will.anderson
4989641b39
The published Terms directly contradicted two locked safety decisions and the
shipping app copy, and the in-app Privacy Policy link 404'd. Both are legal
exposure under CA SB 243 (companion chatbots) and the AI-companion litigation.
Terms (§1, §11):
- Add an explicit "you must be 18 or older" eligibility statement. The old §11
permitted "Children 13 and over" independently and under-13 via family
accounts — the exact minor path the app's age gate forbids and the litigation
epicenter targets.
- Replace §11 "Children and Family Accounts" with an honest "Safety Features"
section. Removes the Hard Bell auto-notify block ("emergency services and
trusted contacts are notified first", "cannot be changed") and the
mandatory-reporting clause ("emergency services or relevant authorities may
be contacted", "cannot opt out") — both promised an automatic escalation the
product does not perform. New copy matches the app: Neuron shows you 988 and
how to reach a contact you chose; it never contacts anyone on your behalf;
there is no automatic escalation.
Privacy Policy (new):
- Add src/privacy.el + register it in main.el (generation, /legal/privacy route,
state pointer, sitemap). Fixes the in-app link, which pointed at
/legal/privacy (404 — no route, no doc existed).
- Ported from docs/legal/privacy-policy-companion-DRAFT.md (2026-07-14):
local-first, 18+, and never-auto-contact stated verbatim from the locked draft.
- Wire privacy.html through Dockerfile.stage / Dockerfile / deploy.yaml; add the
secondary /legal/privacy route to server.el for parity.
PENDING ATTORNEY (Daniel) SIGN-OFF before merge/publish. Bracketed legal
decisions (governing law, effective date, retention periods) left for counsel.
112 lines
4.6 KiB
Docker
112 lines
4.6 KiB
Docker
# Neuron Landing — El-native server.
|
|
#
|
|
# Two-stage build:
|
|
# 1. Build the El landing binary in a Debian container with cc + libcurl-dev
|
|
# from server.c (which was generated on the host by `elc server.el > server.c`)
|
|
# plus el_runtime.c.
|
|
# 2. Copy the binary + the pre-rendered index.html + assets into a slim runtime
|
|
# image. Final image is ~80 MB (mostly libc + libcurl).
|
|
#
|
|
# Build:
|
|
# ./build.sh (regenerates server.c, then docker buildx for linux/amd64)
|
|
#
|
|
# Run:
|
|
# docker run -p 8080:8080 neuron-landing
|
|
|
|
# ── Stage 1a: build liboqs from source ────────────────────────────────────────
|
|
# Debian bookworm doesn't ship liboqs, so we build it ourselves. liboqs is
|
|
# small (~5MB compiled, static) and pinned to a release tag for reproducibility.
|
|
# Built static, so the runtime image doesn't need a separate liboqs.so.
|
|
FROM debian:bookworm-slim AS oqs-builder
|
|
|
|
ARG LIBOQS_VERSION=0.10.1
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
build-essential cmake ninja-build git \
|
|
libssl-dev ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN git clone --depth 1 --branch ${LIBOQS_VERSION} \
|
|
https://github.com/open-quantum-safe/liboqs.git /src/liboqs \
|
|
&& cmake -S /src/liboqs -B /src/liboqs/build -GNinja \
|
|
-DCMAKE_INSTALL_PREFIX=/opt/oqs \
|
|
-DOQS_BUILD_ONLY_LIB=ON \
|
|
-DOQS_DIST_BUILD=ON \
|
|
-DBUILD_SHARED_LIBS=OFF \
|
|
-DOQS_USE_OPENSSL=ON \
|
|
&& cmake --build /src/liboqs/build --parallel \
|
|
&& cmake --install /src/liboqs/build
|
|
|
|
# ── Stage 1b: compile El binary ───────────────────────────────────────────────
|
|
FROM debian:bookworm-slim AS builder
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
libcurl4-openssl-dev \
|
|
libssl-dev \
|
|
ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Pull in liboqs headers + static archive from the previous stage. The
|
|
# archive is ~5MB; we link it statically so the runtime image stays slim
|
|
# and we don't need a second apt install in stage 2.
|
|
COPY --from=oqs-builder /opt/oqs /opt/oqs
|
|
|
|
WORKDIR /build
|
|
COPY runtime/el_runtime.c runtime/el_runtime.h ./
|
|
COPY server.c ./
|
|
|
|
# -rdynamic is the Linux-specific bit: the runtime resolves El handler
|
|
# functions (e.g. handle_request) via dlsym(RTLD_DEFAULT, name), and on
|
|
# glibc that only sees the executable's own symbols if they were exported
|
|
# by the linker. macOS exports them by default, Linux doesn't.
|
|
#
|
|
# liboqs is an optional runtime dependency; el_runtime.c gates all pq_*
|
|
# entry points behind __has_include(<oqs/oqs.h>). With the headers + .a
|
|
# from the oqs-builder stage in /opt/oqs, the post-quantum primitives
|
|
# (Dilithium-3 / ML-DSA-65 signatures, Kyber-768 / ML-KEM-768 KEM, the
|
|
# hybrid X25519+Kyber handshake, and SHA3-256) are all available.
|
|
# -lcrypto pulls in OpenSSL for X25519 + the symmetric primitives liboqs
|
|
# itself uses internally; libcurl4-openssl-dev already pulls libssl-dev
|
|
# transitively but we're explicit.
|
|
RUN cc -std=c11 -O2 -rdynamic \
|
|
-I . -I/opt/oqs/include \
|
|
-L/opt/oqs/lib \
|
|
-o landing server.c el_runtime.c \
|
|
-lcurl -lpthread -ldl -lm -loqs -lcrypto
|
|
# `strip` would discard .symtab but keeps .dynsym (which is what -rdynamic
|
|
# populated and what dlsym actually looks at), so it'd be safe — but the
|
|
# binary is small enough that the few MB saved isn't worth the next person
|
|
# wondering why dlsym fails.
|
|
|
|
# ── Stage 2: runtime ──────────────────────────────────────────────────────────
|
|
FROM debian:bookworm-slim
|
|
|
|
# libssl3 supplies libcrypto.so.3 for the X25519 + symmetric primitives the
|
|
# linked binary needs. liboqs itself is statically linked into the binary
|
|
# (built that way in stage 1a) so there's nothing extra to ship for it.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
libcurl4 \
|
|
libssl3 \
|
|
ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd -r landing && useradd -r -g landing landing
|
|
|
|
COPY --from=builder /build/landing /usr/local/bin/landing
|
|
COPY src/index.html src/about.html src/terms.html src/privacy.html src/enterprise-terms.html /srv/landing/
|
|
COPY src/assets /srv/landing/assets
|
|
|
|
ENV LANDING_ROOT=/srv/landing
|
|
ENV PORT=8080
|
|
|
|
USER landing
|
|
EXPOSE 8080
|
|
|
|
# Cloud Run sends SIGTERM on revision shutdown. The runtime doesn't trap it
|
|
# explicitly, so the kernel just kills the process. That's fine for a stateless
|
|
# server.
|
|
CMD ["/usr/local/bin/landing"]
|