Budget OpenSSH temporary sockets in the shared address policy (#503)

2026-10-29 12:30:56 +00:00
parent df9f50ea31
commit 3bb4324aa0
1 changed files with 2 additions and 1 deletions
@@ -64,7 +64,8 @@ export function socketDirectory(identity, options) {
  const { uid, root } = settings(options);
  const input = canonical(["quixos-unix-socket-v1", uid, identity]);
  if (Buffer.byteLength(input) > 1024 * 1024) throw Error("Socket identity exceeds its bound");
-  return path.join(root, createHash("sha256").update(input).digest("hex"));
+  // Preserve all 256 bits while leaving room for protocol-added socket suffixes.
+  return path.join(root, createHash("sha256").update(input).digest("base64url"));
 }

 export function socketAddress(identity, role, options) {