Harden pack extraction, registry pulls, secret resolution, and published-socket collisions - #701

Open

BinSquare wants to merge 7 commits into

mainfrom

binbin-publish-socket

Commits on Jul 21, 2026

Bound streamed blob pulls to the declared size so a hostile registry or peer can't exhaust host disk
BinSquare
committed
Validate Mach-O load-command sizes so a malformed stub errors cleanly instead of crashing the packer
BinSquare
committed
Reject published sockets that resolve to the same host or guest endpoint instead of silently clobbering one
BinSquare
committed
Use checked arithmetic validating the packed section size so a crafted assets_size can't overflow into an out-of-bounds read
BinSquare
committed
Reject non-regular from_file secret sources so a FIFO or device can't hang resolution
BinSquare
committed
Route pack asset decompression through safe_unpack so an untrusted pack can't plant escaping symlinks or a decompression bomb
BinSquare
committed
Fix the embedded-pack-with-assets test's invalid-hex digest fixture and stale layer filename
BinSquare
committed