A publisher names the feed in hub.url (spec §7.1). This read hub.topic, which
belongs to subscribe and unsubscribe, so every compliant publisher sent a
notification the hub could not resolve: it logged "could not request topic :"
and returned 200 with an empty body. Nothing was ever delivered, and the
status said the opposite. hub.topic is still read, but only when hub.url is
missing.
The rest is the same class of bug — a response that reported success for work
that did not happen:
- a publish with no topic is 400, a topic that does not answer 2xx is 502,
and a subscriber is told nothing about either;
- the fetched body is bounded, its response closed, and a callback is retried
once with the outcome logged instead of assuming the first POST landed;
- unsubscribe wrote 200 and then an error body into the same response; it now
answers once;
- the challenge comes from crypto/rand and must be echoed exactly, since a
substring match let any page that mentioned it pass verification;
- pq.Error implements error on the pointer, so the value assertion never
compiled; the statement now type-asserts the pointer;
- the database password can come from HUB_DB_PASSWORD instead of only being
baked into the binary.
The build moves to go.mod and golang:1.22, because io.Discard does not exist
in the 1.12 image the pipeline was pinned to.
