An HTTP proxy for assets (mainly images) to route requests through an always-encrypted connection.

Dennis Schubert

Last update: Dec 8, 2022

Related tags

Cryptography rust camo

Overview

camo-rs

camo-rs is a frontend-compatible Rust-re-implementation of the now archived NodeJS-based atmos/camo - an HTTP proxy for assets (mainly images) to route requests through an always-encrypted connection.

While initially designed for use in diaspora*, asset proxies like this are useful for all applications that display, for example, image files from external sources based on user input and want to avoid mixed-content warnings and reduce the number of external hosts the end-user has to connect to.

Note that this project is not considered production-ready yet. A version 1.0.0 release will follow after further testing in experimental setups.

URL format

To prevent abuse, only authorized URLs can be proxied through Camo. URLs requested from the application need to have the following format:

https://camo.example.org/<digest>/<asset-url>

Where

the digest is a 40-character hexadecimal-encoded SHA1 HMAC digest computed with the shared secret key,
the asset-url is a hexadecimal representation of the target URL, for example 687474703a2f2f65786d61706c652e636f6d2f6578616d706c652e6a7067 for http://exmaple.com/example.jpg.

Differences to the original project

There are some differences to the original projects, namely:

passing the image-url via a query parameter is not supported.
camo-rs will not follow redirects. Instead, if a redirect is encountered upstream, the redirect response will be passed to the client, but with the location header modified to show a Camo-proxied version of the original location. This allows clients (and server-side logic) to cache permanent redirects.
In addition to GET requests, camo-rs also accepts HEAD and OPTIONS requests and passes them through accordingly. This is useful if you want to verify the availability of URLs through Camo on the server side, or if CORS is relevant.

Security considerations

Camo allows users to proxy essentially arbitrary files through it. If your application is vulnerable, Camo could be used to bypass cross-origin boundaries for assets. To reduce the risk a bit, camo-rs will always set the following headers in all of its proxied responses:

content-security-policy: default-src 'none'; img-src data:; style-src 'unsafe-inline'
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block

Which will reduce the amount of things you can do with the proxied resources significantly. In addition, camo-rs filters responses by content-type. Administrators can set flags to allow audio/*, image/*, and video/* MIME types in the config. Other content types will be rejected. camo-rs will reject to proxy resources without a content-type headers set. While providing this header is not required by the spec, real-world observations show that the vast majority of servers do, at least for static files, correctly set the content-type header.

Changes to request and response headers

In addition to the security-relevant response header changes mentioned above, Camo will make some additional changes to the headers:

Requests to the upstream will always have the user-agent and via headers set to the configured value.
Responses will, in addition to the headers from the upstream, always have a x-camo-original-url header, showing the original URL without any encoding.

Configuration

Configuration can be done via environment variables and CLI flags. The available configuration can be listed by running Camo with --help, but they're also documented at /docs/configuration.md.

Installation and Usage

Please see the additional documentation in the docs folder for details on

License

MIT. This projects takes heavy inspiration from atmos/camo, which also was licensed under the MIT license.

Comments

Add an option to disable ANSI color codes in logging output

At the moment the logging always logs with ANSI color codes to format the logs. That's fancy if you have a terminal that can show colors, but it makes the logs extremely hard to read if you run it as a service and just log the output.

So it would be useful to have an option to only log plain text without ANSI codes. Bonus points for an option to log as JSON instead.
✨ enhancement

opened by SuperTux88 4
Bump axum from 0.6.0-rc.5 to 0.6.0
Bumps axum from 0.6.0-rc.5 to 0.6.0.

