| 2026-08-07 21:12 | fix packaging warning | Christian Grothoff | 2 | +8 | -2 |
| 2026-08-07 21:07 | try to fix debian package | Christian Grothoff | 1 | +15 | -6 |
| 2026-08-07 20:34 | bump versions for Debian package | Christian Grothoff | 2 | +8 | -2 |
| 2026-08-07 18:40 | add benchmark | Christian Grothoff | 7 | +1247 | -11 |
| 2026-08-07 18:25 | add reverse proxy test | Christian Grothoff | 18 | +4855 | -738 |
| 2026-08-07 16:54 | expand test suite with payment test | Christian Grothoff | 7 | +1210 | -5 |
| 2026-08-07 14:51 | -fix misc nits | Christian Grothoff | 26 | +1546 | -438 |
| 2026-08-07 14:43 | expand cookie tests | Christian Grothoff | 5 | +1239 | -209 |
| 2026-08-07 14:41 | build system cleanups | Christian Grothoff | 19 | +360 | -158 |
| 2026-08-07 12:03 | clean up Debian package and especially hardening | Christian Grothoff | 10 | +136 | -133 |
| 2026-08-07 12:02 | improve reverse HTTP standards conformance (options, timeouts, etc.) | Christian Grothoff | 2 | +622 | -27 |
| 2026-08-06 22:06 | implement connection limit options and handle OOM for buffer allocation | Christian Grothoff | 5 | +169 | -10 |
| 2026-08-06 22:04 | add timeout on merchant backend request and only Vary on language if we actually have multiple templates that could apply | Christian Grothoff | 2 | +204 | -22 |
| 2026-08-06 21:23 | escape string literals for JS and set CSP policy | Christian Grothoff | 2 | +188 | -4 |
| 2026-08-06 21:18 | refuse to start without templates, unless in no-pay-mode | Christian Grothoff | 2 | +29 | -6 |
| 2026-08-06 21:18 | replace badly named cur_time with expiration | Christian Grothoff | 6 | +173 | -50 |
| 2026-08-06 17:25 | clean up forwarding header chain parsing and handling | Christian Grothoff | 2 | +45 | -20 |
| 2026-08-06 17:23 | clean up forwarding header chain parsing and handling | Christian Grothoff | 7 | +2759 | -1066 |
| 2026-08-06 17:19 | misc robustness fixes | Christian Grothoff | 4 | +399 | -22 |
| 2026-08-06 17:13 | construct proper cookie path | Christian Grothoff | 4 | +665 | -8 |
| 2026-08-06 16:03 | ensure restarts happen if merchant backend is not available when we try to load templates | Christian Grothoff | 1 | +22 | -9 |
| 2026-08-06 16:02 | refuse to start if templates are not valid | Christian Grothoff | 2 | +18 | -14 |
| 2026-08-06 16:00 | make BASE_URL mandatory if '-f' is not given | Christian Grothoff | 2 | +39 | -3 |
| 2026-08-06 14:45 | split curl context between reverse proxy and merchant to avoid leaking merchant authorization secret to target host | Christian Grothoff | 5 | +60 | -20 |
| 2026-08-06 14:44 | empty regex matches everything | Christian Grothoff | 1 | +8 | -2 |
| 2026-08-06 14:21 | another header proxies should strip | Christian Grothoff | 1 | +4 | -0 |
| 2026-08-06 14:20 | \r and \n are illegal in values, but \t is allowed | Christian Grothoff | 1 | +4 | -4 |
| 2026-08-06 14:19 | preserve header order: need to insert at tail | Christian Grothoff | 1 | +7 | -3 |
