From 28a660e8bacac84523601f67547b2671058d9b20 Mon Sep 17 00:00:00 2001 From: Luke Hoersten Date: Tue, 28 Jul 2026 17:18:43 -0500 Subject: Harden against untrusted input and reduce controller boilerplate Security: - Epoch conversions no longer panic on out-of-range values: a device may report any u64 as its clock, so to_timestamp is fallible (rendered labeled-raw), from_timestamp clamps a pre-epoch host clock to zero (a Pi with no RTC reads 1970 early after boot), and delta arithmetic saturates. Fixes crashes in inspect and status - Identity Debug redacts the root CA private key so no stray {:?} leaks it - fsync the temp file before rename, so a power loss cannot surface an empty identity.json - Document in the README that device attestation is not verified, the NTP servers contacted, and the at-rest key Cleanup: - A MatterCtx extension trait replaces the repeated map_err/anyhow closure at every rs-matter call site with .ctx("what") - SyncOutcome::failed/skipped constructors collapse two large literals - read_our_fabric_entry shares the fabric-filtered read across the label, decommission, and inspect paths 36 unit tests, clippy clean. --- src/output.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/output.rs') diff --git a/src/output.rs b/src/output.rs index 4de5745..e2c91ec 100644 --- a/src/output.rs +++ b/src/output.rs @@ -26,7 +26,7 @@ use crate::tz::format_utc_offset; /// string, never as a JSON number, which silently loses precision beyond /// 2^53 in many consumers. The rule lives in the type, so an ID field /// cannot be emitted wrongly. -#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)] +#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, PartialOrd, Ord)] pub struct Id64(pub u64); impl Serialize for Id64 { -- cgit v1.2.3