4d9a26498e
Paste a secret, get a link, send it. The first person to open it and press
Reveal sees the secret; the link dies at that moment. The recipient needs a
browser and nothing else — no account, no client, no installed tooling.
The server cannot read what it stores. AES-256-GCM happens in the browser and
the key lives in the URL fragment, which browsers never transmit, so hushd
holds ciphertext and no key material. That is a property of where the key sits
rather than a promise about our conduct, which is why there is deliberately no
endpoint accepting a plaintext secret and no server-side-encryption fallback:
two guarantees behind one URL would be worse than one honest guarantee.
Three decisions carry the design:
* GET /s/{id} touches NO storage, not even to check existence. Slack, Teams,
WhatsApp, iMessage and Outlook Safe Links all fetch a URL before a human
sees it, so destroying on GET would destroy most secrets in transit and the
recipient's "already used" would be indistinguishable from interception.
Only POST /reveal consumes. Bot user-agent detection is an arms race;
removing the side effect from GET is not. Pinned by
TestGettingTheRevealPageNeverConsumesTheSecret.
* Destruction is one Redis GETDEL, which is atomic. GET-then-DEL has a window
where two simultaneous readers both win, and for a one-time secret that
window is the product. The store contract demands atomicity and the same
concurrency test runs against both implementations.
* Missing, already-revealed, expired and evicted are ONE indistinguishable
410. Separating them would confirm to a prober that a given link was real.
The secret id IS the capability, so secret.ID is a struct whose every
accidental path — %v, %s, String(), slog, json.Marshal — emits a redacted
handle or refuses, and the raw value needs an explicit Value(). The first
version tried to prevent leaks by implementing no String() at all; its own test
caught that Go's fmt prints unexported fields anyway, so forbidding the method
had removed the control rather than the leak.
Operationally: structured JSON on stdout in the fleet's wire format, which
Vector already collects with no annotation; six hush_* metrics on the chassis
registry with no id, IP or path in any label; five alert rules wired into
vmalert. The public Ingress enumerates /, /s/ and /api/ so /metrics, /healthz
and /readyz share the port but are unreachable from the internet — no
basic-auth middleware to maintain and get wrong.
Dependencies are vendored because go-chassis is private: the Woodpecker test
step and the in-cluster Kaniko build both run -mod=vendor with GOPROXY=off and
hold no git credential.
cmd/hush-mcp is a stdio MCP server doing the same client-side crypto locally,
so using hush from an agent preserves the same guarantee as using it from a
browser.
128 lines
3.9 KiB
Markdown
128 lines
3.9 KiB
Markdown
# Changelog
|
|
All notable changes to this project will be documented in this file.
|
|
|
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
|
|
## [1.11.0] - 2023-05-02
|
|
### Fixed
|
|
- Fix initialization of `Value` wrappers.
|
|
|
|
### Added
|
|
- Add `String` method to `atomic.Pointer[T]` type allowing users to safely print
|
|
underlying values of pointers.
|
|
|
|
[1.11.0]: https://github.com/uber-go/atomic/compare/v1.10.0...v1.11.0
|
|
|
|
## [1.10.0] - 2022-08-11
|
|
### Added
|
|
- Add `atomic.Float32` type for atomic operations on `float32`.
|
|
- Add `CompareAndSwap` and `Swap` methods to `atomic.String`, `atomic.Error`,
|
|
and `atomic.Value`.
|
|
- Add generic `atomic.Pointer[T]` type for atomic operations on pointers of any
|
|
type. This is present only for Go 1.18 or higher, and is a drop-in for
|
|
replacement for the standard library's `sync/atomic.Pointer` type.
|
|
|
|
### Changed
|
|
- Deprecate `CAS` methods on all types in favor of corresponding
|
|
`CompareAndSwap` methods.
|
|
|
|
Thanks to @eNV25 and @icpd for their contributions to this release.
|
|
|
|
[1.10.0]: https://github.com/uber-go/atomic/compare/v1.9.0...v1.10.0
|
|
|
|
## [1.9.0] - 2021-07-15
|
|
### Added
|
|
- Add `Float64.Swap` to match int atomic operations.
|
|
- Add `atomic.Time` type for atomic operations on `time.Time` values.
