release: version 1.0.2 - Audit security fixes and RPM packaging

Security hardening:
- Add input sanitization for method (32), path (2048), host (256), http_version (16)
- Prevent log injection via oversized HTTP values
- Add LOG_THROTTLED macro for consistent error reporting
- Improve socket state double-check pattern to avoid unnecessary reconnects

Code quality:
- Fix const qualifier warnings in get_header()
- Add flags field to module definition
- Add -Wno-error=format-security for compatibility

Documentation:
- Clarify timestamp precision (microseconds expressed as nanoseconds)
- Update README and architecture.yml

Testing:
- Add 4 unit tests for input sanitization
- All 78 tests passing

Packaging:
- Remove DEB package support (RPM only: el8, el9, el10)
- Add CHANGELOG file included in RPM packages
- Bump version to 1.0.2

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

tests/unit/test_module_real.c

@@ -966,24 +966,112 @@ static void test_parse_int_strict_invalid(void **state)
 {
     int out;
     (void)state;
-    
+
     /* Invalid: empty string */
     assert_int_equal(parse_int_strict("", &out), -1);
-    
+
     /* Invalid: NULL */
     assert_int_equal(parse_int_strict(NULL, &out), -1);
-    
+
     /* Invalid: non-numeric */
     assert_int_equal(parse_int_strict("abc", &out), -1);
-    
+
     /* Invalid: mixed */
     assert_int_equal(parse_int_strict("10abc", &out), -1);
-    
+
     /* Invalid: whitespace */
     assert_int_equal(parse_int_strict(" 10", &out), -1);
     assert_int_equal(parse_int_strict("10 ", &out), -1);
 }
 
+/* ============================================================================
+ * Test: Input sanitization - method truncation
+ * ============================================================================ */
+static void test_input_sanitization_method(void **state)
+{
+    apr_pool_t *pool;
+    (void)state;
+
+    apr_pool_create(&pool, NULL);
+
+    /* Simulate oversized method (should be truncated to 32 chars) */
+    const char *long_method = "VERYLONGMETHODTHATEXCEEDSTHEMAXIMUMALLOWEDLENGTHFORHTTPMETHODS";
+    const char *sanitized = apr_pstrmemdup(pool, long_method, 32);
+
+    assert_non_null(sanitized);
+    assert_int_equal(strlen(sanitized), 32);
+    assert_memory_equal(sanitized, "VERYLONGMETHODTHATEXCEEDSTHEMAXI", 32);
+
+    apr_pool_destroy(pool);
+}
+
+/* ============================================================================
+ * Test: Input sanitization - path truncation
+ * ============================================================================ */
+static void test_input_sanitization_path(void **state)
+{
+    apr_pool_t *pool;
+    (void)state;
+
+    apr_pool_create(&pool, NULL);
+
+    /* Simulate oversized path (should be truncated to 2048 chars) */
+    char *long_path = apr_palloc(pool, 3000);
+    memset(long_path, 'A', 2999);
+    long_path[2999] = '\0';
+
+    const char *sanitized = apr_pstrmemdup(pool, long_path, 2048);
+
+    assert_non_null(sanitized);
+    assert_int_equal(strlen(sanitized), 2048);
+
+    apr_pool_destroy(pool);
+}
+
+/* ============================================================================
+ * Test: Input sanitization - host header truncation
+ * ============================================================================ */
+static void test_input_sanitization_host(void **state)
+{
+    apr_pool_t *pool;
+    (void)state;
+
+    apr_pool_create(&pool, NULL);
+
+    /* Simulate oversized Host header (should be truncated to 256 chars) */
+    char *long_host = apr_palloc(pool, 500);
+    memset(long_host, 'H', 499);
+    long_host[499] = '\0';
+
+    const char *sanitized = apr_pstrmemdup(pool, long_host, 256);
+
+    assert_non_null(sanitized);
+    assert_int_equal(strlen(sanitized), 256);
+
+    apr_pool_destroy(pool);
+}
+
+/* ============================================================================
+ * Test: Input sanitization - HTTP version truncation
+ * ============================================================================ */
+static void test_input_sanitization_http_version(void **state)
+{
+    apr_pool_t *pool;
+    (void)state;
+
+    apr_pool_create(&pool, NULL);
+
+    /* Simulate oversized HTTP version (should be truncated to 16 chars) */
+    const char *long_version = "HTTP/1.1.1.1.1.1.1.1.1.1.1.1";
+    const char *sanitized = apr_pstrmemdup(pool, long_version, 16);
+
+    assert_non_null(sanitized);
+    assert_int_equal(strlen(sanitized), 16);
+    assert_memory_equal(sanitized, "HTTP/1.1.1.1.1.1.", 16);
+
+    apr_pool_destroy(pool);
+}
+
 /* ============================================================================
  * Main test runner
  * ============================================================================ */
@@ -1036,6 +1124,12 @@ int main(void)
         cmocka_unit_test_setup_teardown(test_parse_int_strict_valid, setup, teardown),
         cmocka_unit_test_setup_teardown(test_parse_int_strict_invalid, setup, teardown),
 
+        /* Input sanitization tests */
+        cmocka_unit_test_setup_teardown(test_input_sanitization_method, setup, teardown),
+        cmocka_unit_test_setup_teardown(test_input_sanitization_path, setup, teardown),
+        cmocka_unit_test_setup_teardown(test_input_sanitization_host, setup, teardown),
+        cmocka_unit_test_setup_teardown(test_input_sanitization_http_version, setup, teardown),
+
         /* Full JSON structure */
         cmocka_unit_test_setup_teardown(test_full_json_line, setup, teardown),