Release notes

Sourced from axum's releases.

axum - v0.6.0

Routing

fixed: Nested routers are now allowed to have fallbacks (#1521):

let api_router = Router::new() .route("/users", get(|| { ... })) .fallback(api_fallback);
let app = Router::new() // this would panic in 0.5 but in 0.6 it just works // // requests starting with /api but not handled by api_router // will go to /api_fallback .nest("/api", api_router);

The outer router's fallback will still apply if a nested router doesn't have its own fallback:

// this time without a fallback let api_router = Router::new().route("/users", get(|| { ... }));
let app = Router::new() .nest("/api", api_router) // api_fallback will inherit this fallback .fallback(app_fallback);

breaking: The request /foo/ no longer matches /foo/*rest. If you want to match /foo/ you have to add a route specifically for that (#1086)

For example:

use axum::{Router, routing::get, extract::Path}; let app = Router::new() // this will match /foo/bar/baz .route("/foo/*rest", get(handler)) // this will match /foo/ .route("/foo/", get(handler)) // if you want /foo to match you must also add an explicit route for it .route("/foo", get(handler));
async fn handler( // use an Option because /foo/ and /foo don't have any path params params: Option<Path<String>>,

... (truncated)

Commits

1b6780c axum 0.6 and friends 🎉 (#1570)

0b26411 Change Router::with_state and impl Service for Router\<()> (#1552)

fde38f6 docs: Add axum-csrf-sync-pattern to ECOSYSTEM.md (#1567)

102d588 add showcase freedit (#1559)

6771729 Improve State and Router docs (#1543)

7d0bb28 Minor doc fixes (#1562)

ddee1c1 docs: add how to use Arc<AppState> with the cookies examples (#1560)

c7e696b provide links to axum-sessions and axum-login (#1553)

3ab3e5f Use http re-export in docs (#1554)

8d2fb36 Remove unused imports from doctest (#1551)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
Bump clap from 4.0.26 to 4.0.27
Bumps clap from 4.0.26 to 4.0.27.

Changelog

Sourced from clap's changelog.

[4.0.27] - 2022-11-24

Features

Have Arg::value_parser accept Vec<impl Into<PossibleValue>>

Implement Display and FromStr for ColorChoice

Fixes

Remove soundness issue by switching from atty to is-terminal

Commits

3262016 chore: Release

757f95b docs: Update changelog

20e02eb Merge pull request #4509 from epage/possible

fb1d960 Merge pull request #4249 from jcgruenhage/replace-atty

94aca92 feat: Create ValueParser from Vec<PossibleValue>

3bccfce docs: Clarify PossibleValue is likely not needed

19981a2 docs: Clarify ColorChoice impls ValueEnum

8d92f3e feat: Add Display/FromStr to ColorChoice

ed683ef fix: Always expose ColorChoice

789bfd6 Merge pull request #4508 from epage/style

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
Bump reqwest from 0.11.12 to 0.11.13
Bumps reqwest from 0.11.12 to 0.11.13.

Release notes

Sourced from reqwest's releases.

v0.11.13

What's Changed

Add ClientBuilder::dns_resolver() option for custom DNS resolvers.

Add ClientBuilder::tls_sni(bool) option to enable or disable TLS Server Name Indication.

Add Identity::from_pkcs8_pem() constructor when using native-tls.

Fix redirect::Policy::limited(0) from following any redirects.

New Contributors

@NobodyXu made their first contribution in seanmonstar/reqwest#1647

@anhcuky made their first contribution in seanmonstar/reqwest#1645

@mirecl made their first contribution in seanmonstar/reqwest#1655

@irrelevelephant made their first contribution in seanmonstar/reqwest#1653

@Alvenix made their first contribution in seanmonstar/reqwest#1669

@kianmeng made their first contribution in seanmonstar/reqwest#1562

Changelog

Sourced from reqwest's changelog.

v0.11.13

Add ClientBuilder::dns_resolver() option for custom DNS resolvers.

Add ClientBuilder::tls_sni(bool) option to enable or disable TLS Server Name Indication.

Add Identity::from_pkcs8_pem() constructor when using native-tls.

Fix redirect::Policy::limited(0) from following any redirects.

