910d36fb3e2cfed4b1fcee095113ff7d43fbfe3c
49
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 風雪
|
7f664a5d1a |
fix(ci): wait for async certstore after listener create in smoke-runtime
Listener TLS PEMs are written during debounced GenerateFinalConfig/ApplyConfig. Smoke was asserting listener-certs immediately after POST /listeners and failed on amd64/arm64 pre builds. fix(ci): wait for async certstore after listener create in smoke-runtime Listener TLS PEMs are written during debounced GenerateFinalConfig/ApplyConfig. Smoke was asserting listener-certs immediately after POST /listeners and failed on amd64/arm64 pre builds. fix(ci): wait for async certstore after listener create in smoke-runtime Listener TLS PEMs are written during debounced GenerateFinalConfig/ApplyConfig. Smoke was asserting listener-certs immediately after POST /listeners and failed on amd64/arm64 pre builds. fix(ci): wait for async certstore after listener create in smoke-runtime Listener TLS PEMs are written during debounced GenerateFinalConfig/ApplyConfig. Smoke was asserting listener-certs immediately after POST /listeners and failed on amd64/arm64 pre builds. fix(ci): wait for async certstore after listener create in smoke-runtime Listener TLS PEMs are written during debounced GenerateFinalConfig/ApplyConfig. Smoke was asserting listener-certs immediately after POST /listeners and failed on amd64/arm64 pre builds. fix(ci): wait for async certstore after listener create in smoke-runtime Listener TLS PEMs are written during debounced GenerateFinalConfig/ApplyConfig. Smoke was asserting listener-certs immediately after POST /listeners and failed on amd64/arm64 pre builds. fix(ci): wait for async certstore after listener create in smoke-runtime Listener TLS PEMs are written during debounced GenerateFinalConfig/ApplyConfig. Smoke was asserting listener-certs immediately after POST /listeners and failed on amd64/arm64 pre builds. fix(ci): wait for async certstore after listener create in smoke-runtime Listener TLS PEMs are written during debounced GenerateFinalConfig/ApplyConfig. Smoke was asserting listener-certs immediately after POST /listeners and failed on amd64/arm64 pre builds. fix(ci): wait for async certstore after listener create in smoke-runtime Listener TLS PEMs are written during debounced GenerateFinalConfig/ApplyConfig. Smoke was asserting listener-certs immediately after POST /listeners and failed on amd64/arm64 pre builds. fix(ci): wait for async certstore after listener create in smoke-runtime Listener TLS PEMs are written during debounced GenerateFinalConfig/ApplyConfig. Smoke was asserting listener-certs immediately after POST /listeners and failed on amd64/arm64 pre builds. fix(ci): wait for async certstore after listener create in smoke-runtime Listener TLS PEMs are written during debounced GenerateFinalConfig/ApplyConfig. Smoke was asserting listener-certs immediately after POST /listeners and failed on amd64/arm64 pre builds. fix(ci): wait for async certstore after listener create in smoke-runtime Listener TLS PEMs are written during debounced GenerateFinalConfig/ApplyConfig. Smoke was asserting listener-certs immediately after POST /listeners and failed on amd64/arm64 pre builds. |
||
|
風雪
|
68aafdea86 |
feat(scripts/3m-ui): add channel stable|pre subcommand
3m-ui channel [stable|pre] [--update] — show/set update channel and optional upgrade. feat(scripts/3m-ui): add channel stable|pre subcommand 3m-ui channel [stable|pre] [--update] — show/set update channel and optional upgrade. feat(scripts/3m-ui): add channel stable|pre subcommand 3m-ui channel [stable|pre] [--update] — show/set update channel and optional upgrade. feat(scripts/3m-ui): add channel stable|pre subcommand 3m-ui channel [stable|pre] [--update] — show/set update channel and optional upgrade. feat(scripts/3m-ui): add channel stable|pre subcommand 3m-ui channel [stable|pre] [--update] — show/set update channel and optional upgrade. feat(scripts/3m-ui): add channel stable|pre subcommand 3m-ui channel [stable|pre] [--update] — show/set update channel and optional upgrade. feat(scripts/3m-ui): add channel stable|pre subcommand 3m-ui channel [stable|pre] [--update] — show/set update channel and optional upgrade. feat(scripts/3m-ui): add channel stable|pre subcommand 3m-ui channel [stable|pre] [--update] — show/set update channel and optional upgrade. feat(scripts/3m-ui): add channel stable|pre subcommand 3m-ui channel [stable|pre] [--update] — show/set update channel and optional upgrade. feat(scripts/3m-ui): add channel stable|pre subcommand 3m-ui channel [stable|pre] [--update] — show/set update channel and optional upgrade. feat(scripts/3m-ui): add channel stable|pre subcommand 3m-ui channel [stable|pre] [--update] — show/set update channel and optional upgrade. feat(scripts/3m-ui): add channel stable|pre subcommand 3m-ui channel [stable|pre] [--update] — show/set update channel and optional upgrade. |
||
|
風雪
|
d5629d0247 |
security: remove unverified script downloads
security: remove unverified script downloads security: remove unverified script downloads security: remove unverified script downloads security: remove unverified script downloads security: remove unverified script downloads security: remove unverified script downloads security: remove unverified script downloads security: remove unverified script downloads security: remove unverified script downloads security: remove unverified script downloads security: remove unverified script downloads |
||
|
風雪
|
0084c4f053 |
fix(install): always refresh all lifecycle scripts on update
- Force-install 3m-ui-bin, install/update/uninstall.sh, 3m-ui.sh, 3m-ui - Re-install /usr/local/bin/3m-ui from the same release (no stale entry) - Log each installed path; verify executables after write - chmod scripts in prepare_release; document in update.sh fix(install): always refresh all lifecycle scripts on update - Force-install 3m-ui-bin, install/update/uninstall.sh, 3m-ui.sh, 3m-ui - Re-install /usr/local/bin/3m-ui from the same release (no stale entry) - Log each installed path; verify executables after write - chmod scripts in prepare_release; document in update.sh fix(install): always refresh all lifecycle scripts on update - Force-install 3m-ui-bin, install/update/uninstall.sh, 3m-ui.sh, 3m-ui - Re-install /usr/local/bin/3m-ui from the same release (no stale entry) - Log each installed path; verify executables after write - chmod scripts in prepare_release; document in update.sh fix(install): always refresh all lifecycle scripts on update - Force-install 3m-ui-bin, install/update/uninstall.sh, 3m-ui.sh, 3m-ui - Re-install /usr/local/bin/3m-ui from the same release (no stale entry) - Log each installed path; verify executables after write - chmod scripts in prepare_release; document in update.sh fix(install): always refresh all lifecycle scripts on update - Force-install 3m-ui-bin, install/update/uninstall.sh, 3m-ui.sh, 3m-ui - Re-install /usr/local/bin/3m-ui from the same release (no stale entry) - Log each installed path; verify executables after write - chmod scripts in prepare_release; document in update.sh fix(install): always refresh all lifecycle scripts on update - Force-install 3m-ui-bin, install/update/uninstall.sh, 3m-ui.sh, 3m-ui - Re-install /usr/local/bin/3m-ui from the same release (no stale entry) - Log each installed path; verify executables after write - chmod scripts in prepare_release; document in update.sh fix(install): always refresh all lifecycle scripts on update - Force-install 3m-ui-bin, install/update/uninstall.sh, 3m-ui.sh, 3m-ui - Re-install /usr/local/bin/3m-ui from the same release (no stale entry) - Log each installed path; verify executables after write - chmod scripts in prepare_release; document in update.sh fix(install): always refresh all lifecycle scripts on update - Force-install 3m-ui-bin, install/update/uninstall.sh, 3m-ui.sh, 3m-ui - Re-install /usr/local/bin/3m-ui from the same release (no stale entry) - Log each installed path; verify executables after write - chmod scripts in prepare_release; document in update.sh fix(install): always refresh all lifecycle scripts on update - Force-install 3m-ui-bin, install/update/uninstall.sh, 3m-ui.sh, 3m-ui - Re-install /usr/local/bin/3m-ui from the same release (no stale entry) - Log each installed path; verify executables after write - chmod scripts in prepare_release; document in update.sh fix(install): always refresh all lifecycle scripts on update - Force-install 3m-ui-bin, install/update/uninstall.sh, 3m-ui.sh, 3m-ui - Re-install /usr/local/bin/3m-ui from the same release (no stale entry) - Log each installed path; verify executables after write - chmod scripts in prepare_release; document in update.sh fix(install): always refresh all lifecycle scripts on update - Force-install 3m-ui-bin, install/update/uninstall.sh, 3m-ui.sh, 3m-ui - Re-install /usr/local/bin/3m-ui from the same release (no stale entry) - Log each installed path; verify executables after write - chmod scripts in prepare_release; document in update.sh fix(install): always refresh all lifecycle scripts on update - Force-install 3m-ui-bin, install/update/uninstall.sh, 3m-ui.sh, 3m-ui - Re-install /usr/local/bin/3m-ui from the same release (no stale entry) - Log each installed path; verify executables after write - chmod scripts in prepare_release; document in update.sh |
