Repository navigation
fix(api): read the TLS certificate and key before starting the server - #1691
Merged
Merged
Conversation
Echo v5 StartTLS reads string paths through os.DirFS("."), which rejects
absolute paths with fs.ErrInvalid. Since 8.38.0, --api-tls-cert-file and
--api-tls-key-file pointing at absolute paths left the process running
with no listener, the error only logged from the serve goroutine.
Read both files in Start and pass their contents to StartTLS, so any
path works and a missing or unreadable file fails the startup.
Closes gotenberg#1690
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Member
|
Thanks @n-rodriguez, great catch and fix! 🙏 |
hbjydev
pushed a commit
to hbjydev/phoebe
that referenced
this pull request
Oct 27, 2026
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | minor | `8.38.1` → `8.39.0` | --- ### Release Notes <details> <summary>gotenberg/gotenberg</summary> ### [`v8.39.0`](https://github.com/gotenberg/gotenberg/releases/tag/v8.39.0): 8.39.0 [Compare Source](gotenberg/gotenberg@v8.38.1...v8.39.0) ##### Security Fixes⚠️ - **Reject ExifTool's `j` option alias and stop loading ExifTool config files.** The metadata check blocked `json` but not its alias `j`. A metadata key could import a JSON file carrying a `HardLink` pseudo-tag, plant `~/.ExifTool_config`, and have the next ExifTool run execute it as Perl. The keys `j`, `addtagsfromfile`, and `alltagsfromfile` now return `400`, and Gotenberg always runs ExifTool with `-config ""`. - **Accept only `http://` and `https://` URLs on the URL routes.** The default deny-list only covered `file://`, so `devtools://devtools/bundled/devtools_app.html` loaded Chromium's privileged DevTools page, and `waitForExpression` ran there with access to local files. `/forms/chromium/convert/url` and `/forms/chromium/screenshot/url` now return `400` for any other scheme. - **Apply path and `wss://` deny rules to WebSocket handshakes.** The pinning proxy matched CONNECT tunnels against `https://host:port`, so a deny rule anchored on a path, such as `^https?://host/`, or on `wss://` refused the plain request but let the handshake through. The proxy now matches tunnels against each scheme's root URL, and a handshake whose full URL is denied fails the conversion with a generic `403`. - **Drop the compromised eMudhra roots** ([#​1699](gotenberg/gotenberg#1699)). The images trusted `emSign ECC Root CA - G3` and `AAA Certificate Services`, whose intermediates have recoverable private keys. The OS bundle now comes from `ca-certificates` `20250419+deb13u1`, the Java trust store used by PDFtk drops both roots, and Chromium 156 rejects them. Thanks [@​hrueger](https://github.com/hrueger). ##### New Features - **`failOnConsoleMessageTypes` for Chromium** ([#​1667](gotenberg/gotenberg#1667)). Fails the conversion with `409` when the page logs a console message of one of the given types (`log`, `debug`, `info`, `warning`, `error`, `assert`). The response lists the messages. Thanks [@​jschneider](https://github.com/jschneider). - **PDF/A-4** ([#​1703](gotenberg/gotenberg#1703)). The `pdfa` form field now accepts `PDF/A-4` on every route that supports it, through the LibreOffice PDF engine. Thanks [@​henningda](https://github.com/henningda). - **`Gotenberg-Version` response header** ([#​1693](gotenberg/gotenberg#1693)). Set on every authenticated route, error responses included, and on webhook deliveries. It is not set on `401` responses or `/health` ([#​1694](gotenberg/gotenberg#1694)). Thanks [@​fragkakis](https://github.com/fragkakis). ##### Behavior Changes - **The URL routes reject non-HTTP schemes.** `chrome://`, `devtools://`, `data:`, and any other scheme besides `http` and `https` now return `400`. - **ExifTool ignores `~/.ExifTool_config`.** The metadata keys `j`, `addtagsfromfile`, and `alltagsfromfile` now return `400`. Prefix them with a group, for example `XMP:j`, to write a tag of that name. - **The `XRECHNUNG` Factur-X profile embeds `xrechnung.xml`.