security: v0.5.8 — body-limit pre-buffer, rustls-webpki CVE fixes, demos

P1 hardening: multipart uploads now reject pre-buffer via
`tower_http::limit::RequestBodyLimitLayer`. `Content-Length` exceeding
`max_upload_size` returns 413 before any body bytes are read, closing a
memory-exhaustion vector that existed when axum's multipart extractor
streamed oversized bodies and mapped the resulting error to 500.

CVEs: upgraded rustls-webpki 0.103.10 → 0.103.12 to address
RUSTSEC-2026-0098 (URI name constraints incorrectly accepted) and
RUSTSEC-2026-0099 (wildcard name constraints incorrectly accepted).

Added four regression tests covering oversized sign/verify 413,
Content-Length pre-buffer 413, and under-limit negative. Committed the
interactive demos landing page (`docs/demo.html` + six asciinema casts)
and bumped docs/README version badges to 0.5.8. CHANGELOG filled in the
missing 0.5.6 / 0.5.7 entries and captures 0.5.8.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: rayketcham

CHANGELOG.md

@@ -7,6 +7,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.8] - 2026-04-16
+
+### Security
+- **P1 hardening: multipart body-limit pre-buffer enforcement** — added `tower_http::limit::RequestBodyLimitLayer` so `Content-Length` exceeding `max_upload_size` returns `413 Payload Too Large` before any body bytes are buffered. Prevents memory-exhaustion via lying/huge uploads at multipart-extractor edge.
+- **CVE: rustls-webpki name-constraint bypasses** (RUSTSEC-2026-0098, RUSTSEC-2026-0099) — bumped `rustls-webpki` from 0.103.10 to 0.103.12 via `cargo update`. URI-name and wildcard name-constraint validation is now correct.
+
+### Added
+- Four body-limit regression tests in `web::handlers` covering sign/verify oversized-body 413, Content-Length pre-buffer 413, and under-limit negative assertion.
+- Interactive demos landing page at `docs/demo.html` with six asciinema scenarios.
+
+## [0.5.7] - 2026-03-25
+
+### Fixed
+- **CAB Authenticode interop** (#45) — reserve-header magic must be `00 00 10 00` (not `14 00 00 00`); hash covers selective fields `[0..4]+[8..34]+[56..60]+[60..sigOffset]` so osslsigncode/signtool accept output.
+- **MSI Authenticode interop** (#46) — hash includes root CLSID (16 bytes) after stream contents; stream order uses raw UTF-16LE byte sort.
+- CI test-coverage expansion for CAB/MSI interop.
+
+## [0.5.6] - 2026-03-23
+
+### Added
+- **P-521 ECDSA signing** end-to-end with web e2e tests.
+- **CIDR-aware reverse-proxy trust** for `X-Forwarded-For` / `X-Real-IP` — only trusted CIDRs may set `client_ip`.
+- **Rate limiting** middleware per-endpoint / per-IP.
+- **Cosign signing** support (keyless + key-pair) for OCI artifacts.
+- **Secret scanning** pre-commit hook and CI gate.
+- `client_ip` field on all audit-log records.
+- Unit tests for `config`, `audit`, `ldap` modules.
+
+### Changed
+- **Error-handling refactor** — unified `AppError` variants across the web layer; consistent 4xx/5xx mapping.
+- All GitHub Actions pinned to commit SHAs.
+
+### Security
+- Team-review fixes: dead-code removal, key `Zeroize` on drop paths, CI permission hardening.
+- CSP hardening and fail-closed auth middleware.
+- Assorted CVE patches (see commit `21879da`).
+
 ## [0.5.4] - 2026-03-20
 
 ### Added

Cargo.lock

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/pki-sign"]
 
 [workspace.package]
-version = "0.5.7"
+version = "0.5.8"
 edition = "2021"
 rust-version = "1.88"
 license = "Apache-2.0"
@@ -32,7 +32,7 @@ tokio = { version = "1.44", features = ["full"] }
 
 # HTTP server / client
 axum = "0.7"
-tower-http = { version = "0.5", features = ["trace", "cors", "fs"] }
+tower-http = { version = "0.5", features = ["trace", "cors", "fs", "limit"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 reqwest = { version = "0.12", features = ["json", "rustls-tls-native-roots", "rustls-tls-webpki-roots", "blocking"], default-features = false }

Cargo.toml

@@ -22,7 +22,7 @@ No OpenSSL. No `signtool.exe`. No external dependencies. One binary.
 [![OpenSSL](https://img.shields.io/badge/OpenSSL-not%20required-brightgreen?logo=openssl&logoColor=white)](https://github.com/rayketcham-lab/PKI-Signing-Service)
 
