skunky-art.git/app/cli.go, branch v1.3.6alternative deviantart frontend, no javascript. go.
http://git.krz.sh/krz/skunky-art.git/atom?h=v1.3.62026-07-15T07:34:41+00:00fix: attribute fork in copyright and replace upstream matrix link2026-07-15T07:34:41+00:00Christian Cleberghello@cleberg.net2026-07-15T07:34:41+00:00urn:sha1:bc9c79be7824252f385b9d052595ed8d7460f43f
The copyright on /about and in the CLI help credited only lost+skunk and
linked to their matrix account. Credit this fork alongside the original,
as the X11 license requires retaining the upstream notice, and point the
attribution at the upstream repo rather than the stale matrix link.
Replace the upstream matrix room link with this fork's issue tracker.
fix: harden HTTP transport, server timeouts and panic paths2026-07-15T07:24:58+00:00Christian Cleberghello@cleberg.net2026-07-15T07:24:58+00:00urn:sha1:7eb5e5e2230b6fb5b1bed6f0eaa03279aa61555b
Correctness and security findings surfaced by golangci-lint, plus two
latent panics found alongside them.
- router: http.ListenAndServe has no timeouts at all (gosec G114), so a
slow client could hold a connection and its handler open indefinitely.
Replace it with an explicit http.Server carrying read/write/idle
timeouts.
- httpclient: InstallDAThrottle asserted http.DefaultTransport was a
*http.Transport and would panic outright if anything had already
wrapped it -- which is precisely what that function does. Check the
assertion and fall back to a fresh transport. Expose ProxiedTransport
so a configured download-proxy can inherit the same throttle and
timeouts instead of silently bypassing them.
- cache: the Sys() assertion to *syscall.Stat_t is only valid on unix and
would panic elsewhere; skip rotation instead. Indexing
Headers["Content-Type"][0] panics when the header is absent; use
Headers.Get. Cache files are written 0600 rather than 0700, as they are
never executed.
- cli, api: check error returns, and exit rather than nil-dereference a
file handle that failed to open.
SHA-1 and math/rand keep //nolint:gosec with reasons: they are cache-key
hashes and random-artwork picks, not security primitives.
fix: point source links and instance fetch at this fork2026-07-15T01:28:02+00:00Christian Cleberghello@cleberg.net2026-07-15T01:28:02+00:00urn:sha1:0aff13949a8e9e120a585f00627ef6959f8e0635
Upstream references still pointed at git.macaw.me, which is unmaintained
and whose instances.json is a dead link. Repoint them at this repo:
- RefreshInstances now fetches instances.json from raw.githubusercontent
- source/version links in index.htm, about.htm, and CLI help use the
GitHub releases tag URL
- SETUP.md/SETUP-RU.md language switch links were Gitea-absolute paths
that 404 on GitHub; make them relative
- --add-instance message says 'main' branch, matching this repo
The fork attribution in README.md is left as-is: it credits upstream
rather than pointing at the source.
Add da.opnxng.com + lost-skunk.cc is now in Finland2025-04-07T10:53:47+00:00lost+skunkme@lost-skunk.cc2025-04-07T10:53:47+00:00urn:sha1:210c69e48c2af4d1fdb53c0654ed33a21688696cДва API-эндпоинта2024-09-03T12:36:19+00:00lost+skunkskunky@ebloid.ru2024-09-03T12:36:19+00:00urn:sha1:db53a8bd9004098e6a1507e5826a833fd9efa954темплейты в бинарнике и улучшенная система кеша2024-08-13T12:59:52+00:00lost+skunkskunky@ebloid.ru2024-08-13T12:59:52+00:00urn:sha1:1537da9b16dfda1ecb2730b5d1de3b9005397618instances.test.json -> instances.json2024-08-01T19:54:59+00:00lost+skunkskunky@ebloid.ru2024-08-01T19:54:59+00:00urn:sha1:4db018fb7f01669cb5e4c1da4b56ccfe3dbadd6fv1.32024-08-01T19:48:05+00:00lost+skunkskunky@ebloid.ru2024-08-01T19:48:05+00:00urn:sha1:c5514c3875b9b782688047d547dfd6663a5b77bb