Commits

3c39260 v0.11.13

81fc85a docs: fix some typos (#1562)

e302f75 Add option to configure TLS server name indication (SNI) (#1669)

f11e958 Add support for custom DNS resolution (#1653)

231b18f native-tls: add Identiy::from_pkcs8_pem (#1655)

110c3ae Fix redirect limited(0) should not follow redirects (#1645)

4c37766 Bump dep trust-dns-resolver to v0.22 (#1647)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
Bump axum from 0.6.0-rc.2 to 0.6.0-rc.5
Bumps axum from 0.6.0-rc.2 to 0.6.0-rc.5.

Release notes

Sourced from axum's releases.

axum - v0.6.0-rc.5

breaking: Router::with_state is no longer a constructor. It is instead used to convert the router into a RouterService (#1532)

This nested router on 0.6.0-rc.4

Router::with_state(state).route(...);

Becomes this in 0.6.0-rc.5

Router::new().route(...).with_state(state);

breaking:: Router::inherit_state has been removed. Use Router::with_state instead (#1532)

breaking:: Router::nest and Router::merge now only supports nesting routers that use the same state type as the router they're being merged into. Use FromRef for substates (#1532)

added: Add accept_unmasked_frames setting in WebSocketUpgrade (#1529)

fixed: Nested routers will now inherit fallbacks from outer routers (#1521)

added: Add WebSocketUpgrade::on_failed_upgrade to customize what to do when upgrading a connection fails (#1539)

#1521: tokio-rs/axum#1521 #1529: tokio-rs/axum#1529 #1532: tokio-rs/axum#1532 #1539: tokio-rs/axum#1539

axum - v0.6.0-rc.4

changed: The inner error of a JsonRejection is now serde_path_to_error::Error<serde_json::Error>. Previously it was serde_json::Error (#1371)

added: JsonRejection now displays the path at which a deserialization error occurred too (#1371)

fixed: Support streaming/chunked requests in ContentLengthLimit (#1389)

fixed: Used 400 Bad Request for FailedToDeserializeQueryString rejections, instead of 422 Unprocessable Entity (#1387)

added: Add middleware::from_extractor_with_state and middleware::from_extractor_with_state_arc (#1396)

added: Add DefaultBodyLimit::max for changing the default body limit (#1397)

added: Add map_request, map_request_with_state, and map_request_with_state_arc for transforming the request with an async function (#1408)

added: Add map_response, map_response_with_state, and map_response_with_state_arc for transforming the response with an async function (#1414)

... (truncated)

Commits

878ae73 New release candidates (#1541)

4689853 Add example of how to test WebSockets (#1535)

7d58d49 Add #[from_ref(skip)] (#1537)

64960bb Type safe state inheritance (#1532)

ba8e9c1 Add on_failed_upgrade callback to WebSocketUpgrade (#1539)

7090649 Add fallback inheritance for nested routers (#1521)

2e8a7e5 Fix Handler::with_state not working if request body was changed via layer (...

b1f894a Fix unused import if compiling with default features

c461f1d Add accept_unmasked_frames setting in WebSocketUpgrade (#1529)

5874359 Add more tests for the Allow header when returning 405 (#1526)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
Bump clap from 4.0.18 to 4.0.26
Bumps clap from 4.0.18 to 4.0.26.

Release notes

Sourced from clap's releases.

v4.0.26

[4.0.26] - 2022-11-16

Fixes

(error) Fix typos in ContextKind::as_str

v4.0.25

[4.0.25] - 2022-11-15

Features

(error) Report available subcommands when required subcommand is missing

v4.0.24

[4.0.24] - 2022-11-14

Fixes

Avoid panic when printing an argument that isn't built

v4.0.23

[4.0.23] - 2022-11-11

Fixes

Don't panic on reporting invalid-long errors when followed by invalid UTF8

(help) Clarified argument to help subcommand

v4.0.22

[4.0.22] - 2022-11-07

Fixes

(help) Don't overflow into next-line-help early due to stale (pre-v4) padding calculations

v4.0.21

[4.0.21] - 2022-11-07

Features

(derive) long_about and long_help attributes, without a value, force using doc comment (before it wouldn't be set if there wasn't anything different than the short help)

v4.0.20

[4.0.20] - 2022-11-07

Fixes

(derive) Allow defaulted value parser for '()' fields

... (truncated)

Changelog

Sourced from clap's changelog.

