- keydb write_atomic: create the temp file 0600 on Unix (OpenOptionsExt::mode)
so umask can't leave renamed keydb.cfg key material world-readable.
- online is_blocked_ip: decode 6to4 (2002::/16) and Teredo (2001:0000::/32)
embedded IPv4 and re-check via SSRF guard; add unit test.
- online resolve_and_guard: cap outstanding DNS-resolver threads (AtomicUsize,
max 4) so a black-holed keyserver can't leak threads unboundedly.
- keydb cached_db: run the ~62 MiB reparse OUTSIDE self.cache lock, with a
double-checked re-acquire to install (avoids stalling all workers; keeps the
one-open-one-identity invariant).
- keydb unit_keys_from: log tracing::warn! on enc_title_keys()/mkb() Err before
falling back to empty (parity with online.rs).
- keydb unit_keys_from: skip stored unit keys with CPS number 0 (would collide
with unit 1 at idx 0); add regression test.
- tests: assert full 16-byte key values (online UK/VUK/at-cap paths) and give
parse_disc_entry distinct M/I/V/U values.
- docs/keydb-format.md: DiscEntry::title is read (to_keydb_cfg + Debug), not
unused; cross-reference the duplicated MAX_KEYDB_BYTES constants.
CI/lint hardening since v1.6.14: clippy on stable with the MSRV single-sourced
from Cargo.toml, cargo-deny dependency-audit gate with first-party git sources
allowed (#15), and audience-based comment-guard (#17). No library code changes.
Matthew Jackson