** See the bug fix below. ##### Bug Fixes - **Sporadic `502` on uploads behind HTTP/2 proxies** ([#​1112](gotenberg/gotenberg#1112)). Behind Cloud Run with an `h2c` port, the proxy sent large DATA frames, Go answered with a flood of WINDOW_UPDATE frames, and the proxy dropped the connection mid-upload. Gotenberg now advertises the 16 KiB HTTP/2 default frame size ([#​1700](gotenberg/gotenberg#1700)). Thanks [@​TessilimiTheo](https://github.com/TessilimiTheo) and [@​geoherna](https://github.com/geoherna). - **No listener with absolute TLS paths** ([#​1690](gotenberg/gotenberg#1690)). Since 8.38.0, `--api-tls-cert-file` and `--api-tls-key-file` with absolute paths left Gotenberg running without accepting connections. Both paths work again, and a missing or unreadable file now fails the startup ([#​1691](gotenberg/gotenberg#1691)). Thanks [@​n-rodriguez](https://github.com/n-rodriguez). - **Empty `stampSource` or `watermarkSource` returned `400`** ([#​1692](gotenberg/gotenberg#1692)). Since 8.36.0, a blank source failed the merge, split, Chromium, and LibreOffice routes. An empty source is skipped again. Thanks [@​APX403](https://github.com/APX403). - **OIDC rejected `bearer` in lower case** ([#​1696](gotenberg/gotenberg#1696)). The Authorization scheme is now matched case-insensitively, as RFC 9110 requires. Thanks [@​MaxFreedomPollard](https://github.com/MaxFreedomPollard). - **The `XRECHNUNG` Factur-X profile embedded `factur-x.xml`** ([#​1701](gotenberg/gotenberg#1701)). The spec requires `xrechnung.xml` for this profile, both as the embedded file and in `fx:DocumentFileName`. Other levels keep `factur-x.xml`. Thanks [@​nhh](https://github.com/nhh). ##### Chore - Updated Chromium to `156.0.8078.47`. - Updated pdfcpu to `v0.16.3` and bumped Go to `1.27.3`, which fix several HIGH CVEs in the Go standard library and `golang.org/x` modules ([#​1695](gotenberg/gotenberg#1695)). Thanks [@​sergeykad](https://github.com/sergeykad). - Updated the AWS Lambda Web Adapter to `1.1.0`, which supports Lambda SnapStart ([#​1704](gotenberg/gotenberg#1704)). Thanks [@​michael-follmann](https://github.com/michael-follmann). - Bumped golangci-lint to `v2.15.0`. - Updated Go dependencies. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuNyIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL21pbm9yIl19--> Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/1021
eleboucher
pushed a commit
to eleboucher/homelab
that referenced
this pull request
Oct 31, 2026
… 8.39.0) (#2479) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [docker.io/gotenberg/gotenberg](https://github.com/gotenberg/gotenberg) | minor | `8.38.1` → `8.39.0` | --- ### Release Notes <details> <summary>gotenberg/gotenberg (docker.io/gotenberg/gotenberg)</summary> ### [`v8.39.0`](https://github.com/gotenberg/gotenberg/releases/tag/v8.39.0): 8.39.0 [Compare Source](gotenberg/gotenberg@v8.38.1...v8.39.0) ##### Security Fixes⚠️ - **Reject ExifTool's `j` option alias and stop loading ExifTool config files.** The metadata check blocked `json` but not its alias `j`. A metadata key could import a JSON file carrying a `HardLink` pseudo-tag, plant `~/.ExifTool_config`, and have the next ExifTool run execute it as Perl. The keys `j`, `addtagsfromfile`, and `alltagsfromfile` now return `400`, and Gotenberg always runs ExifTool with `-config ""`. - **Accept only `http://` and `https://` URLs on the URL routes.** The default deny-list only covered `file://`, so `devtools://devtools/bundled/devtools_app.html` loaded Chromium's privileged DevTools page, and `waitForExpression` ran there with access to local files. `/forms/chromium/convert/url` and `/forms/chromium/screenshot/url` now return `400` for any other scheme. - **Apply path and `wss://` deny rules to WebSocket handshakes.** The pinning proxy matched CONNECT tunnels against `https://host:port`, so a deny rule anchored on a path, such as `^https?://host/`, or on `wss://` refused the plain request but let the handshake through. The proxy now matches tunnels against each scheme's root URL, and a handshake whose full URL is denied fails the conversion with a generic `403`. - **Drop the compromised eMudhra roots** ([#​1699](gotenberg/gotenberg#1699)). The images trusted `emSign ECC Root CA - G3` and `AAA Certificate Services`, whose intermediates have recoverable private keys. The OS bundle now comes from `ca-certificates` `20250419+deb13u1`, the Java trust store used by PDFtk drops both roots, and Chromium 156 rejects them. Thanks [@​hrueger](https://github.com/hrueger). ##### New Features - **`failOnConsoleMessageTypes` for Chromium** ([#​1667](gotenberg/gotenberg#1667)). Fails the conversion with `409` when the page logs a console