v0.22.2 cli presentation improvements, hardened config

doc/cli.md

@@ -26,7 +26,7 @@ pipelines have [their own flags](#pipelines):
 ```
 --<path>=<value>        e.g. --logging.level=debug
 --<path> <value>        e.g. --logging.level debug
---<path>                bare flag, means true
+--<path>                bare flag: true, for a boolean path only
 ```
 
 ### Common

doc/configuration.md

@@ -231,13 +231,18 @@ lw --logging.level debug          # space form also works
 lw --quiet                        # bare flag means true
 ```
 
-Unrecognized flags are reported on stderr before the logger exists and are then
-ignored:
+A bare flag is accepted only for a boolean key: `--logging.file.directory
+--quiet` fails with `--logging.file.directory needs a value`. Unrecognized flags,
+positional words and single-dash arguments are reported on stderr before the
+logger exists and are then ignored:
 
 ```
-Warning: unrecognized flags ignored: [pipelines.0.name]
+Warning: unrecognized flags ignored: [pipelines.0.name -q]
 ```
 
+An empty `LOGWISP_<PATH>` variable counts as unset, as the pipeline variables
+do.
+
 Array-indexed paths such as `--pipelines.0.name=x` are unrecognized; whole
 pipelines have [their own flags](cli.md#pipelines).
 

doc/security.md

@@ -26,6 +26,16 @@ configure it, and — equally important — what it does not yet do.
   [Startup Warnings](#startup-warnings).
 - Unknown configuration keys rejected: a typo in `tls`, `auth` or a table path
   fails startup.
+- Configuration input hardened (lixenwraith/config v0.2.2, reviewed with
+  adversarial tests and fuzzing like `auth`):
+  - a string in the file is one list entry, so a filter pattern holding a
+    comma is not split into patterns that match nothing;
+  - the file is opened without blocking, so a FIFO swapped in for it cannot
+    hang the watcher or a `SIGHUP` reload;
+  - a permission change on the file is reported once and does not stop
+    auto-reload;
+  - conversion errors name the key, never the value, so a secret placed in
+    the wrong key does not reach the log.
 
 **Not implemented:**
 

doc/todo.md

@@ -131,34 +131,12 @@ its input queue into the client queues, then let every client writer drain its
 queue within a bound (`write_timeout_ms`) before the disconnect frame. Verify
 with a finite stdin into each sink and a connected client counting lines.
 
-## 3. Hardening review of `lixenwraith/config` and `lixenwraith/toml`
+## 3. Bump `lixenwraith/toml`
 
-Both parse untrusted-shaped input (config files, environment, command line)
-and were not reviewed with the auth work. Review them as `auth` was reviewed:
-adversarial lenses, reproduction before belief, a fix per confirmed finding in
-the library repository, then a dependency bump here.
-
-- toml parser:
-  - Limits on nesting depth, key count, string and array length, and number
-    sizes.
-  - Behaviour on invalid UTF-8, duplicate keys and tables, dotted-key and
-    inline-table redefinition.
-  - Fuzz targets (`go test -fuzz`) seeded with the TOML test suite.
-- config:
-  - The weakly typed decoder: string-to-number overflow, duration and size
-    parsing, the comma split into slices.
-  - `maxValueDepth` and `MaxValueSize`, environment and CLI precedence, and
-    unknown-key reporting.
-- Files:
-  - `PreventPathTraversal`, symlink handling and the file-size cap.
-  - The watcher: polling, debounce, a file replaced by rename or symlink swap,
-    TOCTOU between stat and read.
-- Errors: values must never echo secrets (a misplaced password in a config
-  value reported back in an error).
-- Deliverables:
-  - Findings per library.
-  - Fuzz targets committed in the library repositories.
-  - A note in this repository's security.md once done.
+Its hardening commits (a table budget, TOML 1.1 escapes, control characters
+refused outside strings, bounded errors that never print a value) wait to merge
+in that repository. Then bump it here and drop this item; security.md's library
+note already covers it.
 
 ## 4. Packaging: AUR, FreeBSD ports, Debian