main
37
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 kazeyukiro
|
bbe10da416 |
fix(release,hy2): sane auto release notes; Loon-friendly HY2 share links
Release workflow: previous stable tag only, merge-base range, first-parent log, noise filter, and per-section caps so notes stay readable. Hysteria2 share/URI: resolve SNI from access profile/public host, emit allowInsecure alongside insecure, encode userinfo via url.User so Loon and similar clients can complete TLS. |
||
|
風雪
|
8c0779afa6 | ci: diagnose VMess gofmt failure | ||
|
風雪
|
8ad38ca2d5 | ci: restore format check | ||
|
風雪
|
e830b02440 | ci: diagnose remaining gofmt difference | ||
|
風雪
|
1f6f3b57b0 | ci: restore format check | ||
|
風雪
|
31b9e110df | ci: print gofmt offenders for debugging | ||
|
kazeyukiro
|
eb78dec2d8 |
ci(release): restore Changes-since notes like v1.3.7
Build formal release body from conventional commits between the previous SemVer tag and this release, then append install notes. ci(release): restore Changes-since notes like v1.3.7 Build formal release body from conventional commits between the previous SemVer tag and this release, then append install notes. ci(release): restore Changes-since notes like v1.3.7 Build formal release body from conventional commits between the previous SemVer tag and this release, then append install notes. ci(release): restore Changes-since notes like v1.3.7 Build formal release body from conventional commits between the previous SemVer tag and this release, then append install notes. ci(release): restore Changes-since notes like v1.3.7 Build formal release body from conventional commits between the previous SemVer tag and this release, then append install notes. ci(release): restore Changes-since notes like v1.3.7 Build formal release body from conventional commits between the previous SemVer tag and this release, then append install notes. ci(release): restore Changes-since notes like v1.3.7 Build formal release body from conventional commits between the previous SemVer tag and this release, then append install notes. ci(release): restore Changes-since notes like v1.3.7 Build formal release body from conventional commits between the previous SemVer tag and this release, then append install notes. ci(release): restore Changes-since notes like v1.3.7 Build formal release body from conventional commits between the previous SemVer tag and this release, then append install notes. ci(release): restore Changes-since notes like v1.3.7 Build formal release body from conventional commits between the previous SemVer tag and this release, then append install notes. ci(release): restore Changes-since notes like v1.3.7 Build formal release body from conventional commits between the previous SemVer tag and this release, then append install notes. ci(release): restore Changes-since notes like v1.3.7 Build formal release body from conventional commits between the previous SemVer tag and this release, then append install notes. |
||
|
kazeyukiro
|
d7dda63c1d | fix(ci): pass latest:false to pre image workflow | ||
|
kazeyukiro
|
de0195f571 |
fix(ci): publish rolling pre release via gh CLI
softprops/action-gh-release failed updating the pre tag with Resource not accessible by integration. Delete+create with gh matches the stable release path and works under GITHUB_TOKEN contents:write. fix(ci): publish rolling pre release via gh CLI softprops/action-gh-release failed updating the pre tag with Resource not accessible by integration. Delete+create with gh matches the stable release path and works under GITHUB_TOKEN contents:write. fix(ci): publish rolling pre release via gh CLI softprops/action-gh-release failed updating the pre tag with Resource not accessible by integration. Delete+create with gh matches the stable release path and works under GITHUB_TOKEN contents:write. fix(ci): publish rolling pre release via gh CLI softprops/action-gh-release failed updating the pre tag with Resource not accessible by integration. Delete+create with gh matches the stable release path and works under GITHUB_TOKEN contents:write. fix(ci): publish rolling pre release via gh CLI softprops/action-gh-release failed updating the pre tag with Resource not accessible by integration. Delete+create with gh matches the stable release path and works under GITHUB_TOKEN contents:write. fix(ci): publish rolling pre release via gh CLI softprops/action-gh-release failed updating the pre tag with Resource not accessible