[4.0.26] - 2022-11-16

Fixes

(error) Fix typos in ContextKind::as_str

[4.0.25] - 2022-11-15

Features

(error) Report available subcommands when required subcommand is missing

[4.0.24] - 2022-11-14

Fixes

Avoid panic when printing an argument that isn't built

[4.0.23] - 2022-11-11

Fixes

Don't panic on reporting invalid-long errors when followed by invalid UTF8

(help) Clarified argument to help subcommand

[4.0.22] - 2022-11-07

Fixes

(help) Don't overflow into next-line-help early due to stale (pre-v4) padding calculations

[4.0.21] - 2022-11-07

Features

(derive) long_about and long_help attributes, without a value, force using doc comment (before it wouldn't be set if there wasn't anything different than the short help)

[4.0.20] - 2022-11-07

Fixes

(derive) Allow defaulted value parser for '()' fields

[4.0.19] - 2022-11-04

Features

ColorChoice now implements ValueEnum

Commits

f8e9211 chore: Release

6524416 docs: Update changelog

df1efb4 Merge pull request #4486 from jpgrayson/master

d9c9c7b fix: ContextKind.as_str() spellings

ba32ab8 chore: Release

391cd00 docs: Update changelog

8cefdf3 Merge pull request #4482 from epage/suggest

6b62c82 feat(parser): Show available subcommands when one is missing

d21ee51 test(parser): Verify subcommand required message

010976c chore: Release

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
Bump tokio from 1.21.2 to 1.22.0
Bumps tokio from 1.21.2 to 1.22.0.

Release notes

Sourced from tokio's releases.

Tokio v1.22.0

Added

runtime: add Handle::runtime_flavor (#5138)

sync: add Mutex::blocking_lock_owned (#5130)

sync: add Semaphore::MAX_PERMITS (#5144)

sync: add merge() to semaphore permits (#4948)

sync: add mpsc::WeakUnboundedSender (#5189)

Added (unstable)

process: add Command::process_group (#5114)

runtime: export metrics about the blocking thread pool (#5161)

task: add task::id() and task::try_id() (#5171)

Fixed

macros: don't take ownership of futures in macros (#5087)

runtime: fix Stacked Borrows violation in LocalOwnedTasks (#5099)

runtime: mitigate ABA with 32-bit queue indices when possible (#5042)

task: wake local tasks to the local queue when woken by the same thread (#5095)

time: panic in release mode when mark_pending called illegally (#5093)

runtime: fix typo in expect message (#5169)

runtime: fix unsync_load on atomic types (#5175)

task: elaborate safety comments in task deallocation (#5172)

runtime: fix LocalSet drop in thread local (#5179)

net: remove libc type leakage in a public API (#5191)

runtime: update the alignment of CachePadded (#5106)

Changed

io: make tokio::io::copy continue filling the buffer when writer stalls (#5066)

runtime: remove coop::budget from LocalSet::run_until (#5155)

sync: make Notify panic safe (#5154)

Documented

io: fix doc for write_i8 to use signed integers (#5040)

net: fix doc typos for TCP and UDP set_tos methods (#5073)

net: fix function name in UdpSocket::recv documentation (#5150)

sync: typo in TryLockError for RwLock::try_write (#5160)

task: document that spawned tasks execute immediately (#5117)

time: document return type of timeout (#5118)

time: document that timeout checks only before poll (#5126)

sync: specify return type of oneshot::Receiver in docs (#5198)

Internal changes

runtime: use const Mutex::new for globals (#5061)

runtime: remove Option around mio::Events in io driver (#5078)

runtime: remove a conditional compilation clause (#5104)

runtime: remove a reference to internal time handle (#5107)

runtime: misc time driver cleanup (#5120)

runtime: move signal driver to runtime module (#5121)

runtime: signal driver now uses I/O driver directly (#5125)