| 2026-08-06 14:18 | deny access of contract was refunded | Christian Grothoff | 1 | +7 | -1 |
| 2026-08-06 14:17 | no trailing ';' in cookies as per spec | Christian Grothoff | 1 | +5 | -1 |
| 2026-08-06 14:17 | insist our contracts are well-formed | Christian Grothoff | 1 | +11 | -3 |
| 2026-08-06 14:15 | do not log cookie (credential) value | Christian Grothoff | 2 | +5 | -3 |
| 2026-08-06 14:14 | correct build-deps | Christian Grothoff | 1 | +6 | -2 |
| 2026-08-06 14:14 | add missing ALLOW header in 405 response | Christian Grothoff | 1 | +5 | -0 |
| 2026-08-06 14:12 | defualt to systemd | Christian Grothoff | 1 | +15 | -1 |
| 2026-08-06 14:08 | reject non-canonical URLs | Christian Grothoff | 1 | +68 | -0 |
| 2026-08-06 14:07 | fix base_url check: handle NULL, enforce '/' termination | Christian Grothoff | 1 | +44 | -3 |
| 2026-08-06 14:06 | handle missing end-quote | Christian Grothoff | 1 | +5 | -0 |
| 2026-08-05 19:33 | avoid trailing '/' in config causing '//' in constructed URLs when combining with path from MHD | Christian Grothoff | 1 | +36 | -13 |
| 2026-08-05 18:00 | anchor regexes everywhere | Christian Grothoff | 7 | +147 | -23 |
| 2026-08-05 16:47 | complete doxygen | Christian Grothoff | 3 | +3 | -4 |
| 2026-08-05 16:45 | clean up license header to properly specify AGPL | Christian Grothoff | 23 | +67 | -67 |
| 2026-08-04 16:44 | support RFC 7239 Forwarded alongside X-Forwarded-* | Christian Grothoff | 9 | +1104 | -25 |
| 2026-08-04 16:33 | add TRUSTED_PROXIES policy for the forwarded client address | Christian Grothoff | 8 | +998 | -62 |
| 2026-08-04 16:26 | make forwarding headers follow --respect-forwarded-headers | Christian Grothoff | 11 | +1010 | -59 |
| 2026-08-04 15:13 | comment on 'forever' treatment | Christian Grothoff | 1 | +3 | -0 |
| 2026-08-04 15:10 | normalize IP addresses before hashing for cookie | Christian Grothoff | 6 | +226 | -53 |
| 2026-08-04 15:07 | make hdr parsing more robust | Christian Grothoff | 1 | +7 | -4 |
| 2026-08-04 15:06 | make not getting client address fatal instead of allowing client to pay in vain (and then not get access anyway) | Christian Grothoff | 1 | +21 | -5 |
| 2026-08-04 15:03 | remove dead deps | Christian Grothoff | 1 | +0 | -10 |
| 2026-08-04 15:01 | end on error, do not continue with redirect | Christian Grothoff | 1 | +1 | -0 |
| 2026-08-04 14:59 | -typo | Christian Grothoff | 1 | +1 | -1 |
| 2026-08-04 14:53 | make URL parsing more robust, using libcurl parser | Christian Grothoff | 5 | +90 | -23 |
| 2026-08-04 14:37 | add test to reproduce cases where upstream starts to respond but stops reading the request | Christian Grothoff | 3 | +438 | -89 |
| 2026-04-26 21:18 | test for early response | Christian Grothoff | 4 | +425 | -2 |
| 2026-08-04 14:00 | do not forward our cookie upstream | Christian Grothoff | 5 | +139 | -2 |
| 2026-08-04 13:52 | do not forward Connection header from server back to client either | Christian Grothoff | 6 | +187 | -17 |
| 2026-08-04 13:11 | check target website is reasonable | Christian Grothoff | 1 | +16 | -1 |