 <!-- Project Info -->
-[![Version](https://img.shields.io/badge/version-0.5.7-blue?logo=semver&logoColor=white)](https://github.com/rayketcham-lab/PKI-Signing-Service/releases/latest)
+[![Version](https://img.shields.io/badge/version-0.5.8-blue?logo=semver&logoColor=white)](https://github.com/rayketcham-lab/PKI-Signing-Service/releases/latest)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-green?logo=apache&logoColor=white)](LICENSE)
 [![Rust](https://img.shields.io/badge/language-Rust-orange?logo=rust&logoColor=white)](https://www.rust-lang.org/)
 [![MSRV](https://img.shields.io/badge/MSRV-1.88-orange?logo=rust&logoColor=white)](https://blog.rust-lang.org/)
@@ -338,7 +338,7 @@ Compatible with any RFC 3161 client --- `signtool.exe`, `openssl ts`, or this to
 ## CLI Reference
 
 ```
-pki-sign 0.5.4
+pki-sign 0.5.8
 PKI Signing Service - Pure Rust Code Signing Engine
 
 USAGE:

README.md

@@ -1557,6 +1557,9 @@ mod tests {
     }
 
     /// Issue a POST request with an arbitrary body against the router.
+    ///
+    /// Sets `Content-Length` from `body.len()` to match realistic clients —
+    /// without it, the body-limit layer cannot pre-reject oversized uploads.
     async fn post_raw(
         state: Arc<AppState>,
         uri: &str,
@@ -1570,6 +1573,7 @@ mod tests {
             .method("POST")
             .uri(uri)
             .header(axum::http::header::CONTENT_TYPE, content_type)
+            .header(axum::http::header::CONTENT_LENGTH, body.len())
             .body(axum::body::Body::from(body))
             .unwrap();
         router.oneshot(request).await.unwrap()
@@ -1578,8 +1582,6 @@ mod tests {
     /// Build a minimal multipart/form-data body with a single `file` field.
     ///
     /// Returns `(content_type_header, body_bytes)`.
-    /// Scaffolded for upcoming multipart upload handler tests.
-    #[allow(dead_code)]
     fn build_multipart_with_file(filename: &str, data: &[u8]) -> (String, Vec<u8>) {
         let boundary = "testboundary1234567890";
         let content_type = format!("multipart/form-data; boundary={boundary}");
@@ -1701,6 +1703,131 @@ mod tests {
         assert_eq!(json["error"], "not_found");
     }
 
+    // ─── Body-limit enforcement tests (P1 security fix) ─────────────────────
+
+    /// Build an [`AppState`] with a tiny `max_upload_size` so tests can exceed
+    /// the limit without allocating huge buffers.
+    fn make_test_state_with_max(max_upload_size: u64) -> Arc<AppState> {
+        let tmp = tempfile::NamedTempFile::new().expect("tempfile");
+        let audit_path = tmp.path().to_path_buf();
+        std::mem::forget(tmp);
+
+        let config = SignConfig {
+            dev_mode: true,
+            require_timestamp: false,
+            audit_log: audit_path.clone(),
+            max_upload_size,
+            ..SignConfig::default()
+        };
+
+        Arc::new(AppState {
+            config,
+            credentials: tokio::sync::RwLock::new(vec![]),
+            default_credential: tokio::sync::RwLock::new(0),
+            audit: crate::web::audit::AuditLogger::new(&audit_path).expect("audit logger"),
+            started_at: std::time::Instant::now(),
+            stats: crate::web::SigningStats::default(),
+            gh_reporter: None,
+        })
+    }
+
+    /// POST a multipart body larger than `max_upload_size` — must be rejected
+    /// at the axum layer with 413 Payload Too Large, NOT 500 Internal.
+    ///
+    /// Without pre-buffer enforcement the oversized body is streamed through
+    /// the multipart extractor and the resulting error was mapped to 500,
+    /// letting attackers observe internal error messages and forcing the
+    /// server to read significant data before rejecting.
+    #[tokio::test]
+    async fn test_sign_oversized_body_rejected_with_413() {
+        let max = 1024u64;
+        let state = make_test_state_with_max(max);
+        // Build a multipart body whose payload exceeds `max`.
+        let oversized = vec![0xAAu8; (max as usize) * 4];
+        let (ct, body) = build_multipart_with_file("big.exe", &oversized);
+        assert!(body.len() as u64 > max);
+
+        let resp = post_raw(state, "/api/v1/sign", &ct, body).await;
+        assert_eq!(
+            resp.status(),
+            axum::http::StatusCode::PAYLOAD_TOO_LARGE,
+            "oversized upload must return 413, got {}",
+            resp.status()
+        );
+    }
+
+    /// Same for `/api/v1/verify` — every multipart endpoint must enforce the