... (truncated)

Commits

bf31759 chore: prepare Tokio v1.22.0 (#5203)

d658262 ci: remove libc types from external types allow list (#5197)

1cbbcc9 sync: specify return type of oneshot::Receiver in docs (#5198)

a668020 net: remove libc type leakage in a public API (#5191)

01f0193 chore: fix compilation on master (#5190)

71bd49e task: add task::id() and task::try_id() (#5171)

582d512 sync: add mpsc::WeakUnboundedSender (#5189)

b7812c8 rt: fix LocalSet drop in thread local (#5179)

9e3fb16 rt: move CoreStage methods to Core (#5182)

53cba02 rt: fix accidental unsetting of current handle (#5178)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
Bump axum from 0.6.0-rc.2 to 0.6.0-rc.4
Bumps axum from 0.6.0-rc.2 to 0.6.0-rc.4.

Release notes

Sourced from axum's releases.

axum - v0.6.0-rc.4

changed: The inner error of a JsonRejection is now serde_path_to_error::Error<serde_json::Error>. Previously it was serde_json::Error (#1371)

added: JsonRejection now displays the path at which a deserialization error occurred too (#1371)

fixed: Support streaming/chunked requests in ContentLengthLimit (#1389)

fixed: Used 400 Bad Request for FailedToDeserializeQueryString rejections, instead of 422 Unprocessable Entity (#1387)

added: Add middleware::from_extractor_with_state and middleware::from_extractor_with_state_arc (#1396)

added: Add DefaultBodyLimit::max for changing the default body limit (#1397)

added: Add map_request, map_request_with_state, and map_request_with_state_arc for transforming the request with an async function (#1408)

added: Add map_response, map_response_with_state, and map_response_with_state_arc for transforming the response with an async function (#1414)

breaking: ContentLengthLimit has been removed. Use DefaultBodyLimit instead (#1400)

changed: Router no longer implements Service, call .into_service() on it to obtain a RouterService that does (#1368)

added: Add Router::inherit_state, which creates a Router with an arbitrary state type without actually supplying the state; such a Router can't be turned into a service directly (.into_service() will panic), but can be nested or merged into a Router with the same state type (#1368)

changed: Router::nest now only accepts Routers, the general-purpose Service nesting method has been renamed to nest_service (#1368)

added: Support compiling to WASM. See the simple-router-wasm example for more details (#1382)

breaking: New tokio default feature needed for WASM support. If you don't need WASM support but have default_features = false for other reasons you likely need to re-enable the tokio feature (#1382)

breaking: handler::{WithState, IntoService} are merged into one type, named HandlerService (#1418)

changed: The default body limit now applies to the Multipart extractor (#1420)

added: String and binary From impls have been added to extract::ws::Message to be more inline with tungstenite (#1421)

added: Add #[derive(axum::extract::FromRef)] (#1430)

added: FromRequest and FromRequestParts derive macro re-exports from [axum-macros] behind the macros feature (#1352)

breaking: MatchedPath can now no longer be extracted in middleware for nested routes (#1462)

added: Add extract::RawForm for accessing raw urlencoded query bytes or request body (#1487)

breaking: Rename FormRejection::FailedToDeserializeQueryString to FormRejection::FailedToDeserializeForm (#1496)

#1352: tokio-rs/axum#1352 #1368: tokio-rs/axum#1368 #1371: tokio-rs/axum#1371 #1382: tokio-rs/axum#1382

... (truncated)

Commits

74bbe80 axum 0.6.0-rc.4 (#1518)

028cac4 Fix compile error in release mode (#1517)

1d6a96e Remove references to *_with_state_arc functions from changelog

e53c85c Minor changelog fixes

e39d053 New release candidates (#1514)

9c804d5 Update changelog for axum-extra

0e3f9d0 Don't allow extracting MatchedPath in middleware for nested routes (#1462)

e0ef641 Rework Form and Query rejections (#1496)

8d6313a Add example of static-file-server using serve dir with handler as service (#1...

