qpismont/herald
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases 4 Wiki Activity

1.2: Sandboxing #7

Merged
qpismont merged 17 commits from 1.2 into main 2026-09-20 16:58:36 +02:00
Conversation 18 Commits 17 Files Changed 43
+452 -439
4 changed files with 452 additions and 439 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 536c55f27b - Show all commits
.devcontainer/Dockerfile
+1 -1
View File
@@ -1,4 +1,4 @@
FROM rust:1.97-trixie
FROM rust:1.98-trixie
qpismont marked this conversation as resolved
Herald commented 2026-09-17 18:21:45 +02:00
Review
Copy Link
Copy Source

Épingler l'image de base par digest (ou au moins une version majeure mineure) pour la reproductibilité, et éviter d'exécuter le conteneur de développement en root si possible. Vérifier que les outils ajoutés dans cette image ne sont pas supposés présents en production (le devcontainer ne doit pas être une dépendance implicite du runtime).

Épingler l'image de base par digest (ou au moins une version majeure mineure) pour la reproductibilité, et éviter d'exécuter le conteneur de développement en root si possible. Vérifier que les outils ajoutés dans cette image ne sont pas supposés présents en production (le devcontainer ne doit pas être une dépendance implicite du runtime).
ARG USERNAME=dev
ARG USER_UID=1000
Cargo.lock
Generated
+440 -425
View File
File diff suppressed because it is too large Load Diff
Cargo.toml
+5 -5
View File
1
 @@ -13,16 +13,16 @@ tokio-util = "0.7"
futures-util = "0.3"
serde_json = "1.0"
serde = { version = "1.0", features = ["derive"] }
sentry = { version = "0.48", features = ["tower-axum-matched-path"] }
sentry-anyhow = { version = "0.48", features = ["backtrace"] }
openrouter-rs = "0.12"
sentry = { version = "0.49", features = ["tower-axum-matched-path"] }
sentry-anyhow = { version = "0.49", features = ["backtrace"] }
openrouter-rs = "0.14"
dotenvy = "0.15"
tower = "0.5"
tower-http = { version = "0.6", features = ["trace"] }
tower-http = { version = "0.7", features = ["trace"] }
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
axum = "0.8"
anyhow = { version = "1.0", features = ["backtrace"] }
anyhow = { version = "1", features = ["backtrace"] }
thiserror = "2.0"
ring = "0.17"
hex = "0.4"
crates/herald-server/src/main.rs
+6 -8
View File
1
 @@ -36,14 +36,12 @@ fn main() -> anyhow::Result<()> {
let _sentry_guard = if let Ok(sentry_dsn) = env::try_get_env("SENTRY_DSN") {
info!("Initialize sentry");
Some(sentry::init((
sentry_dsn,
sentry::ClientOptions {
release: sentry::release_name!(),
send_default_pii: true,
..Default::default()
},
)))
Some(sentry::init(
sentry::ClientOptions::new()
.dsn(&sentry_dsn)
.maybe_release(sentry::release_name!())
.send_default_pii(true),
))
} else {
warn!("SENTRY_DSN not set, sentry will not be initialized");
None
1