On Tue, Sep 08, 2026 at 10:48:38AM +0200, Stefan Sperling wrote:
> On Mon, Sep 07, 2026 at 10:47:13AM +0200, akira.sato@keemail.me wrote:
> > This patch adds got_render_readme_markdown(), a small wrapper aroundlowdown_buf(3) from textproc/lowdown (already a port, ISC/BSDlicensed, no external dependencies, and explicitly designed to workunder pledge(2) per lowdown(3) — it doesn't need any promise beyondwhat gotwebd's fcgi process already has). Only files ending in .mdgo through this path; plain README and README.txt keep being shownexactly as before, escaped inside <pre>.
 
> As you point out, the fcgi.c code runs under pledge("stdio") today and
> lowdown is happy with this. Back in 2023, when the READMe feature was
> introduced, gotwebd would have been running lowdown under a much longer
> list of pledge promises, namely:
> pledge("stdio rpath inet recvfd proc exec sendfd unveil")

I just realized the code you are adding isn't part of fgci.c at all,
but is called via gotweb.c. So lowdown would run under a fairly large set
of pledge promises still, with full repository read access:

  if (pledge("stdio rpath recvfd sendfd proc exec unveil"

If we could move lowdown rendering into a dedicated process which runs
under pledge("stdio") that would be much better. But it won't be easy
to do this, since we are already running inside gotweb_process_request()
when we discover that markdown needs to be rendered. Hmm...