# Website plan — `https://kimmo.cloud/CVE-2026-43284/`

Publish the Dirty Frag tracker as a single-page static site, generated
by **Hugo** locally and rsync'd to a personal nginx server (`haig`).
The build infrastructure mirrors the sibling CVE-2026-31431 tracker; only
the content and a few config strings differ.

## Architecture

- **Source repo:** `github.com/suominen/CVE-2026-43284` (this repo).
- **Generator:** Hugo extended, ≥ 0.146.0. Run locally; nothing built in CI.
- **Source layout:** Hugo project under `site/`. The tracker is a single
  page at `site/content/_index.md`.
- **Theme:** PaperMod, integrated as a Hugo Module (no submodule). See
  `site/hugo.toml` and `site/go.mod`.
- **Dev environment:** Nix flake (`flake.nix`) provides hugo + go + git.
  Auto-activates via `.envrc` if direnv is installed.
- **Build:** `make build` → `hugo --minify --gc --cleanDestinationDir`,
  output in `site/public/`.
- **Publish:** `make dist` → `rsync -avz --delete site/public/`
  → `haig:.www/sites/kimmo.cloud/htdocs/CVE-2026-43284/`.
- **Web server:** existing nginx vhost on `kimmo.cloud` serves
  `htdocs/CVE-2026-43284/` directly at the URL path `/CVE-2026-43284/`
  (directory name matches URL path; no `alias` directive needed). TLS,
  redirects, and certbot are managed by the host, not by this repo.
- **DNS:** unchanged. `kimmo.cloud` already resolves to the haig server.
  No new records required.

## Repo layout (current)

```
.
├── .envrc                 # `use flake`
├── .gitignore
├── flake.nix              # Nix dev shell: hugo + go + git
├── Makefile               # build / dist targets
├── LICENSE                # CC BY 4.0
├── README.md
├── CLAUDE.md              # project instructions for Claude Code
├── WEBSITE.md             # this file
├── scripts/               # auto-update agent prompt + driver
│   ├── auto-update
│   └── auto-update-prompt.txt
├── systemd/               # user-level timer that runs the auto-update
│   ├── dirty-frag-tracker-update.service
│   └── dirty-frag-tracker-update.timer
└── site/                  # Hugo project
    ├── hugo.toml
    ├── go.mod, go.sum     # Hugo Modules — pulls PaperMod
    ├── assets/css/extended/custom.css   # CSS overrides
    ├── content/
    │   └── _index.md      # the tracker (single page)
    ├── layouts/partials/post_meta.html      # PaperMod override: labels + lastmod
    ├── layouts/partials/extend_footer.html  # client-side rowspan compaction
    │                                        #   + status-cell tagging
    │                                        #   + code-copy buttons (replaces
    │                                        #   PaperMod's code-copy partial)
    └── …                  # standard Hugo skeleton
```

## Steps

### 1. Hugo project — scaffolded from CVE-2026-31431

The Hugo skeleton, theme integration, PaperMod overrides, CSS, and i18n
were copied wholesale from the CVE-2026-31431 tracker on 2026-05-08.
Only `baseURL`, `title`, the Go module path, and the rsync destination
were retargeted.

### 2. Tracker content — initial draft

- [x] `site/content/_index.md` authored from the upstream Dirty Frag
      reference (V4bel/dirtyfrag README + technical write-up).
- [x] Two-variant breakdown (xfrm-ESP, RxRPC) preserved in the Summary
      and Vulnerable commit range sections.
- [x] First-pass distro entries — Debian, Proxmox, NixOS, Rocky/AlmaLinux,
      and Amazon Linux all covered, marked vulnerable pending stable kernel
      releases and per-distro advisories.

### 3. Local dev — done

- [x] `flake.nix` provides hugo + go + git.
- [x] `.envrc` for direnv auto-activation (`direnv allow` once).
- [x] `README.md` documents the workflow.

### 4. Publish — done

- [x] First `make build` and inspect `site/public/` locally.
- [x] First `make dist` to push to `haig` — `htdocs/CVE-2026-43284/`
      created (let rsync make it).
- [x] Verified the site renders at `https://kimmo.cloud/CVE-2026-43284/`,
      including the RSS feed, cover image, and OG metadata.

## Decisions

- **Hosting**: own nginx on `haig`, *not* GitHub Pages. Same as the
  sibling CVE-2026-31431 site.
- **URL**: `https://kimmo.cloud/CVE-2026-43284/` (path under existing vhost).
  Originally published under `/dirty-frag/` before MITRE assigned the
  CVE; renamed to the CVE ID once it landed.
- **Theme integration**: Hugo Modules.
- **Canonical source**: `site/content/_index.md`.
- **Theme**: PaperMod.
- **Automated maintenance**: a user-level systemd timer
  (`systemd/dirty-frag-tracker-update.timer`, twice daily) runs
  `scripts/auto-update`, which fast-forwards `origin/main` into a dedicated
  long-lived `auto-update` branch in a separate worktree and hands off to
  headless Claude with `scripts/auto-update-prompt.txt`. The agent only
  commits onto `auto-update` — it does not push or open PRs. Merges of
  `auto-update` into `main` are done manually.

## Risks & gotchas

- **Anchor drift.** Hugo/Goldmark's heading slugger differs from GitHub's
  for headings with em dashes, parens, plus signs, or slashes. Pin
  brittle headings with `### Heading {#stable-id}` if external bookmarks
  need to survive renames.
- **Subpath baseURL.** `baseURL = "https://kimmo.cloud/CVE-2026-43284/"`
  must include the trailing slash and the path component. Hugo uses this
  for all internal links.
- **`.cleanDestinationDir`** wipes `site/public/` before each build, so
  don't put hand-edited files there.
- **rsync `--delete`** removes server-side files not present in the build
  output. Don't store unrelated content under `htdocs/CVE-2026-43284/` —
  `make dist` will erase it.
- **Two-variant fix tracking.** xfrm-ESP and RxRPC must be tracked
  separately. A distro that backports the netdev xfrm-ESP fix is *not*
  fully patched if it hasn't also addressed RxRPC.
- **Client-side table tweaks.** `layouts/partials/extend_footer.html`
  rewrites tables in the browser: it collapses consecutive duplicate
  first-column cells via `rowSpan`, and tags cells whose text starts
  with a status emoji with `class="status"` so `custom.css` can
  hang-indent them (keeping the emoji in a scannable left gutter when
  the cell wraps). The Markdown source is unchanged; only the rendered
  DOM is. If you compare the rendered page against the source, expect
  divergence in the first column. With JavaScript disabled both tweaks
  are simply skipped — the table still renders correctly, just
  un-compacted and with the status emoji inline.

## Known gaps

- [ ] **Favicons.** PaperMod's `head.html` emits five icon `<link>` tags
      that 404 unless the icon files exist in `site/static/`. The sibling
      tracker also has this open. Same fix applies here when we get to it.

## Out of scope

- Search and multi-page navigation. Hugo + PaperMod can do these later
  if needed. (RSS and the dark/light toggle are already wired up.)