||
|
風雪
|
508b3e30c0 |
fix(scripts/3m-ui): harden yaml edit, DATA_DIR, logs follow, update_self prompt
- Expand $BASE in update_self confirm - mkdir DATA_DIR before run_app - Flexible yaml_get/yaml_set indentation; fail if no server: - logs -f tolerates Ctrl+C under set -e - Clearer enable/disable errors fix(scripts/3m-ui): harden yaml edit, DATA_DIR, logs follow, update_self prompt - Expand $BASE in update_self confirm - mkdir DATA_DIR before run_app - Flexible yaml_get/yaml_set indentation; fail if no server: - logs -f tolerates Ctrl+C under set -e - Clearer enable/disable errors fix(scripts/3m-ui): harden yaml edit, DATA_DIR, logs follow, update_self prompt - Expand $BASE in update_self confirm - mkdir DATA_DIR before run_app - Flexible yaml_get/yaml_set indentation; fail if no server: - logs -f tolerates Ctrl+C under set -e - Clearer enable/disable errors fix(scripts/3m-ui): harden yaml edit, DATA_DIR, logs follow, update_self prompt - Expand $BASE in update_self confirm - mkdir DATA_DIR before run_app - Flexible yaml_get/yaml_set indentation; fail if no server: - logs -f tolerates Ctrl+C under set -e - Clearer enable/disable errors fix(scripts/3m-ui): harden yaml edit, DATA_DIR, logs follow, update_self prompt - Expand $BASE in update_self confirm - mkdir DATA_DIR before run_app - Flexible yaml_get/yaml_set indentation; fail if no server: - logs -f tolerates Ctrl+C under set -e - Clearer enable/disable errors fix(scripts/3m-ui): harden yaml edit, DATA_DIR, logs follow, update_self prompt - Expand $BASE in update_self confirm - mkdir DATA_DIR before run_app - Flexible yaml_get/yaml_set indentation; fail if no server: - logs -f tolerates Ctrl+C under set -e - Clearer enable/disable errors fix(scripts/3m-ui): harden yaml edit, DATA_DIR, logs follow, update_self prompt - Expand $BASE in update_self confirm - mkdir DATA_DIR before run_app - Flexible yaml_get/yaml_set indentation; fail if no server: - logs -f tolerates Ctrl+C under set -e - Clearer enable/disable errors fix(scripts/3m-ui): harden yaml edit, DATA_DIR, logs follow, update_self prompt - Expand $BASE in update_self confirm - mkdir DATA_DIR before run_app - Flexible yaml_get/yaml_set indentation; fail if no server: - logs -f tolerates Ctrl+C under set -e - Clearer enable/disable errors fix(scripts/3m-ui): harden yaml edit, DATA_DIR, logs follow, update_self prompt - Expand $BASE in update_self confirm - mkdir DATA_DIR before run_app - Flexible yaml_get/yaml_set indentation; fail if no server: - logs -f tolerates Ctrl+C under set -e - Clearer enable/disable errors fix(scripts/3m-ui): harden yaml edit, DATA_DIR, logs follow, update_self prompt - Expand $BASE in update_self confirm - mkdir DATA_DIR before run_app - Flexible yaml_get/yaml_set indentation; fail if no server: - logs -f tolerates Ctrl+C under set -e - Clearer enable/disable errors fix(scripts/3m-ui): harden yaml edit, DATA_DIR, logs follow, update_self prompt - Expand $BASE in update_self confirm - mkdir DATA_DIR before run_app - Flexible yaml_get/yaml_set indentation; fail if no server: - logs -f tolerates Ctrl+C under set -e - Clearer enable/disable errors fix(scripts/3m-ui): harden yaml edit, DATA_DIR, logs follow, update_self prompt - Expand $BASE in update_self confirm - mkdir DATA_DIR before run_app - Flexible yaml_get/yaml_set indentation; fail if no server: - logs -f tolerates Ctrl+C under set -e - Clearer enable/disable errors |
||
|
風雪
|
aa08f34be4 |
feat(scripts/3m-ui): expand management console with ops features
Reimplemented for 3m-ui (not a copy of third-party scripts): - enable/disable on boot, follow logs, access URI view - port / public_url / web_path / sub_path / sub_port editors - update to version, update this script from repo - BBR status/enable/disable, Geo, firewall hints - SSL cert helper (certbot/acme.sh command templates) - backup entry, healthcheck, confirm + pause menu flow feat(scripts/3m-ui): expand management console with ops features Reimplemented for 3m-ui (not a copy of third-party scripts): - enable/disable on boot, follow logs, access URI view - port / public_url / web_path / sub_path / sub_port editors - update to version, update this script from repo - BBR status/enable/disable, Geo, firewall hints - SSL cert helper (certbot/acme.sh command templates) - backup entry, healthcheck, confirm + pause menu flow feat(scripts/3m-ui): expand management console with ops features Reimplemented for 3m-ui (not a copy of third-party scripts): - enable/disable on boot, follow logs, access URI view - port / public_url / web_path / sub_path / sub_port editors - update to version, update this script from repo - BBR status/enable/disable, Geo, firewall hints - SSL cert helper (certbot/acme.sh command templates) - backup entry, healthcheck, confirm + pause menu flow feat(scripts/3m-ui): expand management console with ops features Reimplemented for 3m-ui (not a copy of third-party scripts): - enable/disable on boot, follow logs, access URI view - port / public_url / web_path / sub_path / sub_port editors - update to version, update this script from repo - BBR status/enable/disable, Geo, firewall hints - SSL cert helper (certbot/acme.sh command templates) - backup entry, healthcheck, confirm + pause menu flow feat(scripts/3m-ui): expand management console with ops features Reimplemented for 3m-ui (not a copy of third-party scripts): - enable/disable on boot, follow logs, access URI view - port / public_url / web_path / sub_path / sub_port editors - update to version, update this script from repo - BBR status/enable/disable, Geo, firewall hints - SSL cert helper (certbot/acme.sh command templates) - backup entry, healthcheck, confirm + pause menu flow feat(scripts/3m-ui): expand management console with ops features Reimplemented for 3m-ui (not a copy of third-party scripts): - enable/disable on boot, follow logs, access URI view - port / public_url / web_path / sub_path / sub_port editors - update to version, update this script from repo - BBR status/enable/disable, Geo, firewall hints - SSL cert helper (certbot/acme.sh command templates) - backup entry, healthcheck, confirm + pause menu flow feat(scripts/3m-ui): expand management console with ops features Reimplemented for 3m-ui (not a copy of third-party scripts): - enable/disable on boot, follow logs, access URI view - port / public_url / web_path / sub_path / sub_port editors - update to version, update this script from repo - BBR status/enable/disable, Geo, firewall hints - SSL cert helper (certbot/acme.sh command templates) - backup entry, healthcheck, confirm + pause menu flow feat(scripts/3m-ui): expand management console with ops features Reimplemented for 3m-ui (not a copy of third-party scripts): - enable/disable on boot, follow logs, access URI view - port / public_url / web_path / sub_path / sub_port editors - update to version, update this script from repo - BBR status/enable/disable, Geo, firewall hints - SSL cert helper (certbot/acme.sh command templates) - backup entry, healthcheck, confirm + pause menu flow feat(scripts/3m-ui): expand management console with ops features Reimplemented for 3m-ui (not a copy of third-party scripts): - enable/disable on boot, follow logs, access URI view - port / public_url / web_path / sub_path / sub_port editors - update to version, update this script from repo - BBR status/enable/disable, Geo, firewall hints - SSL cert helper (certbot/acme.sh command templates) - backup