gamertan/web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases 3 Activity

3 Releases 5 Tags

RSS Feed
  • v0.1.0-preview.1 a18f1dd22a
    Compare

    Gamertan Web Foundations v0.1.0-preview.1
    verify / verify (push) Successful in 3m1s
    Details
    Pre-Release

    gamertan released this 2026-08-16 19:25:05 -04:00 | 6 commits to main since this release

    Gamertan Web Foundations v0.1.0-preview.1

    The first public preview is a composable Go toolkit for request identity, bounded structured logging, browser security, abuse decisions, authentication, SQLite persistence, and private analytics. Applications keep their own router, HTML, authorization policy, caching, and deployment.

    Packages

    • requestmeta: trusted-proxy resolution, normalized HTTPS/origin state, and cryptographic request IDs.
    • requestlog: versioned bounded records, net/http middleware, sink contracts, and private JSONL storage.
    • websec: security headers, same-origin and CSRF primitives, safe redirects, body limits, and in-memory rate limiting.
    • abuse: application-classified enforcement through bounded storage interfaces.
    • auth, authhttp, and authsqlite: Argon2id credentials, digest-backed opaque sessions, application-defined roles/permissions, secure cookies, and a namespaced no-CGO SQLite adapter.
    • analytics: separate safe and sensitive projections over versioned request records.

    Security and release evidence

    • Canonical signed tag resolves to commit a18f1dd22a448055da1b232ffa9fb664b2f4501b.
    • Exact Go 1.26.6 verification run 126 passed tests, race tests, vet, formatting, licensing, the starter build, and an unchanged-checkout gate.
    • Exact assurance run 127 passed module verification, govulncheck v1.7.0, two bounded 30-second fuzz campaigns, and byte-identical starter builds.
    • The pre-tag review added fail-closed behavior for unsafe requests without origin evidence and invalid authentication middleware configuration; imported request-record numerics are bounded before aggregation; forwarded IPv6 zones are rejected.
    • Most packages use only the standard library. Authentication pins golang.org/x/crypto; the optional SQLite adapter pins modernc.org/sqlite and its recorded transitive graph.
    • Fresh direct and proxy-only downloads both resolve to canonical Gitea and the same checksum-database sums:
    gamertan.com/web v0.1.0-preview.1 h1:b2Te6F+k4mqBK1tA8riram353VgQ7/NlX1qkQgTJPu4=
gamertan.com/web v0.1.0-preview.1/go.mod h1:KOxki9zGWgNb9+1H6OsvnShBijLvw+ZjurBR8D8FZW0=

    Install

    go get gamertan.com/web@v0.1.0-preview.1
go mod verify

    This is an API preview, not a stable compatibility promise. Linux is the maintained release platform. No standalone authentication or logging server is included. EQL Helper adoption will proceed one boundary at a time with retained implementations and differential tests; EQL-specific roles, schemas, analytics policy, and private evidence are not part of this module.

    Embeddable packages are MPL-2.0. Copyable starters are 0BSD. Future standalone service machinery is AGPL-3.0-only. Canonical source, issues, contributions, and security policy: https://gitea.speelman.ca/gamertan/web

    Downloads