+    /// limit uniformly.
+    #[tokio::test]
+    async fn test_verify_oversized_body_rejected_with_413() {
+        let max = 1024u64;
+        let state = make_test_state_with_max(max);
+        let oversized = vec![0xAAu8; (max as usize) * 4];
+        let (ct, body) = build_multipart_with_file("big.exe", &oversized);
+
+        let resp = post_raw(state, "/api/v1/verify", &ct, body).await;
+        assert_eq!(
+            resp.status(),
+            axum::http::StatusCode::PAYLOAD_TOO_LARGE,
+            "oversized verify upload must return 413, got {}",
+            resp.status()
+        );
+    }
+
+    /// A request whose declared `Content-Length` exceeds the limit must be
+    /// rejected BEFORE the body is read (pre-buffer enforcement). This is
+    /// the defining property of the P1 fix: no bytes of a lying client's
+    /// payload are buffered when the header already reveals the overflow.
+    #[tokio::test]
+    async fn test_content_length_header_exceeds_limit_rejected_with_413() {
+        use tower::ServiceExt as _;
+
+        let max = 1024u64;
+        let state = make_test_state_with_max(max);
+        let router = crate::web::build_router(state);
+
+        // Craft a tiny body but a Content-Length header that claims it's huge.
+        // axum will compare CL against the limit and reject with 413 before
+        // streaming. We test with a legitimately oversized body to avoid
+        // ambiguous framing; the point is Content-Length > max.
+        let body_bytes = vec![0u8; (max as usize) * 2];
+        let request = axum::http::Request::builder()
+            .method("POST")
+            .uri("/api/v1/sign")
+            .header(
+                axum::http::header::CONTENT_TYPE,
+                "multipart/form-data; boundary=xxxx",
+            )
+            .header(axum::http::header::CONTENT_LENGTH, body_bytes.len())
+            .body(axum::body::Body::from(body_bytes))
+            .unwrap();
+
+        let resp = router.oneshot(request).await.unwrap();
+        assert_eq!(
+            resp.status(),
+            axum::http::StatusCode::PAYLOAD_TOO_LARGE,
+            "Content-Length > max_upload_size must return 413 pre-buffer"
+        );
+    }
+
+    /// Requests within the limit must NOT be rejected by the body-limit
+    /// layer (regression guard: over-eager enforcement would 413 legit uploads).
+    #[tokio::test]
+    async fn test_under_limit_multipart_not_413() {
+        let max = 64 * 1024u64;
+        let state = make_test_state_with_max(max);
+        let small = vec![0u8; 256]; // well under max
+        let (ct, body) = build_multipart_with_file("small.exe", &small);
+        assert!((body.len() as u64) < max);
+
+        let resp = post_raw(state, "/api/v1/sign", &ct, body).await;
+        assert_ne!(
+            resp.status(),
+            axum::http::StatusCode::PAYLOAD_TOO_LARGE,
+            "under-limit request must not be rejected as too large"
+        );
+    }
+
     fn make_user(groups: Vec<String>, is_admin: bool) -> UserInfo {
         let config = LdapConfig {
             cert_groups: [("server".into(), "cn=server-signers".into())]

crates/pki-sign/src/web/handlers.rs

@@ -42,6 +42,7 @@ use axum::extract::DefaultBodyLimit;
 use axum::routing::{get, post};
 use axum::{middleware as axum_middleware, Router};
 use tokio::sync::RwLock;
+use tower_http::limit::RequestBodyLimitLayer;
 use tower_http::services::ServeDir;
 use tower_http::trace::TraceLayer;
 use tracing::info;
@@ -181,7 +182,14 @@ pub fn build_router(state: Arc<AppState>) -> Router {
         )
         // Catch-all
         .fallback(handlers::fallback)
-        // Layers (applied bottom-up: trace first, then security headers, then body limit)
+        // Layers (applied bottom-up: trace first, then security headers, then body limit).
+        //
+        // `RequestBodyLimitLayer` returns 413 Payload Too Large when `Content-Length`
+        // exceeds `max_upload_size`, rejecting the request BEFORE any body is
+        // buffered — the P1 security fix. `DefaultBodyLimit::max` is also set so
+        // axum-extra's `Multipart` extractor uses the same limit (instead of its
+        // internal 2 MB default) for mid-stream (chunked/no-CL) overflow bounding.
+        .layer(RequestBodyLimitLayer::new(max_body))
         .layer(DefaultBodyLimit::max(max_body))
         .layer(axum_middleware::from_fn(
             middleware::security_headers_middleware,