entry, healthcheck, confirm + pause menu flow feat(scripts/3m-ui): expand management console with ops features Reimplemented for 3m-ui (not a copy of third-party scripts): - enable/disable on boot, follow logs, access URI view - port / public_url / web_path / sub_path / sub_port editors - update to version, update this script from repo - BBR status/enable/disable, Geo, firewall hints - SSL cert helper (certbot/acme.sh command templates) - backup entry, healthcheck, confirm + pause menu flow feat(scripts/3m-ui): expand management console with ops features Reimplemented for 3m-ui (not a copy of third-party scripts): - enable/disable on boot, follow logs, access URI view - port / public_url / web_path / sub_path / sub_port editors - update to version, update this script from repo - BBR status/enable/disable, Geo, firewall hints - SSL cert helper (certbot/acme.sh command templates) - backup entry, healthcheck, confirm + pause menu flow feat(scripts/3m-ui): expand management console with ops features Reimplemented for 3m-ui (not a copy of third-party scripts): - enable/disable on boot, follow logs, access URI view - port / public_url / web_path / sub_path / sub_port editors - update to version, update this script from repo - BBR status/enable/disable, Geo, firewall hints - SSL cert helper (certbot/acme.sh command templates) - backup entry, healthcheck, confirm + pause menu flow |
||
|
風雪
|
bcdec99d82 |
fix(scripts/3m-ui): menu set -e survival, service_is_active, safer config edits
- Menu actions no longer abort the whole console on failure (set -e) - Use local status/start/stop/logs/version instead of 3m-ui.sh detour - service_is_active for post-restart checks; help without root - Safer port/public_url YAML edits (missing field, BusyBox insert, sed escape) fix(scripts/3m-ui): menu set -e survival, service_is_active, safer config edits - Menu actions no longer abort the whole console on failure (set -e) - Use local status/start/stop/logs/version instead of 3m-ui.sh detour - service_is_active for post-restart checks; help without root - Safer port/public_url YAML edits (missing field, BusyBox insert, sed escape) fix(scripts/3m-ui): menu set -e survival, service_is_active, safer config edits - Menu actions no longer abort the whole console on failure (set -e) - Use local status/start/stop/logs/version instead of 3m-ui.sh detour - service_is_active for post-restart checks; help without root - Safer port/public_url YAML edits (missing field, BusyBox insert, sed escape) fix(scripts/3m-ui): menu set -e survival, service_is_active, safer config edits - Menu actions no longer abort the whole console on failure (set -e) - Use local status/start/stop/logs/version instead of 3m-ui.sh detour - service_is_active for post-restart checks; help without root - Safer port/public_url YAML edits (missing field, BusyBox insert, sed escape) fix(scripts/3m-ui): menu set -e survival, service_is_active, safer config edits - Menu actions no longer abort the whole console on failure (set -e) - Use local status/start/stop/logs/version instead of 3m-ui.sh detour - service_is_active for post-restart checks; help without root - Safer port/public_url YAML edits (missing field, BusyBox insert, sed escape) fix(scripts/3m-ui): menu set -e survival, service_is_active, safer config edits - Menu actions no longer abort the whole console on failure (set -e) - Use local status/start/stop/logs/version instead of 3m-ui.sh detour - service_is_active for post-restart checks; help without root - Safer port/public_url YAML edits (missing field, BusyBox insert, sed escape) fix(scripts/3m-ui): menu set -e survival, service_is_active, safer config edits - Menu actions no longer abort the whole console on failure (set -e) - Use local status/start/stop/logs/version instead of 3m-ui.sh detour - service_is_active for post-restart checks; help without root - Safer port/public_url YAML edits (missing field, BusyBox insert, sed escape) fix(scripts/3m-ui): menu set -e survival, service_is_active, safer config edits - Menu actions no longer abort the whole console on failure (set -e) - Use local status/start/stop/logs/version instead of 3m-ui.sh detour - service_is_active for post-restart checks; help without root - Safer port/public_url YAML edits (missing field, BusyBox insert, sed escape) fix(scripts/3m-ui): menu set -e survival, service_is_active, safer config edits - Menu actions no longer abort the whole console on failure (set -e) - Use local status/start/stop/logs/version instead of 3m-ui.sh detour - service_is_active for post-restart checks; help without root - Safer port/public_url YAML edits (missing field, BusyBox insert, sed escape) fix(scripts/3m-ui): menu set -e survival, service_is_active, safer config edits - Menu actions no longer abort the whole console on failure (set -e) - Use local status/start/stop/logs/version instead of 3m-ui.sh detour - service_is_active for post-restart checks; help without root - Safer port/public_url YAML edits (missing field, BusyBox insert, sed escape) fix(scripts/3m-ui): menu set -e survival, service_is_active, safer config edits - Menu actions no longer abort the whole console on failure (set -e) - Use local status/start/stop/logs/version instead of 3m-ui.sh detour - service_is_active for post-restart checks; help without root - Safer port/public_url YAML edits (missing field, BusyBox insert, sed escape) fix(scripts/3m-ui): menu set -e survival, service_is_active, safer config edits - Menu actions no longer abort the whole console on failure (set -e) - Use local status/start/stop/logs/version instead of 3m-ui.sh detour - service_is_active for post-restart checks; help without root - Safer port/public_url YAML edits (missing field, BusyBox insert, sed escape) |
||
|
Z User
|
72a81853b7 |
fix: version menu shows release files; reclaim soft-deleted listener names
- 3m-ui version: fall back to VERSION/CHANNEL/MIHOMO when --version is empty - ensureUniqueName: hard-delete soft-deleted rows still holding UNIQUE(name) - Frontend suggests next 节点N after already-exists conflicts fix: version menu shows release files; reclaim soft-deleted listener names - 3m-ui version: fall back to VERSION/CHANNEL/MIHOMO when --version is empty - ensureUniqueName: hard-delete soft-deleted rows still holding UNIQUE(name) - Frontend suggests next 节点N after already-exists conflicts fix: version menu shows release files; reclaim soft-deleted listener names - 3m-ui version: fall back to VERSION/CHANNEL/MIHOMO when --version is empty - ensureUniqueName: hard-delete soft-deleted rows still holding UNIQUE(name) - Frontend suggests next 节点N after already-exists conflicts fix: version menu shows release files; reclaim soft-deleted listener names - 3m-ui version: fall back to VERSION/CHANNEL/MIHOMO when --version is empty - ensureUniqueName: hard-delete soft-deleted rows still holding UNIQUE(name) - Frontend suggests next 节点N after already-exists conflicts fix: version menu shows release files; reclaim soft-deleted listener names - 3m-ui version: fall back to VERSION/CHANNEL/MIHOMO when --version is empty - ensureUniqueName: hard-delete soft-deleted rows still holding UNIQUE(name) - Frontend suggests next 节点N after already-exists conflicts fix: version menu shows release files; reclaim soft-deleted listener names - 3m-ui version: fall back to VERSION/CHANNEL/MIHOMO when --version is empty - ensureUniqueName: hard-delete soft-deleted rows still holding UNIQUE(name) - Frontend suggests next 节点N after already-exists conflicts fix: version menu shows release files; reclaim soft-deleted listener names - 3m-ui version: fall back to VERSION/CHANNEL/MIHOMO when --version is empty - ensureUniqueName: hard-delete soft-deleted rows still holding UNIQUE(name) - Frontend suggests next 节点N after already-exists conflicts fix: version menu shows release files; reclaim soft-deleted listener names - 3m-ui version: fall back to VERSION/CHANNEL/MIHOMO when --version is empty - ensureUniqueName: hard-delete soft-deleted rows still holding UNIQUE(name) - Frontend suggests next 节点N after already-exists conflicts fix: version menu shows release files; reclaim soft-deleted listener names - 3m-ui version: fall back to VERSION/CHANNEL/MIHOMO when --version is empty - ensureUniqueName: hard-delete soft-deleted rows still holding UNIQUE(name) - Frontend suggests next 节点N after already-exists conflicts fix: version menu shows release files; reclaim soft-deleted listener names - 3m-ui version: fall back to VERSION/CHANNEL/MIHOMO when --version is empty - ensureUniqueName: hard-delete soft-deleted rows still holding UNIQUE(name) - Frontend suggests next 节点N after already-exists conflicts fix: version menu shows release files; reclaim soft-deleted listener names - 3m-ui version: fall back to VERSION/CHANNEL/MIHOMO when --version is empty - ensureUniqueName: hard-delete soft-deleted rows still holding UNIQUE(name) - Frontend suggests next 节点N after already-exists conflicts fix: version menu shows release files; reclaim soft-deleted listener names - 3m-ui version: fall back to VERSION/CHANNEL/MIHOMO when --version is empty - ensureUniqueName: hard-delete soft-deleted rows still holding UNIQUE(name) - Frontend suggests next 节点N after already-exists conflicts |
