main
4
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 freephilx
|
3ec69d55de | feat(mihomo): persistent core updates with rollback (#53) | ||
|
freephilx
|
2e6256fb6a |
feat(distribution): add complete installation and recovery workflows
Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. |
||
|
風雪
|
39608cd0fb |
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' |
||
|
風雪
|
4d6241740d |
feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring
Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. |