by integration. Delete+create with gh matches the stable release path and works under GITHUB_TOKEN contents:write. fix(ci): publish rolling pre release via gh CLI softprops/action-gh-release failed updating the pre tag with Resource not accessible by integration. Delete+create with gh matches the stable release path and works under GITHUB_TOKEN contents:write. fix(ci): publish rolling pre release via gh CLI softprops/action-gh-release failed updating the pre tag with Resource not accessible by integration. Delete+create with gh matches the stable release path and works under GITHUB_TOKEN contents:write. fix(ci): publish rolling pre release via gh CLI softprops/action-gh-release failed updating the pre tag with Resource not accessible by integration. Delete+create with gh matches the stable release path and works under GITHUB_TOKEN contents:write. fix(ci): publish rolling pre release via gh CLI softprops/action-gh-release failed updating the pre tag with Resource not accessible by integration. Delete+create with gh matches the stable release path and works under GITHUB_TOKEN contents:write. fix(ci): publish rolling pre release via gh CLI softprops/action-gh-release failed updating the pre tag with Resource not accessible by integration. Delete+create with gh matches the stable release path and works under GITHUB_TOKEN contents:write. fix(ci): publish rolling pre release via gh CLI softprops/action-gh-release failed updating the pre tag with Resource not accessible by integration. Delete+create with gh matches the stable release path and works under GITHUB_TOKEN contents:write. |
||
|
風雪
|
270f2669bd |
Delete .github/workflows/embed-frontend.yml
Delete .github/workflows/embed-frontend.yml Delete .github/workflows/embed-frontend.yml Delete .github/workflows/embed-frontend.yml Delete .github/workflows/embed-frontend.yml Delete .github/workflows/embed-frontend.yml Delete .github/workflows/embed-frontend.yml Delete .github/workflows/embed-frontend.yml Delete .github/workflows/embed-frontend.yml Delete .github/workflows/embed-frontend.yml Delete .github/workflows/embed-frontend.yml Delete .github/workflows/embed-frontend.yml |
||
|
kazeyukiro
|
f2c86450c8 |
fix(ci): sync package-lock for lucide-react; document Lucide + cluster push
- Regenerate frontend/package-lock.json (fixes npm ci Missing lucide-react) - CI: fall back to npm install if lock drifts - README(s): Ant Design + Lucide; cluster push by name - docs/cluster.md: multi-node push UX and API - docs/installation.md: frontend stack note fix(ci): sync package-lock for lucide-react; document Lucide + cluster push - Regenerate frontend/package-lock.json (fixes npm ci Missing lucide-react) - CI: fall back to npm install if lock drifts - README(s): Ant Design + Lucide; cluster push by name - docs/cluster.md: multi-node push UX and API - docs/installation.md: frontend stack note fix(ci): sync package-lock for lucide-react; document Lucide + cluster push - Regenerate frontend/package-lock.json (fixes npm ci Missing lucide-react) - CI: fall back to npm install if lock drifts - README(s): Ant Design + Lucide; cluster push by name - docs/cluster.md: multi-node push UX and API - docs/installation.md: frontend stack note fix(ci): sync package-lock for lucide-react; document Lucide + cluster push - Regenerate frontend/package-lock.json (fixes npm ci Missing lucide-react) - CI: fall back to npm install if lock drifts - README(s): Ant Design + Lucide; cluster push by name - docs/cluster.md: multi-node push UX and API - docs/installation.md: frontend stack note fix(ci): sync package-lock for lucide-react; document Lucide + cluster push - Regenerate frontend/package-lock.json (fixes npm ci Missing lucide-react) - CI: fall back to npm install if lock drifts - README(s): Ant Design + Lucide; cluster push by name - docs/cluster.md: multi-node push UX and API - docs/installation.md: frontend stack note fix(ci): sync package-lock for lucide-react; document Lucide + cluster push - Regenerate frontend/package-lock.json (fixes npm ci Missing lucide-react) - CI: fall back to npm install if lock drifts - README(s): Ant Design + Lucide; cluster push by name - docs/cluster.md: multi-node push UX and API - docs/installation.md: frontend stack note fix(ci): sync package-lock for lucide-react; document Lucide + cluster push - Regenerate frontend/package-lock.json (fixes npm ci Missing lucide-react) - CI: fall back to npm install if lock drifts - README(s): Ant Design + Lucide; cluster push by name - docs/cluster.md: multi-node push UX and API - docs/installation.md: frontend stack note fix(ci): sync package-lock for lucide-react; document Lucide + cluster push - Regenerate frontend/package-lock.json (fixes npm ci Missing lucide-react) - CI: fall back to npm install if lock drifts - README(s): Ant Design + Lucide; cluster push by name - docs/cluster.md: multi-node push UX and API - docs/installation.md: frontend stack note fix(ci): sync package-lock for lucide-react; document Lucide + cluster push - Regenerate frontend/package-lock.json (fixes npm ci Missing lucide-react) - CI: fall back to npm install if lock drifts - README(s): Ant Design + Lucide; cluster push by name - docs/cluster.md: multi-node push UX and API - docs/installation.md: frontend stack note fix(ci): sync package-lock for lucide-react; document Lucide + cluster push - Regenerate frontend/package-lock.json (fixes npm ci Missing lucide-react) - CI: fall back to npm install if lock drifts - README(s): Ant Design + Lucide; cluster push by name - docs/cluster.md: multi-node push UX and API - docs/installation.md: frontend stack note fix(ci): sync package-lock for lucide-react; document Lucide + cluster push - Regenerate frontend/package-lock.json (fixes npm ci Missing lucide-react) - CI: fall back to npm install if lock drifts - README(s): Ant Design + Lucide; cluster push by name - docs/cluster.md: multi-node push UX and API - docs/installation.md: frontend stack note fix(ci): sync package-lock for lucide-react; document Lucide + cluster push - Regenerate frontend/package-lock.json (fixes npm ci Missing lucide-react) - CI: fall back to npm install if lock drifts - README(s): Ant Design + Lucide; cluster push by name - docs/cluster.md: multi-node push UX and API - docs/installation.md: frontend stack note |
||
|
kazeyukiro
|
2daf05d93d |
ci(release): allow formal releases from the GitHub web UI
workflow_dispatch now accepts version (1.3.5 or v1.3.5) and optional ref (default main), creates the annotated tag if missing, then builds and publishes. Tag-push releases keep working as before. Existing tags/releases stay immutable. ci(release): allow formal releases from the GitHub web UI workflow_dispatch now accepts version (1.3.5 or v1.3.5) and optional ref (default main), creates the annotated tag if missing, then builds and publishes. Tag-push releases keep working as before. Existing tags/releases stay immutable. ci(release): allow formal releases from the GitHub web UI workflow_dispatch now accepts version (1.3.5 or v1.3.5) and optional ref (default main), creates the annotated tag if missing, then builds and publishes. Tag-push releases keep working as before. Existing tags/releases stay immutable. ci(release): allow formal releases from the GitHub web UI workflow_dispatch now accepts version (1.3.5 or v1.3.5) and optional ref (default main), creates the annotated tag if missing, then builds and publishes. Tag-push releases keep working as before. Existing tags/releases stay immutable. ci(release): allow formal releases from the GitHub web UI workflow_dispatch now accepts version (1.3.5 or v1.3.5) and optional ref (default main), creates the annotated tag if missing, then builds and publishes. Tag-push releases keep working as before. Existing tags/releases stay immutable. ci(release): allow formal releases from the GitHub web UI workflow_dispatch now accepts version (1.3.5 or v1.3.5) and optional ref (default main), creates the annotated tag if missing, then builds and publishes. Tag-push releases keep working as before. Existing tags/releases stay immutable. ci(release): allow formal releases from the GitHub web UI workflow_dispatch now accepts version (1.3.5 or v1.3.5) and optional ref (default main), creates the annotated tag if missing, then builds and publishes. Tag-push releases keep working as before. Existing tags/releases stay immutable. ci(release): allow formal releases from the GitHub web UI workflow_dispatch now accepts version (1.3.5 or v1.3.5) and optional ref (default main), creates the annotated tag if missing, then builds and publishes. Tag-push releases keep working as before. Existing tags/releases stay immutable. ci(release): allow formal releases from the GitHub web UI workflow_dispatch now accepts version (1.3.5 or v1.3.5) and optional ref (default main), creates the annotated tag if missing, then builds and publishes. Tag-push releases keep working as