944f388 Add missing cfg's for signed cookie tests

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
Bump clap from 4.0.18 to 4.0.23
Bumps clap from 4.0.18 to 4.0.23.

Release notes

Sourced from clap's releases.

v4.0.23

[4.0.23] - 2022-11-11

Fixes

Don't panic on reporting invalid-long errors when followed by invalid UTF8

(help) Clarified argument to help subcommand

v4.0.22

[4.0.22] - 2022-11-07

Fixes

(help) Don't overflow into next-line-help early due to stale (pre-v4) padding calculations

v4.0.21

[4.0.21] - 2022-11-07

Features

(derive) long_about and long_help attributes, without a value, force using doc comment (before it wouldn't be set if there wasn't anything different than the short help)

v4.0.20

[4.0.20] - 2022-11-07

Fixes

(derive) Allow defaulted value parser for '()' fields

v4.0.19

[4.0.19] - 2022-11-04

Features

ColorChoice now implements ValueEnum

Changelog

Sourced from clap's changelog.

[4.0.23] - 2022-11-11

Fixes

Don't panic on reporting invalid-long errors when followed by invalid UTF8

(help) Clarified argument to help subcommand

[4.0.22] - 2022-11-07

Fixes

(help) Don't overflow into next-line-help early due to stale (pre-v4) padding calculations

[4.0.21] - 2022-11-07

Features

(derive) long_about and long_help attributes, without a value, force using doc comment (before it wouldn't be set if there wasn't anything different than the short help)

[4.0.20] - 2022-11-07

Fixes

(derive) Allow defaulted value parser for '()' fields

[4.0.19] - 2022-11-04

Features

ColorChoice now implements ValueEnum

Commits

95144b7 chore: Release

20ecae1 docs: Update changelog

e6a3529 Merge pull request #4474 from epage/utf8

e9cbed3 fix(parser): Don't panic on invalid UTF-8 values

45d26e0 test(parser): Show UTF8 bug

4d69e56 Merge pull request #4471 from epage/assert

ec03972 test(assert): Verify empty positional assert exists

0d27188 Merge pull request #4465 from epage/help

9376a57 fix(help): Clarify that 'help' command accepts multiple

6cbe5c4 chore: Release

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
Bump hyper from 0.14.20 to 0.14.23
Bumps hyper from 0.14.20 to 0.14.23.

Release notes

Sourced from hyper's releases.

v0.14.23

Bug Fixes

http2: Fix race condition in client dispatcher (#3041) (2f1c0b72, closes #2419)

dependencies: Really fix compile-time feature for socket2 dependency.

New Contributors

@jfourie1 made their first contribution in hyperium/hyper#3041

v0.14.22

Bug Fixes

server: fix compile-time cfgs for TCP keepalive options (#3039) (e8765e0f, closes #3038)

v0.14.21

Bug Fixes

client: send an error back to client when dispatch misbehaves () (9fa36382, closes #2649)

http1: fix http1_header_read_timeout to use same future (#2891) (c5a14e7c)

Features

http1: allow ignoring invalid header lines in requests (73dd4746)

server: add Server::tcp_keepalive_interval and Server::tcp_keepalive_retries (#2991) (287d7124)

New Contributors

@hansonchar made their first contribution in hyperium/hyper#2991

Changelog

Sourced from hyper's changelog.

v0.14.23 (2022-11-07)

Bug Fixes

http2: Fix race condition in client dispatcher (#3041) (2f1c0b72, closes #2419)

v0.14.22 (2022-10-31)

Bug Fixes

server: fix compile-time cfgs for TCP keepalive options (#3039) (e8765e0f, closes #3038)

v0.14.21 (2022-10-31)

Bug Fixes

client: send an error back to client when dispatch misbehaves () (9fa36382, closes #2649)

http1: fix http1_header_read_timeout to use same future (#2891) (c5a14e7c)

Features

http1: allow ignoring invalid header lines in requests (73dd4746)

server: add Server::tcp_keepalive_interval and Server::tcp_keepalive_retries (#2991) (287d7124)