|
|
|
|
[1.9.0]: https://github.com/uber-go/atomic/compare/v1.8.0...v1.9.0
|
|
|
|
## [1.8.0] - 2021-06-09
|
|
### Added
|
|
- Add `atomic.Uintptr` type for atomic operations on `uintptr` values.
|
|
- Add `atomic.UnsafePointer` type for atomic operations on `unsafe.Pointer` values.
|
|
|
|
[1.8.0]: https://github.com/uber-go/atomic/compare/v1.7.0...v1.8.0
|
|
|
|
## [1.7.0] - 2020-09-14
|
|
### Added
|
|
- Support JSON serialization and deserialization of primitive atomic types.
|
|
- Support Text marshalling and unmarshalling for string atomics.
|
|
|
|
### Changed
|
|
- Disallow incorrect comparison of atomic values in a non-atomic way.
|
|
|
|
### Removed
|
|
- Remove dependency on `golang.org/x/{lint, tools}`.
|
|
|
|
[1.7.0]: https://github.com/uber-go/atomic/compare/v1.6.0...v1.7.0
|
|
|
|
## [1.6.0] - 2020-02-24
|
|
### Changed
|
|
- Drop library dependency on `golang.org/x/{lint, tools}`.
|
|
|
|
[1.6.0]: https://github.com/uber-go/atomic/compare/v1.5.1...v1.6.0
|
|
|
|
## [1.5.1] - 2019-11-19
|
|
- Fix bug where `Bool.CAS` and `Bool.Toggle` do work correctly together
|
|
causing `CAS` to fail even though the old value matches.
|
|
|
|
[1.5.1]: https://github.com/uber-go/atomic/compare/v1.5.0...v1.5.1
|
|
|
|
## [1.5.0] - 2019-10-29
|
|
### Changed
|
|
- With Go modules, only the `go.uber.org/atomic` import path is supported now.
|
|
If you need to use the old import path, please add a `replace` directive to
|
|
your `go.mod`.
|
|
|
|
[1.5.0]: https://github.com/uber-go/atomic/compare/v1.4.0...v1.5.0
|
|
|
|
## [1.4.0] - 2019-05-01
|
|
### Added
|
|
- Add `atomic.Error` type for atomic operations on `error` values.
|
|
|
|
[1.4.0]: https://github.com/uber-go/atomic/compare/v1.3.2...v1.4.0
|
|
|
|
## [1.3.2] - 2018-05-02
|
|
### Added
|
|
- Add `atomic.Duration` type for atomic operations on `time.Duration` values.
|
|
|
|
[1.3.2]: https://github.com/uber-go/atomic/compare/v1.3.1...v1.3.2
|
|
|
|
## [1.3.1] - 2017-11-14
|
|
### Fixed
|
|
- Revert optimization for `atomic.String.Store("")` which caused data races.
|
|
|
|
[1.3.1]: https://github.com/uber-go/atomic/compare/v1.3.0...v1.3.1
|
|
|
|
## [1.3.0] - 2017-11-13
|
|
### Added
|
|
- Add `atomic.Bool.CAS` for compare-and-swap semantics on bools.
|
|
|
|
### Changed
|
|
- Optimize `atomic.String.Store("")` by avoiding an allocation.
|
|
|
|
[1.3.0]: https://github.com/uber-go/atomic/compare/v1.2.0...v1.3.0
|
|
|
|
## [1.2.0] - 2017-04-12
|
|
### Added
|
|
- Shadow `atomic.Value` from `sync/atomic`.
|
|
|
|
[1.2.0]: https://github.com/uber-go/atomic/compare/v1.1.0...v1.2.0
|
|
|
|
## [1.1.0] - 2017-03-10
|
|
### Added
|
|
- Add atomic `Float64` type.
|
|
|
|
### Changed
|
|
- Support new `go.uber.org/atomic` import path.
|
|
|
|
[1.1.0]: https://github.com/uber-go/atomic/compare/v1.0.0...v1.1.0
|
|
|
|
## [1.0.0] - 2016-07-18
|
|
|
|
- Initial release.
|
|
|
|
[1.0.0]: https://github.com/uber-go/atomic/releases/tag/v1.0.0
|