before. Existing tags/releases stay immutable. ci(release): allow formal releases from the GitHub web UI workflow_dispatch now accepts version (1.3.5 or v1.3.5) and optional ref (default main), creates the annotated tag if missing, then builds and publishes. Tag-push releases keep working as before. Existing tags/releases stay immutable. ci(release): allow formal releases from the GitHub web UI workflow_dispatch now accepts version (1.3.5 or v1.3.5) and optional ref (default main), creates the annotated tag if missing, then builds and publishes. Tag-push releases keep working as before. Existing tags/releases stay immutable. ci(release): allow formal releases from the GitHub web UI workflow_dispatch now accepts version (1.3.5 or v1.3.5) and optional ref (default main), creates the annotated tag if missing, then builds and publishes. Tag-push releases keep working as before. Existing tags/releases stay immutable. |
||
|
Z User
|
71119d59d6 |
feat(ui): 18 panel languages, login theme/lang, live about version
- Settings appearance language select uses full LOCALE_OPTIONS (18 locales) - Login page: theme + language switches (persisted via existing stores) - About shows version from /api/v1/health (buildinfo linked at release time) - ldflags write Version/GitCommit/BuildTime into internal/buildinfo feat(ui): 18 panel languages, login theme/lang, live about version - Settings appearance language select uses full LOCALE_OPTIONS (18 locales) - Login page: theme + language switches (persisted via existing stores) - About shows version from /api/v1/health (buildinfo linked at release time) - ldflags write Version/GitCommit/BuildTime into internal/buildinfo feat(ui): 18 panel languages, login theme/lang, live about version - Settings appearance language select uses full LOCALE_OPTIONS (18 locales) - Login page: theme + language switches (persisted via existing stores) - About shows version from /api/v1/health (buildinfo linked at release time) - ldflags write Version/GitCommit/BuildTime into internal/buildinfo feat(ui): 18 panel languages, login theme/lang, live about version - Settings appearance language select uses full LOCALE_OPTIONS (18 locales) - Login page: theme + language switches (persisted via existing stores) - About shows version from /api/v1/health (buildinfo linked at release time) - ldflags write Version/GitCommit/BuildTime into internal/buildinfo feat(ui): 18 panel languages, login theme/lang, live about version - Settings appearance language select uses full LOCALE_OPTIONS (18 locales) - Login page: theme + language switches (persisted via existing stores) - About shows version from /api/v1/health (buildinfo linked at release time) - ldflags write Version/GitCommit/BuildTime into internal/buildinfo feat(ui): 18 panel languages, login theme/lang, live about version - Settings appearance language select uses full LOCALE_OPTIONS (18 locales) - Login page: theme + language switches (persisted via existing stores) - About shows version from /api/v1/health (buildinfo linked at release time) - ldflags write Version/GitCommit/BuildTime into internal/buildinfo feat(ui): 18 panel languages, login theme/lang, live about version - Settings appearance language select uses full LOCALE_OPTIONS (18 locales) - Login page: theme + language switches (persisted via existing stores) - About shows version from /api/v1/health (buildinfo linked at release time) - ldflags write Version/GitCommit/BuildTime into internal/buildinfo feat(ui): 18 panel languages, login theme/lang, live about version - Settings appearance language select uses full LOCALE_OPTIONS (18 locales) - Login page: theme + language switches (persisted via existing stores) - About shows version from /api/v1/health (buildinfo linked at release time) - ldflags write Version/GitCommit/BuildTime into internal/buildinfo feat(ui): 18 panel languages, login theme/lang, live about version - Settings appearance language select uses full LOCALE_OPTIONS (18 locales) - Login page: theme + language switches (persisted via existing stores) - About shows version from /api/v1/health (buildinfo linked at release time) - ldflags write Version/GitCommit/BuildTime into internal/buildinfo feat(ui): 18 panel languages, login theme/lang, live about version - Settings appearance language select uses full LOCALE_OPTIONS (18 locales) - Login page: theme + language switches (persisted via existing stores) - About shows version from /api/v1/health (buildinfo linked at