preventing cross-site forced logout via img tags
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Critical:
- FR-01: Chain verification now supports key rotation via signed rotation
records (soosef/key-rotation-v1 content type). Old single-signer
invariant replaced with authorized-signers set.
- FR-02: Carrier images stripped of EXIF metadata by default before
steganographic encoding (strip_metadata=True). Prevents source
location/device leakage.
High priority:
- FR-03: Session timeout (default 15min) + secure cookie flags
(HttpOnly, SameSite=Strict, Secure when HTTPS)
- FR-04: CSRF protection via Flask-WTF on all POST forms. Killswitch
now requires password re-authentication.
- FR-05: Collaborator trust store — trust_key(), get_trusted_keys(),
resolve_attestor_name(), untrust_key() in KeystoreManager.
- FR-06: Production WSGI server (Waitress) by default, Flask dev
server only with --debug flag.
- FR-07: Dead man's switch sends warning during grace period via
local file + optional webhook before auto-purge.
Medium:
- FR-08: Geofence get_current_location() via gpsd for --here support.
- FR-09: Batch attestation endpoint (/attest/batch) with SHA-256
dedup and per-file status reporting.
- FR-10: Key backup tracking with last_backup_info() and
is_backup_overdue() + backup_reminder_days config.
- FR-11: Verification receipts signed with instance Ed25519 key
(schema_version bumped to 2).
- FR-12: Login rate limiting with configurable lockout (5 attempts,
15 min default).
Nice-to-have:
- FR-13: Unified `soosef status` pre-flight command showing identity,
channel key, deadman, geofence, chain, and backup status.
- FR-14: `soosef chain export` produces ZIP with JSON manifest,
public key, and raw chain.bin for legal discovery.
Tests: 157 passed, 1 skipped, 1 pre-existing flaky test.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Merge stegasoo (v4.3.0, steganography) and verisoo (v0.1.0, attestation)
as subpackages under soosef.stegasoo and soosef.verisoo. This eliminates
cross-repo coordination and enables atomic changes across the full stack.
- Copy stegasoo (34 modules) and verisoo (15 modules) into src/soosef/
- Convert all verisoo absolute imports to relative imports
- Rewire ~50 import sites across soosef code (cli, web, keystore, tests)
- Replace stegasoo/verisoo pip deps with inlined code + pip extras
(stego-dct, stego-audio, attest, web, api, cli, fieldkit, all, dev)
- Add _availability.py for runtime feature detection
- Add unified FastAPI mount point at soosef.api
- Copy and adapt tests from both repos (155 pass, 1 skip)
- Drop standalone CLI/web frontends; keep FastAPI as optional modules
- Both source repos tagged pre-monorepo-consolidation on GitHub
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
These packages aren't available from git.golfcards.club yet.
Lint and typecheck jobs still run.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Use type: ignore for cbor2/json Any returns in serialization/deadman
- Fix callable→Callable in killswitch.py and usb_monitor.py
- Add Ed25519PrivateKey assertion in CLI chain-wrap path
- Allow None for RotationResult fingerprints
- Annotate channel key as str in manager.py
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Reformat 8 files and add --target-version py312 to avoid
3.13 AST parsing issues with Python 3.12 container.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Container can't resolve internal gitea:3000 hostname.
Clone from public HTTPS URL instead.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
python:3.12-slim lacks node, so actions/checkout@v4 fails.
Use manual git clone with Gitea environment variables instead.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace actions/setup-python@v5 (skipped by act runner) with
python:3.12-slim container images so Python is available directly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Templates referenced 'admin_user_new' (stegasoo convention) but the
soosef route is named 'admin_new_user'. Caused 500 error when clicking
"Add User" from admin panel.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The healthcheck tried HTTPS first (curl -fsk https://...) when HTTPS
was disabled. The TLS ClientHello to a plain HTTP listener hung the
sync worker indefinitely. With 2 workers, both got stuck, blocking
all real HTTP requests.
Fix: try HTTP first, add --max-time 3 to release quickly on failure.
Compose override uses HTTP-only to match HTTPS_ENABLED=false default.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Dockerfile: builds from Sources/ context, installs stegasoo + verisoo + soosef
- docker-compose.yml: single service with persistent volume at /root/.soosef
- entrypoint.sh: auto-init on first run, gunicorn with 2 workers
Build: cd soosef/docker && sudo docker compose build
Run: sudo docker compose up -d
Port 35811, HTTPS disabled by default (reverse proxy expected)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New file stego_routes.py:
- register_stego_routes() mounts all encode/decode routes on the Flask app
- Async encode with ThreadPoolExecutor + progress polling
- Subprocess isolation for crash-safe stegasoo operations
- Image + audio encode/decode with full validation
- Encode result display with download
- Tools API routes (capacity, EXIF, rotate, compress, convert)
- About page with crypto documentation
Real templates (replacing stubs):
- encode.html (889 lines): full form with carrier upload, passphrase,
PIN, RSA key, embed mode selection, async progress bar
- decode.html (681 lines): decode form with credential inputs
- encode_result.html (242 lines): result display with download
- about.html (602 lines): security documentation
All routes verified working with auth flow.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Copy Bootstrap 5, Bootstrap Icons, and html5-qrcode from stegasoo
- Fix stegasoo CLI import (cli group, not main wrapper)
- Add .gitignore and README.md
- Verified: soosef init, soosef serve, all routes, key export/import all work
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