Commits

d32beb3 v0.14.23

4912c6d chore(dependencies): enable socket2 'all' feature (#3047)

2f1c0b7 fix(http2): Fix race condition in client dispatcher (#3041)

04d637e v0.14.22

e8765e0 fix(server): fix compile-time cfgs for TCP keepalive options (#3039)

9ad4055 v0.14.21

9fa3638 fix(client): send an error back to client when dispatch misbehaves (fixes #2649)

78e2c58 chore(http2): add a server feature-gate on some server-only method

73dd474 feat(h1): allow ignoring invalid header lines in requests

287d712 feat(server): add Server::tcp_keepalive_interval and `Server::tcp_keepalive...

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
Bump clap from 4.0.18 to 4.0.20
Bumps clap from 4.0.18 to 4.0.20.

Release notes

Sourced from clap's releases.

v4.0.20

[4.0.20] - 2022-11-07

Fixes

(derive) Allow defaulted value parser for '()' fields

v4.0.19

[4.0.19] - 2022-11-04

Features

ColorChoice now implements ValueEnum

Changelog

Sourced from clap's changelog.

[4.0.20] - 2022-11-07

Fixes

(derive) Allow defaulted value parser for '()' fields

[4.0.19] - 2022-11-04

Features

ColorChoice now implements ValueEnum

Commits

b4b94af chore: Release

4ea612c docs: Update changelog

816841f Merge pull request #4459 from epage/unit

79225d3 fix(derive): Allow defaulted value parser for '()' fields

520145e Merge pull request #4449 from epage/update

a24fb58 chore: Update trycmd

7a8cf91 chore: Release

5dfeb1e docs: Update changelog

8c31bce Merge pull request #4445 from tmccombs/colorchoice-valueenum

2ff3d43 feat(derive): Implement ValueEnum for ColorChoice

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
Bump clap from 4.0.29 to 4.0.32
Bumps clap from 4.0.29 to 4.0.32.

Release notes

Sourced from clap's releases.

v4.0.32

[4.0.32] - 2022-12-22

Fixes

(parser) When overriding required(true), consider args that conflict with its group

v4.0.31

[4.0.31] - 2022-12-22

Performance

Speed up parsing when a lot of different flags are present (100 unique flags)

v4.0.30

[4.0.30] - 2022-12-21

Fixes

(error) Improve error for args_conflicts_with_subcommand

Changelog

Sourced from clap's changelog.

[4.0.32] - 2022-12-22

Fixes

(parser) When overriding required(true), consider args that conflict with its group

[4.0.31] - 2022-12-22

Performance

Speed up parsing when a lot of different flags are present (100 unique flags)

[4.0.30] - 2022-12-21

Fixes

(error) Improve error for args_conflicts_with_subcommand

Commits

ec4ccf0 chore: Release

13fdb83 docs: Update changelog

b877345 Merge pull request #4573 from epage/conflict

85ecb3e fix(parser): Override required when parent group has conflict

d145b8b test(parser): Demonstrate required-overload bug

0eccd55 chore: Release

1e37c25 docs: Update changelog

dcd5fec Merge pull request #4572 from epage/group

dde22e7 style: Update for latest clippy

dd8435d perf(parser): Reduce duplicate lookups

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 0
Bump thiserror from 1.0.37 to 1.0.38
Bumps thiserror from 1.0.37 to 1.0.38.

Release notes

Sourced from thiserror's releases.

1.0.38

Documentation improvements

Commits

74bfe75 Release 1.0.38

cfc7d8c Update build status badge

db78fa2 Update ui test suite to nightly-2022-12-15

c25a710 Time out workflows after 45 minutes

464e2e7 Merge pull request #200 from dtolnay/displayattr

4b06a3e Add test of Display impl nested inside display attribute

29ee95e Ui test changes for trybuild 1.0.66

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 0
Bump hyper-rustls from 0.23.1 to 0.23.2
Bumps hyper-rustls from 0.23.1 to 0.23.2.

