TheSunIsLeaking/recflare
3
0
Fork 0
mirror of https://github.com/djdevin/recflare.git synced 2026-09-08 14:41:28 -07:00
Code Issues Packages Projects Releases Wiki Activity

oops, just return a fake signature

Browse Source
This commit is contained in:
Devin Zuczek
2026-08-07 15:17:53 -04:00
parent 4e578f7771
commit c2d36009a3
5 changed files with 187 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/img/wrangler.jsonc
+7 -5
View File
@@ -54,11 +54,13 @@
"vars": {
"ENVIRONMENT": "development", // overridden during deployment
"SENTRY_RELEASE": "unknown", // overridden during deployment
// Feature flag for `?sig=p1` response signing. OFF: signing buffers the whole
// object into the isolate instead of streaming it from R2, then pays a SHA-1
// over the full body plus an RSA-2048 private-key op on every edge-cache miss.
// Nothing verifies the `Content-Signature` header today. Flip to true (and set
// a real IMG_SIGNING_KEY) if something ever needs to.
// Feature flag for REAL `?sig=p1` signing. OFF: the client only needs a
// Content-Signature header to EXIST, and never checks it, while signing for
// real buffers the whole object into the isolate instead of streaming it from
// R2 and pays a SHA-1 over the full body plus an RSA-2048 private-key op on
// every edge-cache miss. So the header is filled with a placeholder derived
// from the object key (see stubSignature in src/img.app.ts). Flip to true if
// anything ever needs to verify it.
"IMG_SIGNING_ENABLED": false,
// RSA-2048 private key (PKCS8 DER, base64) used to sign image responses
// requested with ?sig=p1. This is an INSECURE DEV KEY committed for local