||
|
Z User
|
d404de8cb9 |
fix(mihomo): start core synchronously on first apply; poll in smoke
ApplyConfigDeferredRestart returned before Start() when core was down, so smoke (and UI) saw running=false right after creating the first listener. - First start: still synchronous (fail the API if core cannot start) - Already running: keep async restart for responsive create/update - smoke-runtime: brief poll for mihomo/status.running fix(mihomo): start core synchronously on first apply; poll in smoke ApplyConfigDeferredRestart returned before Start() when core was down, so smoke (and UI) saw running=false right after creating the first listener. - First start: still synchronous (fail the API if core cannot start) - Already running: keep async restart for responsive create/update - smoke-runtime: brief poll for mihomo/status.running fix(mihomo): start core synchronously on first apply; poll in smoke ApplyConfigDeferredRestart returned before Start() when core was down, so smoke (and UI) saw running=false right after creating the first listener. - First start: still synchronous (fail the API if core cannot start) - Already running: keep async restart for responsive create/update - smoke-runtime: brief poll for mihomo/status.running fix(mihomo): start core synchronously on first apply; poll in smoke ApplyConfigDeferredRestart returned before Start() when core was down, so smoke (and UI) saw running=false right after creating the first listener. - First start: still synchronous (fail the API if core cannot start) - Already running: keep async restart for responsive create/update - smoke-runtime: brief poll for mihomo/status.running fix(mihomo): start core synchronously on first apply; poll in smoke ApplyConfigDeferredRestart returned before Start() when core was down, so smoke (and UI) saw running=false right after creating the first listener. - First start: still synchronous (fail the API if core cannot start) - Already running: keep async restart for responsive create/update - smoke-runtime: brief poll for mihomo/status.running fix(mihomo): start core synchronously on first apply; poll in smoke ApplyConfigDeferredRestart returned before Start() when core was down, so smoke (and UI) saw running=false right after creating the first listener. - First start: still synchronous (fail the API if core cannot start) - Already running: keep async restart for responsive create/update - smoke-runtime: brief poll for mihomo/status.running fix(mihomo): start core synchronously on first apply; poll in smoke ApplyConfigDeferredRestart returned before Start() when core was down, so smoke (and UI) saw running=false right after creating the first listener. - First start: still synchronous (fail the API if core cannot start) - Already running: keep async restart for responsive create/update - smoke-runtime: brief poll for mihomo/status.running fix(mihomo): start core synchronously on first apply; poll in smoke ApplyConfigDeferredRestart returned before Start() when core was down, so smoke (and UI) saw running=false right after creating the first listener. - First start: still synchronous (fail the API if core cannot start) - Already running: keep async restart for responsive create/update - smoke-runtime: brief poll for mihomo/status.running fix(mihomo): start core synchronously on first apply; poll in smoke ApplyConfigDeferredRestart returned before Start() when core was down, so smoke (and UI) saw running=false right after creating the first listener. - First start: still synchronous (fail the API if core cannot start) - Already running: keep async restart for responsive create/update - smoke-runtime: brief poll for mihomo/status.running fix(mihomo): start core synchronously on first apply; poll in smoke ApplyConfigDeferredRestart returned before Start() when core was down, so smoke (and UI) saw running=false right after creating the first listener. - First start: still synchronous (fail the API if core cannot start) - Already running: keep async restart for responsive create/update - smoke-runtime: brief poll for mihomo/status.running fix(mihomo): start core synchronously on first apply; poll in smoke ApplyConfigDeferredRestart returned before Start() when core was down, so smoke (and UI) saw running=false right after creating the first listener. - First start: still synchronous (fail the API if core cannot start) - Already running: keep async restart for responsive create/update - smoke-runtime: brief poll for mihomo/status.running fix(mihomo): start core synchronously on first apply; poll in smoke ApplyConfigDeferredRestart returned before Start() when core was down, so smoke (and UI) saw running=false right after creating the first listener. - First start: still synchronous (fail the API if core cannot start) - Already running: keep async restart for responsive create/update - smoke-runtime: brief poll for mihomo/status.running |
||
|
Z User
|
09fd9d0069 |
docs: 18 language READMEs; main README language hub; 3m-ui menu CN/EN only
- Add README.<lang>.md for en, zh-CN, zh-TW, ja, ko, es, fr, de, ru, pt-BR, vi, id, th, tr, ar, hi, pl, uk - Main README: language switcher + docs/site links; English body moved to README.en.md - Management menu bilingual Chinese|English only (no extra locales in shell) docs: 18 language READMEs; main README language hub; 3m-ui menu CN/EN only - Add README.<lang>.md for en, zh-CN, zh-TW, ja, ko, es, fr, de, ru, pt-BR, vi, id, th, tr, ar, hi, pl, uk - Main README: language switcher + docs/site links; English body moved to README.en.md - Management menu bilingual Chinese|English only (no extra locales in shell) docs: 18 language READMEs; main README language hub; 3m-ui menu CN/EN only - Add README.<lang>.md for en, zh-CN, zh-TW, ja, ko, es, fr, de, ru, pt-BR, vi, id, th, tr, ar, hi, pl, uk - Main README: language switcher + docs/site links; English body moved to README.en.md - Management menu bilingual Chinese|English only (no extra locales in shell) docs: 18 language READMEs; main README language hub; 3m-ui menu CN/EN only - Add README.<lang>.md for en, zh-CN, zh-TW, ja, ko, es, fr, de, ru, pt-BR, vi, id, th, tr, ar, hi, pl, uk - Main README: language switcher + docs/site links; English body moved to README.en.md - Management menu bilingual Chinese|English only (no extra locales in shell) docs: 18 language READMEs; main README language hub; 3m-ui menu CN/EN only - Add README.<lang>.md for en, zh-CN, zh-TW, ja, ko, es, fr, de, ru, pt-BR, vi, id, th, tr, ar, hi, pl, uk - Main README: language switcher + docs/site links; English body moved to README.en.md - Management menu bilingual Chinese|English only (no extra locales in shell) docs: 18 language READMEs; main README language hub; 3m-ui menu CN/EN only - Add README.<lang>.md for en, zh-CN, zh-TW, ja, ko, es, fr, de, ru, pt-BR, vi, id, th, tr, ar, hi, pl, uk - Main README: language switcher + docs/site links; English body moved to README.en.md - Management menu bilingual Chinese|English only (no extra locales in shell) docs: 18 language READMEs; main README language hub; 3m-ui menu CN/EN only - Add README.<lang>.md for en, zh-CN, zh-TW, ja, ko, es, fr, de, ru, pt-BR, vi, id, th, tr, ar, hi, pl, uk - Main README: language switcher + docs/site links; English body moved to README.en.md - Management menu bilingual Chinese|English only (no extra locales in shell) docs: 18 language READMEs; main README language hub; 3m-ui menu CN/EN only - Add README.<lang>.md for en, zh-CN, zh-TW, ja, ko, es, fr, de, ru, pt-BR, vi, id, th, tr, ar, hi, pl, uk - Main README: language switcher + docs/site links; English body moved to README.en.md - Management menu bilingual Chinese|English only (no extra locales in shell) docs: 18 language READMEs; main README language hub; 3m-ui menu CN/EN only - Add README.