Commits

5930fa9 Remove authors from Cargo metadata (see RFC 3052)

67ffaf8 Bump version to 0.23.2

73c1ee9 Update changelog for 0.23.2

0a34dd9 fix: can't resolve ip address with square brackets

141eb5f Disable clippy lint for enum variant sizes

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 0
Improvements to the release process/CI
There are a couple of things I could improve.

[x] The binary inside the archive doesn't have the executable flag set. This is due to an issue in the upload-artifact action, but this can be worked around by building a tar/zip manually and uploading that.

[x] Instead of camo-linux-amd64.zip, it probably makes sense to add the version number to the archive, something like camo-v0.3.0-linux-amd64.zip so it's clear when linking to it.

[ ] For releasing, I currently have to wait until the build job for the release branch is done, then downloading the artifacts, drafting a release, and attaching the artifacts there. In theory, I could run GHA when a new tag is created, build release artifacts, and automatically create a new draft release with the artifacts attached. The matrix-org/synapse repo has something close to that where I could probably take inspiration from.

[x] My current version number hacks based on ::set-output are deprecated, and there is a much nicer way available.

[x] action-rs seems unmaintained. This will become an issue soon since GitHub Actions will deprecate NodeJS 12. I can probably just manually use rustup and call cargo...

Optionally, some other things:

[ ] The docker-release workflow currently doesn't care about the "pre-release" checkbox in a release, and would tag even pre-releases to latest. This probably isn't a big deal since I don't plan on releasing pre-releases, but it might be worth adjusting that, and only push a tag 1.0.0-dev, instead of pushing it to 1, 1.0, 1.0.0-dev, and latest.

[x] I currently push container images to Docker Hub, but there's no reason not to push it towards the GitHub Container Registry as well.

✨ enhancement
opened by denschub 1

Releases(v1.1.0)

v1.1.0(Dec 8, 2022)
Switch from OpenSSL-bindings to Rustls, to avoid incompatibilities between OpenSSL 1.x and 3.x (looking at you, Canonical)...

Switched back to Ubuntu 20.04 to build the binaries that are attached to GitHub releases, as the glibc in 22.04 is a bit too new for most folks...

Source code(tar.gz)
Source code(zip)
camo-1.1.0-linux-amd64.zip(3.96 MB)
v1.0.0(Dec 8, 2022)
This is the first release version of camo-rs, so there are no breaking changes to any previous stable release!

For people running a 0.x prerelease, these are the breaking changes between the latest pre-release and this stable release:

For boolean settings like CAMO_ALLOW_IMAGE, you have to explicitly set true or false as values, and other values will be rejected as invalid. The previous behavior, where any specified value (like yes or confusingly even no) would be parsed as true has been removed. Omitting those fields will, however, still set them to false by default.

Source code(tar.gz)
Source code(zip)
camo-1.0.0-linux-amd64.zip(3.19 MB)
v0.3.0(Sep 12, 2022)
You can now set the log output level with --log-level/CAMO_LOG_LEVEL, and the log output format with --log-format/CAMO_LOG_FORMAT. Please see the documentation for full details!

Source code(tar.gz)
Source code(zip)
camo-linux-amd64.zip(3.14 MB)
v0.2.0(Sep 4, 2022)
camo-rs now refuses to start if no content-types are allowed. Before that, Camo would start up just fine, but reject everything, which can be confusing.

When receiving a status code outside the expected range ([200..399]), Camo will still reject that request, but will pass the upstream status code to the client.

Even with RUST_LOG=warn, the log will still contain the encoded digest, target, and - if available - the decoded and validated target URL. This makes debugging production setups easier.

Source code(tar.gz)
Source code(zip)
camo-linux-amd64.zip(3.46 MB)
v0.1.0(Aug 29, 2022)

This is the first public release. While it is not considered "production-ready" yet, it should work, and is currently being tested in experimental rollouts.
Source code(tar.gz)
Source code(zip)
camo-linux-amd64.zip(3.46 MB)