Merge branch 'master' into feat/redistribution-toggle

Author: sbackend123

.github/workflows/go.yml

@@ -18,32 +18,13 @@ on:
     branches:
       - '**'
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
-  test-linux:
-    name: Test (Linux)
-    runs-on: [self-hosted, linux, bee]
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v5
-    - name: Setup Go
-      uses: actions/setup-go@v6
-      with:
-        cache: true
-        go-version-file: go.mod
-    - name: Build
-      run: make build
-    - name: Test with race detector
-      run: make test-ci-race
-  test-other:
+  test:
     name: Test
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [macos-latest, windows-latest]
+        os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
     - name: Checkout
       uses: actions/checkout@v5
@@ -52,14 +33,19 @@ jobs:
       with:
         cache: true
         go-version-file: go.mod
+    - name: Increase UDP buffer sizes (Ubuntu)
+      if: matrix.os == 'ubuntu-latest'
+      run: |
+        sudo sysctl -w net.core.rmem_max=7500000
+        sudo sysctl -w net.core.wmem_max=7500000
     - name: Increase UDP buffer sizes (macOS)
       if: matrix.os == 'macos-latest'
       run: |
         sudo sysctl -w kern.ipc.maxsockbuf=6291456
     - name: Build
       run: make build
-    - name: Test with race detector (macOS)
-      if: matrix.os == 'macos-latest'
+    - name: Test with race detector (Ubuntu and MacOS)
+      if: matrix.os != 'windows-latest'
       run: make test-ci-race
     - name: Test without race detector (Windows)
       if: matrix.os == 'windows-latest'
@@ -124,7 +110,7 @@ jobs:
   trigger-beekeeper:
     name: Trigger Beekeeper
     runs-on: ubuntu-latest
-    needs: [test-linux, test-other, lint, coverage]
+    needs: [test, lint, coverage]
     if: github.ref == 'refs/heads/master'
     steps:
     - name: Checkout

Dockerfile

@@ -20,7 +20,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     useradd -r -g bee --uid 999 --no-log-init -m bee;
 
 # make sure mounted volumes have correct permissions
-RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee
+RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 COPY --from=build /src/dist/bee /usr/local/bin/bee
 

Dockerfile.ci

@@ -4,7 +4,7 @@ USER root
 
 RUN addgroup --system bee --gid 998; \
     adduser -S -G bee -u 998 -D -h /home/bee bee; \
-    mkdir -p /home/bee/.bee && chown 998:998 /home/bee/.bee
+    mkdir -p /home/bee/.bee && chown 998:998 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 COPY bee /bee
 

Dockerfile.dev

@@ -31,7 +31,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     groupadd -r bee --gid 999; \
     useradd -r -g bee --uid 999 --no-log-init -m bee;
 
-RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee
+RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 COPY --from=build /src/dist/bee /usr/local/bin/bee
 

Dockerfile.goreleaser

@@ -10,7 +10,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     useradd -r -g bee --uid 999 --no-log-init -m bee;
 
 # make sure mounted volumes have correct permissions
-RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee
+RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 COPY bee /usr/local/bin/bee
 

Dockerfile.scratch

@@ -8,7 +8,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     useradd -r -g bee --uid 999 --no-log-init -m bee;
 
 # make sure mounted volumes have correct permissions
-RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee
+RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 FROM scratch
 

cmd/bee/cmd/split.go

@@ -104,7 +104,7 @@ func splitRefs(cmd *cobra.Command) {
 				refs = append(refs, ch.Address().String())
 				return nil
 			})
-			writer, err := os.OpenFile(outputFileName, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o644)
+			writer, err := os.OpenFile(outputFileName, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o600)
 			if err != nil {
 				return fmt.Errorf("open output file: %w", err)
 			}
@@ -192,7 +192,7 @@ func splitChunks(cmd *cobra.Command) {
 			var chunksCount atomic.Int64
 			store := newPutter(func(chunk swarm.Chunk) error {
 				filePath := filepath.Join(outputDir, chunk.Address().String())
-				err := os.WriteFile(filePath, chunk.Data(), 0o644)
+				err := os.WriteFile(filePath, chunk.Data(), 0o600)
 				if err != nil {
 					return err
 				}

cmd/bee/cmd/split_test.go

@@ -14,6 +14,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"runtime"
 	"sync"
 	"testing"
 
@@ -172,3 +173,47 @@ func requestPipelineFn(s storage.Putter, encrypt bool, rLevel redundancy.Level)
 		return builder.FeedPipeline(ctx, pipe, r)
 	}
 }
+
+// TestDBSplitChunksFilePermissions is a regression test for PERM-01: the
+// "split chunks" command wrote each chunk payload file world-readable (0o644),
+// disclosing chunk contents to other local users on a shared host. Files must
+// not be group- or world-accessible.
+func TestDBSplitChunksFilePermissions(t *testing.T) {
+	t.Parallel()
+	if runtime.GOOS == "windows" {
+		t.Skip("permission bits are not meaningful on windows")
+	}
+
+	buf := make([]byte, 16*1024)
+	if _, err := crand.Read(buf); err != nil {
+		t.Fatal(err)
+	}
+
+	inputFileName := path.Join(t.TempDir(), "input")
+	if err := os.WriteFile(inputFileName, buf, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	outputDir := t.TempDir()
+
+	err := newCommand(t, cmd.WithArgs("split", "chunks", "--input-file", inputFileName, "--output-dir", outputDir)).Execute()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	entries, err := os.ReadDir(outputDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) == 0 {
+		t.Fatal("no chunk files were written")
+	}
+	for _, e := range entries {
+		info, err := e.Info()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if perm := info.Mode().Perm(); perm&0o077 != 0 {
+			t.Fatalf("chunk file %s is group/other-accessible: %#o", e.Name(), perm)
+		}
+	}
+}

pkg/api/api.go

@@ -391,7 +391,9 @@ func (s *Service) SetProbe(probe *Probe) {
 }
 
 func (s *Service) SetIsWarmingUp(v bool) {
-	s.isWarmingUp = v
+	if s != nil {
+		s.isWarmingUp = v
+	}
 }
 
 // Close hangs up running websockets on shutdown.

pkg/api/warmup_test.go

@@ -0,0 +1,25 @@
+// Copyright 2026 The Swarm Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package api_test
+
+import (
+	"testing"
+
+	"github.com/ethersphere/bee/v2/pkg/api"
+)
+
+// TestSetIsWarmingUpNilReceiver is a regression test for NIL-01. When the API
+// is disabled (empty --api-addr) the apiService is nil, and the warmup
+// completion goroutine calls SetIsWarmingUp on it. Like its sibling setters,
+// SetIsWarmingUp must be a no-op on a nil receiver rather than panicking.
+func TestSetIsWarmingUpNilReceiver(t *testing.T) {
+	t.Parallel()
+
+	var s *api.Service // nil, as when the API is disabled
+
+	// Must not panic.
+	s.SetIsWarmingUp(false)
+	s.SetIsWarmingUp(true)
+}