| 2026-08-04 12:40 | check calloc for NULL | Christian Grothoff | 1 | +2 | -0 |
| 2026-08-04 12:38 | fix shutdown leak from lack of shutdown task, add assertion | Christian Grothoff | 2 | +3 | -3 |
| 2026-08-04 12:36 | make OOB check more explicit | Christian Grothoff | 1 | +6 | -2 |
| 2026-08-04 12:01 | -remove useles MHD option, clean up lsock on failure | Christian Grothoff | 1 | +3 | -2 |
| 2026-08-04 11:59 | enforce order_id is a slug, prevent NPE on missing host | Christian Grothoff | 3 | +13 | -7 |
| 2026-08-04 11:44 | check X-Forwarded port is well-formed, do not use if default | Christian Grothoff | 1 | +29 | -7 |
| 2026-08-04 11:39 | also enforce 40MB limit from GNUnet | Christian Grothoff | 1 | +16 | -7 |
| 2026-08-03 19:43 | -fix leak | Christian Grothoff | 2 | +2 | -0 |
| 2026-08-03 19:42 | properly return error codes if configuration/options are bad | Christian Grothoff | 2 | +10 | -0 |
| 2026-08-03 19:31 | enforce -f also on X-Forwarded-Host/Port | Christian Grothoff | 1 | +6 | -3 |
| 2026-08-03 19:13 | avoid excessive memmove on larger uploads | Christian Grothoff | 1 | +11 | -6 |
| 2026-08-03 19:11 | bound number of templates we cache | Christian Grothoff | 1 | +46 | -0 |
| 2026-08-03 19:04 | fix early-response handling in reverse proxy | Christian Grothoff | 1 | +3 | -2 |
| 2026-08-02 21:05 | validate 'website' is a URL | Christian Grothoff | 3 | +14 | -3 |
| 2026-08-02 21:02 | do not die if we could not set headers | Christian Grothoff | 1 | +8 | -8 |
| 2026-08-02 21:01 | ensure client's cur_time is within a reasonable timeframe of 'now' | Christian Grothoff | 1 | +20 | -0 |
| 2026-08-02 20:55 | only log if adding Paivana header failed | Christian Grothoff | 1 | +4 | -4 |
| 2026-08-02 20:54 | use constant-time cmp on authentication data | Christian Grothoff | 1 | +2 | -2 |
| 2026-07-28 14:46 | paivana: answer HEAD requests for the paywall page | Florian Dold | 1 | +7 | -2 |
| 2026-07-27 17:25 | debian: install into debian/tmp | Florian Dold | 1 | +4 | -1 |
| 2026-07-27 17:22 | fix duplicate meson version argument | Florian Dold | 1 | +0 | -1 |
| 2026-07-27 17:20 | fix debian rules for meson | Florian Dold | 1 | +1 | -4 |
| 2026-07-27 17:19 | remove leftover autotools Makefile.am | Florian Dold | 1 | +0 | -8 |
| 2026-07-27 16:52 | debian: fix file list of the paivana-httpd package | Florian Dold | 1 | +1 | -1 |
| 2026-06-22 12:18 | put frontend under src/frontend and refactor | Florian Dold | 11 | +834 | -657 |
| 2026-06-22 09:35 | pass missing nonce argument | Christian Grothoff | 1 | +2 | -2 |
| 2026-06-16 14:56 | convert to new gnunet random API | Martin Schanzenbach | 3 | +145 | -146 |
| 2026-06-01 17:34 | configure: export flags for 'meson setup' | Florian Dold | 1 | +4 | -1 |
| 2026-05-31 10:56 | use 409, not 400 | Christian Grothoff | 2 | +4 | -3 |
| 2026-05-31 10:38 | write README | Christian Grothoff | 1 | +188 | -0 |
| 2026-05-31 10:14 | return 501 if paywall is disabled for /.well-known/paivana endpoint | Christian Grothoff | 6 | +19 | -5 |