message of one of the given types (`log`, `debug`, `info`, `warning`, `error`, `assert`). The response lists the messages. Thanks [@​jschneider](https://github.com/jschneider). - **PDF/A-4** ([#​1703](gotenberg/gotenberg#1703)). The `pdfa` form field now accepts `PDF/A-4` on every route that supports it, through the LibreOffice PDF engine. Thanks [@​henningda](https://github.com/henningda). - **`Gotenberg-Version` response header** ([#​1693](gotenberg/gotenberg#1693)). Set on every authenticated route, error responses included, and on webhook deliveries. It is not set on `401` responses or `/health` ([#​1694](gotenberg/gotenberg#1694)). Thanks [@​fragkakis](https://github.com/fragkakis). ##### Behavior Changes - **The URL routes reject non-HTTP schemes.** `chrome://`, `devtools://`, `data:`, and any other scheme besides `http` and `https` now return `400`. - **ExifTool ignores `~/.ExifTool_config`.** The metadata keys `j`, `addtagsfromfile`, and `alltagsfromfile` now return `400`. Prefix them with a group, for example `XMP:j`, to write a tag of that name. - **The `XRECHNUNG` Factur-X profile embeds `xrechnung.xml`.** See the bug fix below. ##### Bug Fixes - **Sporadic `502` on uploads behind HTTP/2 proxies** ([#​1112](gotenberg/gotenberg#1112)). Behind Cloud Run with an `h2c` port, the proxy sent large DATA frames, Go answered with a flood of WINDOW_UPDATE frames, and the proxy dropped the connection mid-upload. Gotenberg now advertises the 16 KiB HTTP/2 default frame size ([#​1700](gotenberg/gotenberg#1700)). Thanks [@​TessilimiTheo](https://github.com/TessilimiTheo) and [@​geoherna](https://github.com/geoherna). - **No listener with absolute TLS paths** ([#​1690](gotenberg/gotenberg#1690)). Since 8.38.0, `--api-tls-cert-file` and `--api-tls-key-file` with absolute paths left Gotenberg running without accepting connections. Both paths work again, and a missing or unreadable file now fails the startup ([#​1691](gotenberg/gotenberg#1691)). Thanks [@​n-rodriguez](https://github.com/n-rodriguez). - **Empty `stampSource` or `watermarkSource` returned `400`** ([#​1692](gotenberg/gotenberg#1692)). Since 8.36.0, a blank source failed the merge, split, Chromium, and LibreOffice routes. An empty source is skipped again. Thanks [@​APX403](https://github.com/APX403). - **OIDC rejected `bearer` in lower case** ([#​1696](gotenberg/gotenberg#1696)). The Authorization scheme is now matched case-insensitively, as RFC 9110 requires. Thanks [@​MaxFreedomPollard](https://github.com/MaxFreedomPollard). - **The `XRECHNUNG` Factur-X profile embedded `factur-x.xml`** ([#​1701](gotenberg/gotenberg#1701)). The spec requires `xrechnung.xml` for this profile, both as the embedded file and in `fx:DocumentFileName`. Other levels keep `factur-x.xml`. Thanks [@​nhh](https://github.com/nhh). ##### Chore - Updated Chromium to `156.0.8078.47`. - Updated pdfcpu to `v0.16.3` and bumped Go to `1.27.3`, which fix several HIGH CVEs in the Go standard library and `golang.org/x` modules ([#​1695](gotenberg/gotenberg#1695)). Thanks [@​sergeykad](https://github.com/sergeykad). - Updated the AWS Lambda Web Adapter to `1.1.0`, which supports Lambda SnapStart ([#​1704](gotenberg/gotenberg#1704)). Thanks [@​michael-follmann](https://github.com/michael-follmann). - Bumped golangci-lint to `v2.15.0`. - Updated Go dependencies. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuOSIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS45IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/2479
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1690
Since 8.38.0,
--api-tls-cert-fileand--api-tls-key-filepointing at absolute paths leave Gotenberg running with no listener. Echo v5StartTLSreads string paths throughos.DirFS("."), which rejects absolute paths withfs.ErrInvalid("readfile …: invalid argument"), and the error is only logged from the serve goroutine.Startnow reads both files withos.ReadFileand passes their contents toStartTLS, which accepts[]byteas-is.Tests:
pkg/modules/api/api_tls_test.gostarts the API with a self-signed pair written undert.TempDir()(absolute paths) and calls/versionover HTTPS, and checks that missing files makeStartreturn an error. Both fail onmain(connection refused, thennilerror) and pass with the fix.go test ./pkg/modules/api/...andgolangci-lintv2.13.2 pass.🤖 Generated with Claude Code