Release 0.5.0 - #35
Merged
Merged
Conversation
Minor rather than patch: several changes in this cycle can reject a token or refuse to start where 0.4.1 would have served. - A token whose nbf is in the future is now rejected. Previously nbf was parsed and ignored. - iss and aud are required by the validator, not only by Claims deserialization. - Cf-Access-Jwt-Assertion now takes precedence over the CF_Authorization cookie, and a malformed header no longer falls back to it. - An empty JWKS or an empty application catalog aborts startup instead of opening the port with nothing to validate against. - Initialization failure exits without opening the port, so a restart into a broken configuration is visible rather than serving denials. Operators should note the startup change in particular: a deployment that previously came up during a Cloudflare API outage and returned 403s will now fail to start. Runtime is unaffected, since refresh failures still retain the last complete state.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Version bump only — no code changes. The hardening work itself landed in #34.
Why 0.5.0 and not 0.4.2
Several changes in this cycle can reject a token, or refuse to start, where 0.4.1 would have served:
nbfnbfparsed, ignored)iss/audenforcementCf-Access-Jwt-Assertionpreferred; malformed header does not fall back to the cookieThe one operators need to know about
A deployment that previously started during a Cloudflare API outage will now fail to start. Before, it would open the port and return 403 to everything; now it exits. That's deliberate — a crash-looping container is visible to an orchestrator in a way that silent denials aren't — but it does mean deploys are now coupled to Cloudflare's availability in the default mode.
Runtime behaviour is unchanged: refresh failures still retain the last complete catalog and key set, so a running instance rides out an outage.
Also worth noting the startup sequence now makes TCP readiness truthful — the port only opens once keys and the catalog are loaded, so a plain TCP check is a valid readiness probe. That matters because the image is distroless with no shell.
Verified before tagging
cargo fmt --all --check,cargo clippy --workspace --all-targets -- -D warnings,cargo build --release --locked --workspace: all clean onmain.--lockedre-verified after the version bump, since the lockfile records the workspace member's own version and CI plus the Docker build both pass that flag. BumpingCargo.tomlalone would have failed the release build.Release checklist after merge
0.5.0frommain.linux/amd64andlinux/arm64on native runners, pushes by digest, then merges the manifest — and fails if either architecture is missing.🤖 Generated with Claude Code