| 2026-05-31 09:28 | handle allocation failures better | Christian Grothoff | 1 | +40 | -33 |
| 2026-05-31 09:24 | limit responses to GNUNET_MAX_MALLOC_CHECKED | Christian Grothoff | 3 | +32 | -20 |
| 2026-05-31 08:58 | cleanup minor issues | Christian Grothoff | 4 | +49 | -25 |
| 2026-05-30 23:30 | -more bugfixes | Christian Grothoff | 5 | +46 | -31 |
| 2026-05-30 23:00 | -misc bugfixes | Christian Grothoff | 3 | +24 | -10 |
| 2026-05-30 22:45 | -misc bugfixes | Christian Grothoff | 2 | +6 | -4 |
| 2026-05-30 22:36 | -misc bugfixes | Christian Grothoff | 5 | +35 | -26 |
| 2026-05-22 09:25 | Fix #11423 | Martin Schanzenbach | 6 | +43 | -6 |
| 2026-05-13 03:32 | fix #11385 | Sebastian | 2 | +117 | -45 |
| 2026-05-12 20:01 | must be incref | Christian Grothoff | 1 | +1 | -1 |
| 2026-05-12 19:50 | choices is an array not an obj | Sebastian | 2 | +6 | -4 |
| 2026-05-08 21:56 | bump version | Christian Grothoff | 1 | +1 | -2 |
| 2026-05-08 21:46 | pass summary and choices to Paivana page generation | Christian Grothoff | 1 | +103 | -70 |
| 2026-05-05 11:34 | add whitelisting, global cookie setting, but generally restrict payment per path | Christian Grothoff | 6 | +118 | -6 |
| 2026-05-04 14:09 | use IP, not struct sockaddr | Christian Grothoff | 2 | +15 | -7 |
| 2026-05-04 14:03 | more logging | Christian Grothoff | 1 | +1 | -1 |
| 2026-05-04 14:02 | more logging | Christian Grothoff | 1 | +12 | -3 |
| 2026-05-04 13:55 | more logging | Christian Grothoff | 2 | +20 | -1 |
| 2026-05-04 13:47 | more logging | Christian Grothoff | 1 | +5 | -0 |
| 2026-05-03 22:55 | 402 resp change based on cookie | Sebastian | 1 | +2 | -1 |
| 2026-05-03 22:54 | dont follow redirect when checking payment | Sebastian | 1 | +4 | -3 |
| 2026-05-03 22:45 | use the right website from the location.hash | Sebastian | 1 | +22 | -17 |
| 2026-05-03 22:12 | styled paywall | Sebastian | 1 | +410 | -28 |
| 2026-05-03 17:56 | fix #11356 | Christian Grothoff | 1 | +21 | -0 |
| 2026-05-03 08:04 | even cache 302, but Vary on Cookie | Christian Grothoff | 1 | +8 | -0 |
| 2026-05-02 21:36 | -fix up config | Christian Grothoff | 1 | +4 | -4 |
| 2026-05-02 21:18 | update implementation to match latest spec | Christian Grothoff | 3 | +97 | -7 |
| 2026-05-02 17:44 | properly initialize max_pickup_duration from template, default to FOREVER as per spec | Christian Grothoff | 1 | +5 | -1 |
| 2026-05-02 17:30 | must allow some minimum caching, otherwise this is really bad for high-performance sites | Christian Grothoff | 1 | +4 | -1 |
| 2026-05-01 12:20 | debian: clean up rules | Christian Grothoff | 5 | +4 | -7 |
| 2026-05-01 11:33 | debian: build-depends on meson now, remove autotools | Christian Grothoff | 1 | +2 | -4 |
| 2026-04-30 23:44 | fix #11356: cache is bad here since | Sebastian | 1 | +0 | -4 |
| 2026-04-30 23:42 | fix typo: missing colon | Sebastian | 1 | +1 | -1 |
| 2026-04-30 22:51 | support for destination unix path | Sebastian | 3 | +25 | -0 |
| 2026-04-29 21:33 | make error messages slightly nicer | Christian Grothoff | 1 | +4 | -4 |