<lang>.md for en, zh-CN, zh-TW, ja, ko, es, fr, de, ru, pt-BR, vi, id, th, tr, ar, hi, pl, uk - Main README: language switcher + docs/site links; English body moved to README.en.md - Management menu bilingual Chinese|English only (no extra locales in shell) docs: 18 language READMEs; main README language hub; 3m-ui menu CN/EN only - Add README.<lang>.md for en, zh-CN, zh-TW, ja, ko, es, fr, de, ru, pt-BR, vi, id, th, tr, ar, hi, pl, uk - Main README: language switcher + docs/site links; English body moved to README.en.md - Management menu bilingual Chinese|English only (no extra locales in shell) docs: 18 language READMEs; main README language hub; 3m-ui menu CN/EN only - Add README.<lang>.md for en, zh-CN, zh-TW, ja, ko, es, fr, de, ru, pt-BR, vi, id, th, tr, ar, hi, pl, uk - Main README: language switcher + docs/site links; English body moved to README.en.md - Management menu bilingual Chinese|English only (no extra locales in shell) docs: 18 language READMEs; main README language hub; 3m-ui menu CN/EN only - Add README.<lang>.md for en, zh-CN, zh-TW, ja, ko, es, fr, de, ru, pt-BR, vi, id, th, tr, ar, hi, pl, uk - Main README: language switcher + docs/site links; English body moved to README.en.md - Management menu bilingual Chinese|English only (no extra locales in shell) |
||
|
freephilx
|
2e6256fb6a |
feat(distribution): add complete installation and recovery workflows
Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. feat(distribution): add complete installation and recovery workflows Ship stable-only Linux bundles and multiarch Docker images with a pinned Mihomo core. Share secure first-run initialization across native and container installs. Validate downloads before downtime, snapshot persistent state before updates, and restore the previous installation after a failed upgrade. Add backup, restore, healthcheck, and randomized administrator reset commands. Add release verification, lifecycle regression tests, and installation documentation. |
||
|
Z User
|
db08c0745c |
fix(scripts): quiet Mihomo download; try asset name variants; stable tag for mihomo
The curl 404 during 3m-ui update was optional Mihomo core refresh (wrong/pre tag or missing -compatible asset). Panel update already succeeded. fix(scripts): quiet Mihomo download; try asset name variants; stable tag for mihomo The curl 404 during 3m-ui update was optional Mihomo core refresh (wrong/pre tag or missing -compatible asset). Panel update already succeeded. fix(scripts): quiet Mihomo download; try asset name variants; stable tag for mihomo The curl 404 during 3m-ui update was optional Mihomo core refresh (wrong/pre tag or missing -compatible asset). Panel update already succeeded. fix(scripts): quiet Mihomo download; try asset name variants; stable tag for mihomo The curl 404 during 3m-ui update was optional Mihomo core refresh (wrong/pre tag or missing -compatible asset). Panel update already succeeded. fix(scripts): quiet Mihomo download; try asset name variants; stable tag for mihomo The curl 404 during 3m-ui update was optional Mihomo core refresh (wrong/pre tag or missing -compatible asset). Panel update already succeeded. fix(scripts): quiet Mihomo download; try asset name variants; stable tag for mihomo The curl 404 during 3m-ui update was optional Mihomo core refresh (wrong/pre tag or missing -compatible asset). Panel update already succeeded. fix(scripts): quiet Mihomo download; try asset name variants; stable tag for mihomo The curl 404 during 3m-ui update was optional Mihomo core refresh (wrong/pre tag or missing -compatible asset). Panel update already succeeded. fix(scripts): quiet Mihomo download; try asset name variants; stable tag for mihomo The curl 404 during 3m-ui update was optional Mihomo core refresh (wrong/pre tag or missing -compatible asset). Panel update already succeeded. fix(scripts): quiet Mihomo download; try asset name variants; stable tag for mihomo The curl 404 during 3m-ui update was optional Mihomo core refresh (wrong/pre tag or missing -compatible asset). Panel update already succeeded. fix(scripts): quiet Mihomo download; try asset name variants; stable tag for mihomo The curl 404 during 3m-ui update was optional Mihomo core refresh (wrong/pre tag or missing -compatible asset). Panel update already succeeded. fix(scripts): quiet Mihomo download; try asset name variants; stable tag for mihomo The curl 404 during 3m-ui update was optional Mihomo core refresh (wrong/pre tag or missing -compatible asset). Panel update already succeeded. fix(scripts): quiet Mihomo download; try asset name variants; stable tag for mihomo The curl 404 during 3m-ui update was optional Mihomo core refresh (wrong/pre tag or missing -compatible asset). Panel update already succeeded. |
||
|
Z User
|
b7f0389353 |
ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates)
ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) ci(test): single rolling Pre-release tag 'pre' (overwrite, no duplicates) |
||
|
Z User
|
04865db275 | feat(test): PWA manifest; update.sh HTTP health probe before success | ||
|
Z User
|
db96350bd8 | fix(scripts): clean version argument case pattern | ||
|
Z User
|
8086e729c0 | fix(scripts): dedupe version arg pattern after test-* support | ||
|
Z User
|
f4bb43ecd3 |
ci(test): publish Pre-releases; install/update prefer newest prerelease
ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease ci(test): publish Pre-releases; install/update prefer newest prerelease |
||
|
Z User
|
70e9b0c423 | fix(cli): support 3m-ui update|install|uninstall; embed logo in README | ||
|
Z User
|
1f484b8c06 |
feat(p1-p3): safe config publish, batch user ops, cluster push, update harden, settings icons
- Config: generate no longer applies; Apply accepts editor YAML; Rollback UI - Users batch: extend-days and add-traffic (GiB) - Cluster: POST push-node with dry-run then create disabled on remote - Install: NONINTERACTIVE result file; update: longer health poll, strip more seccomp - Settings sidebar icons softer/outlined set feat(p1-p3): safe config publish, batch user ops, cluster push, update harden, settings icons - Config: generate no longer applies; Apply accepts editor YAML; Rollback UI - Users batch: extend-days and add-traffic (GiB) - Cluster: POST push-node with dry-run then create disabled on remote - Install: NONINTERACTIVE result file; update: longer health poll, strip more seccomp - Settings sidebar icons softer/outlined set feat(p1-p3): safe config publish, batch user ops, cluster push, update harden, settings icons - Config: generate no longer applies; Apply accepts editor YAML; Rollback UI - Users batch: extend-days and add-traffic (GiB) - Cluster: POST push-node with dry-run then create disabled on remote - Install: NONINTERACTIVE result file; update: longer health poll, strip more seccomp - Settings sidebar icons softer/outlined set feat(p1-p3): safe config publish, batch user ops, cluster push, update harden, settings icons - Config: generate no longer applies; Apply accepts editor YAML; Rollback UI - Users batch: extend-days and add-traffic (GiB) - Cluster: POST push-node with dry-run then create disabled on remote - Install: NONINTERACTIVE result file; update: longer health poll, strip more seccomp - Settings sidebar icons softer/outlined set feat(p1-p3): safe config publish, batch user ops, cluster push, update harden, settings icons - Config: generate no longer applies; Apply accepts editor YAML; Rollback UI - Users batch: extend-days and add-traffic (GiB) - Cluster: POST push-node with dry-run then create disabled on remote - Install: NONINTERACTIVE result file; update: longer health poll, strip more seccomp - Settings sidebar icons softer/outlined set feat(p1-p3): safe config publish, batch user ops, cluster push, update harden, settings icons - Config: generate no longer applies; Apply accepts editor YAML; Rollback UI - Users batch: extend-days and add-traffic (GiB) - Cluster: POST push-node with dry-run then create disabled on remote - Install: NONINTERACTIVE result file; update: longer health poll, strip more seccomp - Settings sidebar icons softer/outlined set feat(p1-p3): safe config publish, batch user ops, cluster push, update harden, settings icons - Config: generate no longer applies; Apply