release time) - ldflags write Version/GitCommit/BuildTime into internal/buildinfo feat(ui): 18 panel languages, login theme/lang, live about version - Settings appearance language select uses full LOCALE_OPTIONS (18 locales) - Login page: theme + language switches (persisted via existing stores) - About shows version from /api/v1/health (buildinfo linked at release time) - ldflags write Version/GitCommit/BuildTime into internal/buildinfo feat(ui): 18 panel languages, login theme/lang, live about version - Settings appearance language select uses full LOCALE_OPTIONS (18 locales) - Login page: theme + language switches (persisted via existing stores) - About shows version from /api/v1/health (buildinfo linked at release time) - ldflags write Version/GitCommit/BuildTime into internal/buildinfo |
||
|
freephilx
|
2e6256fb6a |
feat(distribution): add complete installation and recovery workflows
Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. |
||
|
freephilx
|
0e5af8a096 |
feat(listeners)!: select REALITY targets with server-side checks
BREAKING CHANGE: REALITY create and update requests require an explicit reality-config.dest; implicit Microsoft and SNI-derived destinations are no longer supplied. feat(listeners)!: select REALITY targets with server-side checks BREAKING CHANGE: REALITY create and update requests require an explicit reality-config.dest; implicit Microsoft and SNI-derived destinations are no longer supplied. feat(listeners)!: select REALITY targets with server-side checks BREAKING CHANGE: REALITY create and update requests require an explicit reality-config.dest; implicit Microsoft and SNI-derived destinations are no longer supplied. feat(listeners)!: select REALITY targets with server-side checks BREAKING CHANGE: REALITY create and update requests require an explicit reality-config.dest; implicit Microsoft and SNI-derived destinations are no longer supplied. feat(listeners)!: select REALITY targets with server-side checks BREAKING CHANGE: REALITY create and update requests require an explicit reality-config.dest; implicit Microsoft and SNI-derived destinations are no longer supplied. feat(listeners)!: select REALITY targets with server-side checks BREAKING CHANGE: REALITY create and update requests require an explicit reality-config.dest; implicit Microsoft and SNI-derived destinations are no longer supplied. feat(listeners)!: select REALITY targets with server-side checks BREAKING CHANGE: REALITY create and update requests require an explicit reality-config.dest; implicit Microsoft and SNI-derived destinations are no longer supplied. feat(listeners)!: select REALITY targets with server-side checks BREAKING CHANGE: REALITY create and update requests require an explicit reality-config.dest; implicit Microsoft and SNI-derived destinations are no longer supplied. feat(listeners)!: select REALITY targets with server-side checks BREAKING CHANGE: REALITY create and update requests require an explicit reality-config.dest; implicit Microsoft and SNI-derived destinations are no longer supplied. feat(listeners)!: select REALITY targets with server-side checks BREAKING CHANGE: REALITY create and update requests require an explicit reality-config.dest; implicit Microsoft and SNI-derived destinations are no longer supplied. feat(listeners)!: select REALITY targets with server-side checks BREAKING CHANGE: REALITY create and update requests require an explicit reality-config.dest; implicit Microsoft and SNI-derived destinations are no longer supplied. feat(listeners)!: select REALITY targets with server-side checks BREAKING CHANGE: REALITY create and update requests require an explicit reality-config.dest; implicit Microsoft and SNI-derived destinations are no longer supplied. |
||
|
Z User
|
50066e169c |
fix(ci): ProxyUser.hwid_limit; formal vs pre workflows; drop test branch CI