| 2026-04-29 17:55 | fix #11356 couple of fixes - use proper buffer before hashing to 256 - query paivana on origin instead of website - request the merchant directly (instead of /.well-known/paivana/session/) - qrjs inplace (instead of internet request to sauron) | Sebastian | 1 | +174 | -122 |
| 2026-04-29 17:49 | fix #11356: default max pickup time to one hour | Sebastian | 1 | +1 | -0 |
| 2026-04-29 17:22 | ignore makefiles | Sebastian | 1 | +1 | -0 |
| 2026-04-29 17:21 | fix #11356 bad cookie format | Sebastian | 1 | +1 | -1 |
| 2026-04-29 13:13 | missgin resource release | Sebastian | 1 | +1 | -0 |
| 2026-04-29 13:00 | fix valgrind: Use of uninitialised value of size 8 | Sebastian | 1 | +1 | -1 |
| 2026-04-29 12:53 | fix #11356 corrected commit 0dc274d | Sebastian | 1 | +2 | -2 |
| 2026-04-28 21:55 | -bugfix | Christian Grothoff | 1 | +1 | -1 |
| 2026-04-28 17:00 | fix #11356 when .well-known is present it won't be at the start of the URL | Sebastian | 1 | +1 | -1 |
| 2026-04-27 19:42 | fix minor warning | Christian Grothoff | 1 | +12 | -7 |
| 2026-04-27 15:18 | fix #11356 adding paivana header reponse for non-web | Sebastian | 1 | +62 | -0 |
| 2026-04-26 22:15 | remove FIXME | Christian Grothoff | 1 | +8 | -7 |
| 2026-04-26 22:12 | remove -F option, also use PH_ctx instead of another curl multi loop for the reverse proxy curl interaction | Christian Grothoff | 3 | +87 | -415 |
| 2026-04-26 21:15 | add -F flag to continue upload even if response is already being received | Christian Grothoff | 3 | +32 | -6 |
| 2026-04-26 20:48 | do not 502 on early response | Christian Grothoff | 1 | +52 | -48 |
| 2026-04-26 20:09 | use bool for curl_paused | Christian Grothoff | 1 | +4 | -4 |
| 2026-04-26 20:08 | implement new -f option to extract client address from X-forwarded-for header | Christian Grothoff | 1 | +43 | -6 |
| 2026-04-26 20:04 | add new -f command-line option | Christian Grothoff | 2 | +17 | -0 |
| 2026-04-26 20:01 | set VARY and CACHE_CONTROL headers in paywall responses | Christian Grothoff | 1 | +12 | -2 |
| 2026-04-26 19:07 | fix 100 continue handling | Christian Grothoff | 3 | +14 | -16 |
| 2026-04-26 19:04 | clean up reverse proxy state machine logic and error handling | Christian Grothoff | 1 | +683 | -459 |
| 2026-04-23 21:07 | fix Via and Connection header handling | Christian Grothoff | 2 | +210 | -23 |
| 2026-04-23 20:54 | fail 100 continue early properly | Christian Grothoff | 1 | +0 | -3 |
| 2026-04-23 20:54 | fail 100 continue early properly | Christian Grothoff | 3 | +112 | -3 |
| 2026-04-23 20:43 | make max upload size an option | Christian Grothoff | 2 | +14 | -10 |
| 2026-04-23 20:39 | add reverse proxy tests | Christian Grothoff | 11 | +2157 | -1 |
| 2026-04-23 20:20 | add FIXME | Christian Grothoff | 1 | +2 | -1 |
| 2026-04-23 19:05 | more comprehensive reverse proxy logic | Christian Grothoff | 1 | +327 | -45 |
| 2026-04-23 17:30 | only initialize templates if we are actually in paywall mode | Christian Grothoff | 1 | +46 | -24 |