accepts editor YAML; Rollback UI - Users batch: extend-days and add-traffic (GiB) - Cluster: POST push-node with dry-run then create disabled on remote - Install: NONINTERACTIVE result file; update: longer health poll, strip more seccomp - Settings sidebar icons softer/outlined set feat(p1-p3): safe config publish, batch user ops, cluster push, update harden, settings icons - Config: generate no longer applies; Apply accepts editor YAML; Rollback UI - Users batch: extend-days and add-traffic (GiB) - Cluster: POST push-node with dry-run then create disabled on remote - Install: NONINTERACTIVE result file; update: longer health poll, strip more seccomp - Settings sidebar icons softer/outlined set feat(p1-p3): safe config publish, batch user ops, cluster push, update harden, settings icons - Config: generate no longer applies; Apply accepts editor YAML; Rollback UI - Users batch: extend-days and add-traffic (GiB) - Cluster: POST push-node with dry-run then create disabled on remote - Install: NONINTERACTIVE result file; update: longer health poll, strip more seccomp - Settings sidebar icons softer/outlined set feat(p1-p3): safe config publish, batch user ops, cluster push, update harden, settings icons - Config: generate no longer applies; Apply accepts editor YAML; Rollback UI - Users batch: extend-days and add-traffic (GiB) - Cluster: POST push-node with dry-run then create disabled on remote - Install: NONINTERACTIVE result file; update: longer health poll, strip more seccomp - Settings sidebar icons softer/outlined set feat(p1-p3): safe config publish, batch user ops, cluster push, update harden, settings icons - Config: generate no longer applies; Apply accepts editor YAML; Rollback UI - Users batch: extend-days and add-traffic (GiB) - Cluster: POST push-node with dry-run then create disabled on remote - Install: NONINTERACTIVE result file; update: longer health poll, strip more seccomp - Settings sidebar icons softer/outlined set feat(p1-p3): safe config publish, batch user ops, cluster push, update harden, settings icons - Config: generate no longer applies; Apply accepts editor YAML; Rollback UI - Users batch: extend-days and add-traffic (GiB) - Cluster: POST push-node with dry-run then create disabled on remote - Install: NONINTERACTIVE result file; update: longer health poll, strip more seccomp - Settings sidebar icons softer/outlined set |
||
|
Z User
|
6102d9cf55 | fix(systemd): drop SystemCallFilter causing SIGSYS (status=31) on pure-Go binary | ||
|
Z User
|
c6e33de929 |
fix(update,tls): wait for service health; hydrate certs on boot without re-save
- update.sh: poll up to 15s before rollback (fixes false failure after binary update) - On startup, restore listener PEMs from /var/lib/3m-ui/listener-certs and fall back to names in existing mihomo config.yaml into DB before generate fix(update,tls): wait for service health; hydrate certs on boot without re-save - update.sh: poll up to 15s before rollback (fixes false failure after binary update) - On startup, restore listener PEMs from /var/lib/3m-ui/listener-certs and fall back to names in existing mihomo config.yaml into DB before generate fix(update,tls): wait for service health; hydrate certs on boot without re-save - update.sh: poll up to 15s before rollback (fixes false failure after binary update) - On startup, restore listener PEMs from /var/lib/3m-ui/listener-certs and fall back to names in existing mihomo config.yaml into DB before generate fix(update,tls): wait for service health; hydrate certs on boot without re-save - update.sh: poll up to 15s before rollback (fixes false failure after binary update) - On startup, restore listener PEMs from /var/lib/3m-ui/listener-certs and fall back to names in existing mihomo config.yaml into DB before generate fix(update,tls): wait for service health; hydrate certs on boot without re-save - update.sh: poll up to 15s before rollback (fixes false failure after binary update) - On startup, restore listener PEMs from /var/lib/3m-ui/listener-certs and fall back to names in existing mihomo config.yaml into DB before generate fix(update,tls): wait for service health; hydrate certs on boot without re-save - update.sh: poll up to 15s before rollback (fixes false failure after binary update) - On startup, restore listener PEMs from /var/lib/3m-ui/listener-certs and fall back to names in existing mihomo config.yaml into DB before generate fix(update,tls): wait for service health; hydrate certs on boot without re-save - update.sh: poll up to 15s before rollback (fixes false failure after binary update) - On startup, restore listener PEMs from /var/lib/3m-ui/listener-certs and fall back to names in existing mihomo config.yaml into DB before generate fix(update,tls): wait for service health; hydrate certs on boot without re-save - update.sh: poll up to 15s before rollback (fixes false failure after binary update) - On startup, restore listener PEMs from /var/lib/3m-ui/listener-certs and fall back to names in existing mihomo config.yaml into DB before generate fix(update,tls): wait for service health; hydrate certs on boot without re-save - update.sh: poll up to 15s before rollback (fixes false failure after binary update) - On startup, restore listener PEMs from /var/lib/3m-ui/listener-certs and fall back to names in existing mihomo config.yaml into DB before generate fix(update,tls): wait for service health; hydrate certs on boot without re-save - update.sh: poll up to 15s before rollback (fixes false failure after binary update) - On startup, restore listener PEMs from /var/lib/3m-ui/listener-certs and fall back to names in existing mihomo config.yaml into DB before generate fix(update,tls): wait for service health; hydrate certs on boot without re-save - update.sh: poll up to 15s before rollback (fixes false failure after binary update) - On startup, restore listener PEMs from /var/lib/3m-ui/listener-certs and fall back to names in existing mihomo config.yaml into DB before generate fix(update,tls): wait for service health; hydrate certs on boot without re-save - update.sh: poll up to 15s before rollback (fixes false failure after binary update) - On startup, restore listener PEMs from /var/lib/3m-ui/listener-certs and fall back to names in existing mihomo config.yaml into DB before generate |
||
|
Z User
|
b30de84bec | fix: import Alert in Settings; keep 3m-ui menu after child scripts; idempotent BBR | ||
|
Z User
|
286873b128 |
feat(ops+sub): Phase A/B install menu, admin reset CLI, UA/sub UX
- Keep initial admin password as admin (no random password) - Install summary prints local/public panel URLs - Management menu: show URL, reset-admin to admin, BBR, geo update, public_url - Binary: reset-admin command - Expand subscription User-Agent auto-detect; frontend hints + user status filters feat(ops+sub): Phase A/B install menu, admin reset CLI, UA/sub UX - Keep initial admin password as admin (no random password) - Install summary prints local/public panel URLs - Management menu: show URL, reset-admin to admin, BBR, geo update, public_url - Binary: reset-admin command - Expand subscription User-Agent auto-detect; frontend hints + user status filters feat(ops+sub): Phase A/B install menu, admin reset CLI, UA/sub UX - Keep initial admin password as admin (no random password) - Install summary prints local/public panel URLs - Management menu: show URL, reset-admin to admin, BBR, geo update, public_url - Binary: reset-admin command - Expand subscription User-Agent auto-detect; frontend hints + user status filters feat(ops+sub): Phase A/B install menu, admin reset CLI, UA/sub UX - Keep initial admin password as admin (no random password) - Install summary prints local/public panel URLs - Management menu: show URL, reset-admin to admin, BBR, geo update, public_url - Binary: reset-admin command - Expand subscription User-Agent auto-detect; frontend hints + user status filters feat(ops+sub): Phase A/B install menu, admin reset CLI, UA/sub UX - Keep initial admin password as admin (no random password) - Install summary prints local/public panel URLs - Management menu: show URL, reset-admin to admin, BBR, geo update, public_url - Binary: reset-admin command - Expand subscription User-Agent auto-detect; frontend hints + user status filters feat(ops+sub): Phase A/B install menu, admin reset CLI, UA/sub UX - Keep initial admin password as admin (no random password) - Install summary prints