- release.yml: only v* formal releases - release-pre.yml: manual rolling tag pre - remove test from CI triggers - fix missing hwid_limit on ProxyUser (tsc) fix(ci): ProxyUser.hwid_limit; formal vs pre workflows; drop test branch CI - release.yml: only v* formal releases - release-pre.yml: manual rolling tag pre - remove test from CI triggers - fix missing hwid_limit on ProxyUser (tsc) fix(ci): ProxyUser.hwid_limit; formal vs pre workflows; drop test branch CI - release.yml: only v* formal releases - release-pre.yml: manual rolling tag pre - remove test from CI triggers - fix missing hwid_limit on ProxyUser (tsc) fix(ci): ProxyUser.hwid_limit; formal vs pre workflows; drop test branch CI - release.yml: only v* formal releases - release-pre.yml: manual rolling tag pre - remove test from CI triggers - fix missing hwid_limit on ProxyUser (tsc) fix(ci): ProxyUser.hwid_limit; formal vs pre workflows; drop test branch CI - release.yml: only v* formal releases - release-pre.yml: manual rolling tag pre - remove test from CI triggers - fix missing hwid_limit on ProxyUser (tsc) fix(ci): ProxyUser.hwid_limit; formal vs pre workflows; drop test branch CI - release.yml: only v* formal releases - release-pre.yml: manual rolling tag pre - remove test from CI triggers - fix missing hwid_limit on ProxyUser (tsc) fix(ci): ProxyUser.hwid_limit; formal vs pre workflows; drop test branch CI - release.yml: only v* formal releases - release-pre.yml: manual rolling tag pre - remove test from CI triggers - fix missing hwid_limit on ProxyUser (tsc) fix(ci): ProxyUser.hwid_limit; formal vs pre workflows; drop test branch CI - release.yml: only v* formal releases - release-pre.yml: manual rolling tag pre - remove test from CI triggers - fix missing hwid_limit on ProxyUser (tsc) fix(ci): ProxyUser.hwid_limit; formal vs pre workflows; drop test branch CI - release.yml: only v* formal releases - release-pre.yml: manual rolling tag pre - remove test from CI triggers - fix missing hwid_limit on ProxyUser (tsc) fix(ci): ProxyUser.hwid_limit; formal vs pre workflows; drop test branch CI - release.yml: only v* formal releases - release-pre.yml: manual rolling tag pre - remove test from CI triggers - fix missing hwid_limit on ProxyUser (tsc) fix(ci): ProxyUser.hwid_limit; formal vs pre workflows; drop test branch CI - release.yml: only v* formal releases - release-pre.yml: manual rolling tag pre - remove test from CI triggers - fix missing hwid_limit on ProxyUser (tsc) fix(ci): ProxyUser.hwid_limit; formal vs pre workflows; drop test branch CI - release.yml: only v* formal releases - release-pre.yml: manual rolling tag pre - remove test from CI triggers - fix missing hwid_limit on ProxyUser (tsc) |
||
|
Z User
|
0707ff9316 |
ci(release): formal v* releases are non-prerelease latest; pre stays rolling
ci(release): formal v* releases are non-prerelease latest; pre stays rolling ci(release): formal v* releases are non-prerelease latest; pre stays rolling ci(release): formal v* releases are non-prerelease latest; pre stays rolling ci(release): formal v* releases are non-prerelease latest; pre stays rolling ci(release): formal v* releases are non-prerelease latest; pre stays rolling ci(release): formal v* releases are non-prerelease latest; pre stays rolling ci(release): formal v* releases are non-prerelease latest; pre stays rolling ci(release): formal v* releases are non-prerelease latest; pre stays rolling ci(release): formal v* releases are non-prerelease latest; pre stays rolling ci(release): formal v* releases are non-prerelease latest; pre stays rolling ci(release): formal v* releases are non-prerelease latest; pre stays rolling |
||
|
Z User
|
b7f0389353 |
ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates)
ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) |
||
|
Z User
|
e6e9f60e9d | fix(subpage): drop unused encoding/json; CI on test; qrcode direct dep | ||
|
Z User
|
f4bb43ecd3 |
ci(test): publish Pre-releases; install/update prefer newest prerelease
ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease |
||
|
Z User
|
d6e64ab313 |
chore(release): set version to v1.0.0
Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. |
||
|
風雪
|
4f038eba42 |
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS |
||
|
風雪
|
39608cd0fb |
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' |
||
|
風雪
|
80986710f5 | fix(release): bare SHA256SUMS names; attach management scripts | ||
|
風雪
|
4455f1546b | fix: Hy2 quick-setup self-signed TLS; CI workflow_dispatch; release-ready | ||
|
風雪
|
4585f304a6 | fix(scripts): checksum verify, versioned update, backup retention, safer traps | ||
|
風雪
|
08001e42de |
feat(release): pure-Go static multi-arch Linux builds (CGO=0 + modernc sqlite)
