Ettore Di Giacinto 9826547c42 fix(security): clear the gosec findings this branch introduced ...

Tighten the permissions that can be tightened and justify the ones that
cannot. The e2e harness creates its directories 0750 and writes its model
config and process logs 0600; the copied binary keeps 0755 because the
suite executes it.

Everything else is a gosec rule firing on code that is doing what it is
supposed to: jitter drawn from math/rand for a reconnect backoff, a fixed
credential for a throwaway cluster, and subprocesses launched from the
binary the suite just built. Each carries a #nosec naming the rule and
the reason, in the form the tree already uses.

Scanned before and after: 13 findings in the packages this branch added,
now 0. The one that remains in core/services/worker is byte-identical on
master and is not this branch's to silence.

Assisted-by: Claude Opus 5 [claude-code]
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

2026-09-20 03:05:35 +00:00

..

addr_test.go

feat(distributed): take the backend worker off NATS entirely

2026-09-20 03:05:34 +00:00

auth_required_test.go

feat(distributed): take the backend worker off NATS entirely

2026-09-20 03:05:34 +00:00

backend_delete_test.go

fix(worker): reap deleted backends and stop models that live on a worker (#10956)

2026-07-20 01:09:22 +02:00

backend_reinstall_cwd_test.go

fix(worker): never reuse a backend process whose directory a reinstall replaced (#11029)

2026-07-22 17:29:59 +02:00

concurrency_test.go

fix(distributed): split NATS backend.upgrade off install + dedup loads (#9717)

2026-05-08 16:24:54 +02:00

config.go

feat(distributed): take the backend worker off NATS entirely

2026-09-20 03:05:34 +00:00

control_client_roundtrip_test.go

feat(distributed): let a worker name a broadcast the frontend decides on

2026-09-20 03:05:34 +00:00

control_files_test.go

fix(distributed): harden staged resource ownership

2026-09-20 03:05:35 +00:00

control_files.go

fix(distributed): harden staged resource ownership

2026-09-20 03:05:35 +00:00

control_routes_test.go

fix(distributed): stage directory outputs

2026-09-20 03:05:35 +00:00

control_routes.go

feat(distributed): give agent workers a tunnel of their own

2026-09-20 03:05:34 +00:00

ephemeral_capacity_test.go

fix(worker): resolve temporary paths in tests (#11944)

2026-09-09 08:51:09 +02:00

ephemeral_capacity.go

fix(distributed): bound ephemeral staging (#11924)

2026-09-08 18:13:40 +02:00

ephemeral_cleanup_test.go

fix(worker): resolve temporary paths in tests (#11944)

2026-09-09 08:51:09 +02:00

ephemeral_cleanup.go

fix(distributed): bound ephemeral staging (#11924)

2026-09-08 18:13:40 +02:00

file_stager_roundtrip_test.go

fix(distributed): stage directory outputs

2026-09-20 03:05:35 +00:00

file_staging_release_test.go

fix(distributed): preserve master protocol extensions

2026-09-20 03:05:35 +00:00

file_staging_test.go

fix(worker): resolve staging directory symlinks

2026-09-20 03:05:35 +00:00

file_staging.go

fix(distributed): preserve async staging state

2026-09-20 03:05:35 +00:00

free_timeout_test.go

Revert "chore(tests): Avoid network, sleep and more during tests" (#11601)

2026-08-19 16:39:39 +02:00

heartbeat_test.go

feat(distributed): take the backend worker off NATS entirely

2026-09-20 03:05:34 +00:00

install.go

fix(worker): pin the rune cut, answer unload honestly, drop the dead publisher

2026-09-20 03:05:34 +00:00

lifecycle.go

fix(worker): pin the rune cut, answer unload honestly, drop the dead publisher

2026-09-20 03:05:34 +00:00

loaded_backend_addresses_test.go

fix(distributed): survive a slow control-plane database (#11837)

2026-09-02 12:37:12 +02:00

model_stop_test.go

feat(worker): serve the control plane over the tunnel, not over NATS

2026-09-20 03:05:34 +00:00

models_running_test.go

fix(distributed): reaper reaps live backends, ghost model stubs, in_flight leak, sidecar staging runaway (#11142)

2026-07-27 18:36:31 +02:00

models_running.go

feat(worker): serve the control plane over the tunnel, not over NATS

2026-09-20 03:05:34 +00:00

port_allocator_test.go

test(worker): script the kernel out of the port bookkeeping specs

2026-09-20 03:05:35 +00:00

port_bindable_test.go

fix(worker): check a gRPC port is free before handing it out

2026-09-20 03:05:35 +00:00

port_quarantine_test.go

test(worker): script the kernel out of the port bookkeeping specs

2026-09-20 03:05:35 +00:00

prefetch_test.go

feat(worker): add LOCALAI_PREFETCH_MODELS for boot-time gallery prefetch (#10108)

2026-05-31 12:22:45 +02:00

prefetch.go

feat(distributed): take the backend worker off NATS entirely

2026-09-20 03:05:34 +00:00

process_helpers.go

fix(distributed): split NATS backend.upgrade off install + dedup loads (#9717)

2026-05-08 16:24:54 +02:00

registration_test.go

feat(nodes): add fleet operations dashboard (#12046)

2026-09-15 00:57:14 +02:00

registration.go

feat(distributed): stop workers listening, and stop them advertising

2026-09-20 03:05:34 +00:00

replica_test.go

fix(distributed): survive a slow control-plane database (#11837)

2026-09-02 12:37:12 +02:00

supervisor.go

fix(worker): check a gRPC port is free before handing it out

2026-09-20 03:05:35 +00:00

tunnel_test.go

feat(distributed): give agent workers a tunnel of their own

2026-09-20 03:05:34 +00:00

tunnel.go

fix(security): clear the gosec findings this branch introduced

2026-09-20 03:05:35 +00:00

worker_suite_test.go

fix(worker): resolve temporary paths in tests (#11944)

2026-09-09 08:51:09 +02:00

worker.go

fix(distributed): preserve master protocol extensions

2026-09-20 03:05:35 +00:00