local/public panel URLs - Management menu: show URL, reset-admin to admin, BBR, geo update, public_url - Binary: reset-admin command - Expand subscription User-Agent auto-detect; frontend hints + user status filters feat(ops+sub): Phase A/B install menu, admin reset CLI, UA/sub UX - Keep initial admin password as admin (no random password) - Install summary prints local/public panel URLs - Management menu: show URL, reset-admin to admin, BBR, geo update, public_url - Binary: reset-admin command - Expand subscription User-Agent auto-detect; frontend hints + user status filters feat(ops+sub): Phase A/B install menu, admin reset CLI, UA/sub UX - Keep initial admin password as admin (no random password) - Install summary prints local/public panel URLs - Management menu: show URL, reset-admin to admin, BBR, geo update, public_url - Binary: reset-admin command - Expand subscription User-Agent auto-detect; frontend hints + user status filters feat(ops+sub): Phase A/B install menu, admin reset CLI, UA/sub UX - Keep initial admin password as admin (no random password) - Install summary prints local/public panel URLs - Management menu: show URL, reset-admin to admin, BBR, geo update, public_url - Binary: reset-admin command - Expand subscription User-Agent auto-detect; frontend hints + user status filters feat(ops+sub): Phase A/B install menu, admin reset CLI, UA/sub UX - Keep initial admin password as admin (no random password) - Install summary prints local/public panel URLs - Management menu: show URL, reset-admin to admin, BBR, geo update, public_url - Binary: reset-admin command - Expand subscription User-Agent auto-detect; frontend hints + user status filters feat(ops+sub): Phase A/B install menu, admin reset CLI, UA/sub UX - Keep initial admin password as admin (no random password) - Install summary prints local/public panel URLs - Management menu: show URL, reset-admin to admin, BBR, geo update, public_url - Binary: reset-admin command - Expand subscription User-Agent auto-detect; frontend hints + user status filters feat(ops+sub): Phase A/B install menu, admin reset CLI, UA/sub UX - Keep initial admin password as admin (no random password) - Install summary prints local/public panel URLs - Management menu: show URL, reset-admin to admin, BBR, geo update, public_url - Binary: reset-admin command - Expand subscription User-Agent auto-detect; frontend hints + user status filters |
||
|
Z User
|
d6e64ab313 |
chore(release): set version to v1.0.0
Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. chore(release): set version to v1.0.0 Align Makefile, embedded default, frontend package, and script help text with the first stable release tag. |
||
|
Z User
|
7addcdc5c7 |
fix(non-listener): enforcement retry, DB restore warning, security headers, config placeholder, sensitive key gaps, dead UI options, bot API server, update.sh dedup
Non-listener comprehensive audit found 4 Medium + 4 Low issues. All fixed. VLESS+REALITY and listener schema untouched. == Medium == M-NEW-C1: Enforcement doesn't retry failed config regen traffic/enforcement.go CheckAndEnforce updated lastBlocked BEFORE calling RegenerateConfig. If regen failed, lastBlocked was already set, so next tick saw no change and never retried — over-quota users stayed connected. Fix: update lastBlocked only after successful regen; preserve old state on failure for retry. M-NEW-C2: DB restore orphans running process's SQLite handle system/api.go RestoreDatabase renames the DB file, but the running panel keeps writing to the old (unlinked) inode. Added prominent [WARNING] log + restart_required:true + *** RESTART REQUIRED *** message in response. In-place GORM reconnect not feasible; restart is the correct approach. M-NEW-G1: Backend doesn't send CSP/security HTTP headers CSP was only in index.html meta tag. Added SecurityHeaders() middleware setting X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, X-XSS-Protection: 1; mode=block on all responses. CSP NOT set on API responses (meta CSP handles the SPA shell). M-NEW-A1: Default config.yaml has placeholder secrets backend/config/config.yaml contained DefaultJWTSecret and DefaultCredentialKey (rejected by Validate → startup failure for developers). Replaced with CHANGE_ME placeholders + comments explaining use install.sh or openssl rand -hex 32. == Low == L-NEW-B1: isSensitiveSettingKey heuristic gaps panel_settings.go blocklist missing 'key' and 'auth' substrings. Added (api deliberately excluded — too broad). L-NEW-D1: enabled_events UI has dead options Settings.tsx Select included node_down/node_up/block/unblock which have no backend effect. Removed. Kept only implemented events: login/cpu/memory/crash/expiry/traffic. L-NEW-D3: Bot loop hardcodes api.telegram.org bot.go getUpdates/deleteWebhook hardcoded the official Telegram API URL. Now takes apiBase parameter; loop() passes tgClient.apiBase() so custom api_server setting is respected for long-polling. L-NEW-H1: update.sh duplicate CONFIG_DIR Line 11-12 had CONFIG_DIR defined twice. Removed duplicate. == Verification == - go build ./... : PASS - go vet ./... : PASS - go test ./... : 16 packages all PASS - npm run build : PASS - gofmt : clean - sh -n update.sh : OK fix(non-listener): enforcement retry, DB restore warning, security headers, config placeholder, sensitive key gaps, dead UI options, bot API server, update.sh dedup Non-listener comprehensive audit found 4 Medium + 4 Low issues. All fixed. VLESS+REALITY and listener schema untouched. == Medium == M-NEW-C1: Enforcement doesn't retry failed config regen traffic/enforcement.go CheckAndEnforce updated lastBlocked BEFORE calling RegenerateConfig. If regen failed, lastBlocked was already set, so next tick saw no change and never retried — over-quota users stayed connected. Fix: update lastBlocked only after successful regen; preserve old state on failure for retry. M-NEW-C2: DB restore orphans running process's SQLite handle system/api.go RestoreDatabase renames the DB file, but the running panel keeps writing to the old (unlinked) inode. Added prominent [WARNING] log + restart_required:true + *** RESTART REQUIRED *** message in response. In-place GORM reconnect not feasible; restart is the correct approach. M-NEW-G1: Backend doesn't send CSP/security HTTP headers CSP was only in index.html meta tag. Added SecurityHeaders() middleware setting X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, X-XSS-Protection: 1; mode=block on all responses. CSP NOT set on API responses (meta CSP handles the SPA shell). M-NEW-A1: Default config.yaml has placeholder secrets backend/config/config.yaml contained DefaultJWTSecret and DefaultCredentialKey (rejected by Validate → startup failure for developers). Replaced with CHANGE_ME placeholders + comments explaining use install.sh or openssl rand -hex 32. == Low == L-NEW-B1: isSensitiveSettingKey heuristic gaps panel_settings.go blocklist missing 'key' and 'auth' substrings. Added (api deliberately excluded — too broad). L-NEW-D1: enabled_events UI has dead options Settings.tsx Select included node_down/node_up/block/unblock which have no backend effect. Removed. Kept only implemented events: login/cpu/memory/crash/expiry/traffic. L-NEW-D3: Bot loop hardcodes api.telegram.org bot.go getUpdates/deleteWebhook hardcoded the official Telegram API URL. Now takes apiBase parameter; loop() passes tgClient.apiBase() so custom api_server setting is respected for long-polling. L-NEW-H1: update.sh duplicate CONFIG_DIR Line 11-12 had CONFIG_DIR defined twice. Removed duplicate. == Verification == - go build ./... : PASS - go vet ./... : PASS - go test ./... : 16 packages all PASS - npm run build : PASS - gofmt : clean - sh -n update.sh : OK fix(non-listener): enforcement retry, DB restore warning, security headers, config placeholder, sensitive key gaps, dead UI options, bot API server, update.sh dedup Non-listener comprehensive audit found 4 Medium + 4 Low issues. All fixed. VLESS+REALITY and listener schema untouched. == Medium == M-NEW-C1: Enforcement doesn't retry failed config regen traffic/enforcement.go CheckAndEnforce updated lastBlocked BEFORE calling RegenerateConfig. If regen failed, lastBlocked was already set, so next tick saw no change and never retried — over-quota users stayed connected. Fix: update lastBlocked only after successful regen; preserve old state on failure for retry. M-NEW-C2: DB restore orphans running