Architectures: amd64(v1), arm64, armv7, armv6, 386, riscv64, loong64, ppc64le, s390x Portable on glibc and musl without system libsqlite3 feat(release): pure-Go static multi-arch Linux builds (CGO=0 + modernc sqlite) Architectures: amd64(v1), arm64, armv7, armv6, 386, riscv64, loong64, ppc64le, s390x Portable on glibc and musl without system libsqlite3 feat(release): pure-Go static multi-arch Linux builds (CGO=0 + modernc sqlite) Architectures: amd64(v1), arm64, armv7, armv6, 386, riscv64, loong64, ppc64le, s390x Portable on glibc and musl without system libsqlite3 feat(release): pure-Go static multi-arch Linux builds (CGO=0 + modernc sqlite) Architectures: amd64(v1), arm64, armv7, armv6, 386, riscv64, loong64, ppc64le, s390x Portable on glibc and musl without system libsqlite3 feat(release): pure-Go static multi-arch Linux builds (CGO=0 + modernc sqlite) Architectures: amd64(v1), arm64, armv7, armv6, 386, riscv64, loong64, ppc64le, s390x Portable on glibc and musl without system libsqlite3 feat(release): pure-Go static multi-arch Linux builds (CGO=0 + modernc sqlite) Architectures: amd64(v1), arm64, armv7, armv6, 386, riscv64, loong64, ppc64le, s390x Portable on glibc and musl without system libsqlite3 feat(release): pure-Go static multi-arch Linux builds (CGO=0 + modernc sqlite) Architectures: amd64(v1), arm64, armv7, armv6, 386, riscv64, loong64, ppc64le, s390x Portable on glibc and musl without system libsqlite3 feat(release): pure-Go static multi-arch Linux builds (CGO=0 + modernc sqlite) Architectures: amd64(v1), arm64, armv7, armv6, 386, riscv64, loong64, ppc64le, s390x Portable on glibc and musl without system libsqlite3 feat(release): pure-Go static multi-arch Linux builds (CGO=0 + modernc sqlite) Architectures: amd64(v1), arm64, armv7, armv6, 386, riscv64, loong64, ppc64le, s390x Portable on glibc and musl without system libsqlite3 feat(release): pure-Go static multi-arch Linux builds (CGO=0 + modernc sqlite) Architectures: amd64(v1), arm64, armv7, armv6, 386, riscv64, loong64, ppc64le, s390x Portable on glibc and musl without system libsqlite3 feat(release): pure-Go static multi-arch Linux builds (CGO=0 + modernc sqlite) Architectures: amd64(v1), arm64, armv7, armv6, 386, riscv64, loong64, ppc64le, s390x Portable on glibc and musl without system libsqlite3 feat(release): pure-Go static multi-arch Linux builds (CGO=0 + modernc sqlite) Architectures: amd64(v1), arm64, armv7, armv6, 386, riscv64, loong64, ppc64le, s390x Portable on glibc and musl without system libsqlite3 |
||
|
風雪
|
885100fd4d |
update
update update update update update update update update update update update |
||
|
風雪
|
6b3a09a09c |
update
update update update update update update update update update update update |
||
|
風雪
|
4d25b52547 |
ci(release): deprecate combined release workflow
ci(release): deprecate combined release workflow ci(release): deprecate combined release workflow ci(release): deprecate combined release workflow ci(release): deprecate combined release workflow ci(release): deprecate combined release workflow ci(release): deprecate combined release workflow ci(release): deprecate combined release workflow ci(release): deprecate combined release workflow ci(release): deprecate combined release workflow ci(release): deprecate combined release workflow ci(release): deprecate combined release workflow |
||
|
風雪
|
197079ec2b | feat(ui): add independent Material, Mantine and shadcn editions | ||
|
風雪
|
65a6de976d |
ci(frontend): keep embedded web assets in sync
ci(frontend): keep embedded web assets in sync ci(frontend): keep embedded web assets in sync ci(frontend): keep embedded web assets in sync ci(frontend): keep embedded web assets in sync ci(frontend): keep embedded web assets in sync ci(frontend): keep embedded web assets in sync ci(frontend): keep embedded web assets in sync ci(frontend): keep embedded web assets in sync ci(frontend): keep embedded web assets in sync ci(frontend): keep embedded web assets in sync ci(frontend): keep embedded web assets in sync |
||
|
風雪
|
d6545ede90 | Merge branch 'main' into fix/telegram-p0-p1-hardening | ||
|
風雪
|
f1ea17889b | test: run Telegram concurrency suite with race detector | ||
|
風雪
|
2c06ca5a22 | ci: build backend and validate agent branches | ||
|
dzx941
|
6ac6b31a39 | update | ||
|
dzx941
|
5b4cb63a73 |
fix: align listener generation with mihomo official spec
- Port now supports mihomo ports format (single/range/list) - Add explicit RoutingMark field support - Auto-propagate UDP flag for vmess/vless/trojan/anytls/trusttunnel - Update validator to accept port ranges - Sync visual config and client converter port types - Rename module from dzx941 to kazeyukiro - Fix missing ExpiresAt in JWTClaims - Fix nodeDTO Port type to string - Fix frontend tsconfig and add missing dependencies |