| 2026-04-23 17:22 | use prebuilt branch | Christian Grothoff | 1 | +1 | -0 |
| 2026-04-23 14:31 | build: update depdencies for nix build | Martin Schanzenbach | 2 | +6 | -7 |
| 2026-04-23 13:53 | add Debian package definition | Christian Grothoff | 20 | +1620 | -0 |
| 2026-04-23 06:36 | build: Migrate to meson | Martin Schanzenbach | 17 | +1577 | -427 |
| 2026-04-22 20:59 | debug paivana | Christian Grothoff | 9 | +368 | -142 |
| 2026-04-21 22:30 | sketch HTML paywall page | Christian Grothoff | 1 | +4 | -5 |
| 2026-04-21 22:29 | sketch HTML paywall page | Christian Grothoff | 2 | +150 | -63 |
| 2026-04-21 21:38 | add man pages | Christian Grothoff | 1 | +4 | -0 |
| 2026-04-21 21:35 | add docs submodule | Christian Grothoff | 3 | +5 | -0 |
| 2026-04-20 20:03 | use FIXME, not TODO | Christian Grothoff | 1 | +1 | -1 |
| 2026-04-20 18:08 | complete template loading logic | Christian Grothoff | 5 | +51 | -44 |
| 2026-04-20 16:50 | start to implement template logic | Christian Grothoff | 6 | +283 | -43 |
| 2026-04-20 13:34 | more basics on Paivana | Christian Grothoff | 6 | +478 | -382 |
| 2026-04-20 13:21 | WiP | Christian Grothoff | 6 | +377 | -65 |
| 2026-04-20 13:09 | address various FIXMEs | Christian Grothoff | 4 | +98 | -68 |
| 2026-04-19 22:34 | can be static | Christian Grothoff | 1 | +2 | -2 |
| 2026-04-19 22:34 | expand consistency check logic | Christian Grothoff | 2 | +86 | -9 |
| 2026-04-19 22:15 | compute paivana hash without complex KDF as per spec | Christian Grothoff | 1 | +14 | -13 |
| 2026-04-19 22:11 | compute paivana_id for session check | Christian Grothoff | 3 | +70 | -1 |
| 2026-04-19 21:59 | align cookie computation with spec | Christian Grothoff | 4 | +25 | -15 |
| 2026-04-19 21:13 | more work on Paivana: add pay handler | Christian Grothoff | 8 | +784 | -225 |
| 2026-04-16 09:06 | refacotor httpd logic | Christian Grothoff | 6 | +1366 | -1144 |
| 2026-04-16 07:33 | use libtalermhd to remove code duplication | Christian Grothoff | 3 | +92 | -389 |
| 2026-04-16 07:02 | use timestamp | Christian Grothoff | 2 | +49 | -10 |
| 2026-04-07 14:23 | adapt to latest GNUnet API | Christian Grothoff | 1 | +9 | -10 |
| 2025-11-26 23:32 | Paivana paywall serving | Christian Grothoff | 1 | +5 | -0 |
| 2025-11-26 23:29 | get paywall page | Christian Grothoff | 1 | +14 | -10 |
| 2025-11-26 23:27 | expand build system to install resource file | Christian Grothoff | 2 | +2 | -1 |
| 2025-11-26 23:24 | basic paywall logic | Christian Grothoff | 2 | +298 | -2 |
| 2025-11-26 23:12 | paywall.html | Florian Dold | 1 | +71 | -0 |
| 2025-11-26 22:40 | complete trivial reverse proxy | Christian Grothoff | 6 | +314 | -41 |
| 2025-11-26 22:28 | get code to compile | Christian Grothoff | 4 | +77 | -37 |
| 2025-11-26 13:22 | more basics | Christian Grothoff | 5 | +110 | -0 |
| 2025-11-26 13:14 | minimal build system | Christian Grothoff | 3 | +2 | -0 |
| 2025-11-26 13:12 | initial import, based on twister | Christian Grothoff | 8 | +2787 | -0 |