process's SQLite handle system/api.go RestoreDatabase renames the DB file, but the running panel keeps writing to the old (unlinked) inode. Added prominent [WARNING] log + restart_required:true + *** RESTART REQUIRED *** message in response. In-place GORM reconnect not feasible; restart is the correct approach. M-NEW-G1: Backend doesn't send CSP/security HTTP headers CSP was only in index.html meta tag. Added SecurityHeaders() middleware setting X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, X-XSS-Protection: 1; mode=block on all responses. CSP NOT set on API responses (meta CSP handles the SPA shell). M-NEW-A1: Default config.yaml has placeholder secrets backend/config/config.yaml contained DefaultJWTSecret and DefaultCredentialKey (rejected by Validate → startup failure for developers). Replaced with CHANGE_ME placeholders + comments explaining use install.sh or openssl rand -hex 32. == Low == L-NEW-B1: isSensitiveSettingKey heuristic gaps panel_settings.go blocklist missing 'key' and 'auth' substrings. Added (api deliberately excluded — too broad). L-NEW-D1: enabled_events UI has dead options Settings.tsx Select included node_down/node_up/block/unblock which have no backend effect. Removed. Kept only implemented events: login/cpu/memory/crash/expiry/traffic. L-NEW-D3: Bot loop hardcodes api.telegram.org bot.go getUpdates/deleteWebhook hardcoded the official Telegram API URL. Now takes apiBase parameter; loop() passes tgClient.apiBase() so custom api_server setting is respected for long-polling. L-NEW-H1: update.sh duplicate CONFIG_DIR Line 11-12 had CONFIG_DIR defined twice. Removed duplicate. == Verification == - go build ./... : PASS - go vet ./... : PASS - go test ./... : 16 packages all PASS - npm run build : PASS - gofmt : clean - sh -n update.sh : OK fix(non-listener): enforcement retry, DB restore warning, security headers, config placeholder, sensitive key gaps, dead UI options, bot API server, update.sh dedup Non-listener comprehensive audit found 4 Medium + 4 Low issues. All fixed. VLESS+REALITY and listener schema untouched. == Medium == M-NEW-C1: Enforcement doesn't retry failed config regen traffic/enforcement.go CheckAndEnforce updated lastBlocked BEFORE calling RegenerateConfig. If regen failed, lastBlocked was already set, so next tick saw no change and never retried — over-quota users stayed connected. Fix: update lastBlocked only after successful regen; preserve old state on failure for retry. M-NEW-C2: DB restore orphans running process's SQLite handle system/api.go RestoreDatabase renames the DB file, but the running panel keeps writing to the old (unlinked) inode. Added prominent [WARNING] log + restart_required:true + *** RESTART REQUIRED *** message in response. In-place GORM reconnect not feasible; restart is the correct approach. M-NEW-G1: Backend doesn't send CSP/security HTTP headers CSP was only in index.html meta tag. Added SecurityHeaders() middleware setting X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, X-XSS-Protection: 1; mode=block on all responses. CSP NOT set on API responses (meta CSP handles the SPA shell). M-NEW-A1: Default config.yaml has placeholder secrets backend/config/config.yaml contained DefaultJWTSecret and DefaultCredentialKey (rejected by Validate → startup failure for developers). Replaced with CHANGE_ME placeholders + comments explaining use install.sh or openssl rand -hex 32. == Low == L-NEW-B1: isSensitiveSettingKey heuristic gaps panel_settings.go blocklist missing 'key' and 'auth' substrings. Added (api deliberately excluded — too broad). L-NEW-D1: enabled_events UI has dead options Settings.tsx Select included node_down/node_up/block/unblock which have no backend effect. Removed. Kept only implemented events: login/cpu/memory/crash/expiry/traffic. L-NEW-D3: Bot loop hardcodes api.telegram.org bot.go getUpdates/deleteWebhook hardcoded the official Telegram API URL. Now takes apiBase parameter; loop() passes tgClient.apiBase() so custom api_server setting is respected for long-polling. L-NEW-H1: update.sh duplicate CONFIG_DIR Line 11-12 had CONFIG_DIR defined twice. Removed duplicate. == Verification == - go build ./... : PASS - go vet ./... : PASS - go test ./... : 16 packages all PASS - npm run build : PASS - gofmt : clean - sh -n update.sh : OK fix(non-listener): enforcement retry, DB restore warning, security headers, config placeholder, sensitive key gaps, dead UI options, bot API server, update.sh dedup Non-listener comprehensive audit found 4 Medium + 4 Low issues. All fixed. VLESS+REALITY and listener schema untouched. == Medium == M-NEW-C1: Enforcement doesn't retry failed config regen traffic/enforcement.go CheckAndEnforce updated lastBlocked BEFORE calling RegenerateConfig. If regen failed, lastBlocked was already set, so next tick saw no change and never retried — over-quota users stayed connected. Fix: update lastBlocked only after successful regen; preserve old state on failure for retry. M-NEW-C2: DB restore orphans running process's SQLite handle system/api.go RestoreDatabase renames the DB file, but the running panel keeps writing to the old (unlinked) inode. Added prominent [WARNING] log + restart_required:true + *** RESTART REQUIRED *** message in response. In-place GORM reconnect not feasible; restart is the correct approach. M-NEW-G1: Backend doesn't send CSP/security HTTP headers CSP was only in index.html meta tag. Added SecurityHeaders() middleware setting X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, X-XSS-Protection: 1; mode=block on all responses. CSP NOT set on API responses (meta CSP handles the SPA shell). M-NEW-A1: Default config.yaml has placeholder secrets backend/config/config.yaml contained DefaultJWTSecret and DefaultCredentialKey (rejected by Validate → startup failure for developers). Replaced with CHANGE_ME placeholders + comments explaining use install.sh or openssl rand -hex 32. == Low == L-NEW-B1: isSensitiveSettingKey heuristic gaps panel_settings.go blocklist missing 'key' and 'auth' substrings. Added (api deliberately excluded — too broad). L-NEW-D1: enabled_events UI has dead options Settings.tsx Select included node_down/node_up/block/unblock which have no backend effect. Removed. Kept only implemented events: login/cpu/memory/crash/expiry/traffic. L-NEW-D3: Bot loop hardcodes api.telegram.org bot.go getUpdates/deleteWebhook hardcoded the official Telegram API URL. Now takes apiBase parameter; loop() passes tgClient.apiBase() so custom api_server setting is respected for long-polling. L-NEW-H1: update.sh duplicate CONFIG_DIR Line 11-12 had CONFIG_DIR defined twice. Removed duplicate. == Verification == - go build ./... : PASS - go vet ./... : PASS - go test ./... : 16 packages all PASS - npm run build : PASS - gofmt : clean - sh -n update.sh : OK fix(non-listener): enforcement retry, DB restore warning, security headers, config placeholder, sensitive key gaps, dead UI options, bot API server, update.sh dedup Non-listener comprehensive audit found 4 Medium + 4 Low issues. All fixed. VLESS+REALITY and listener schema untouched. == Medium == M-NEW-C1: Enforcement doesn't retry failed config regen traffic/enforcement.go CheckAndEnforce updated lastBlocked BEFORE calling RegenerateConfig. If regen failed, lastBlocked was already set, so next tick saw no change and never retried — over-quota users stayed connected. Fix: update lastBlocked only after successful regen; preserve old state on failure for retry. M-NEW-C2: DB restore orphans running process's SQLite handle system/api.go RestoreDatabase renames the DB file, but the running panel keeps writing to the old (unlinked) inode. Added prominent [WARNING] log + restart_required:true + *** RESTART REQUIRED *** message in response. In-place GORM reconnect not feasible; restart is the correct approach. M-NEW-G1: Backend doesn't send CSP/security HTTP headers CSP was only in index.html meta tag. Added SecurityHeaders() middleware setting X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, X-XSS-Protection: 1; mode=block on all responses. CSP NOT set on API responses (meta CSP handles the SPA shell). M-NEW-A1: Default config.yaml has placeholder secrets backend/config/config.yaml contained DefaultJWTSecret and DefaultCredentialKey (rejected by Validate → startup failure for developers). Replaced with CHANGE_ME placeholders + comments explaining use install.sh or openssl rand -hex 32. == Low == L-NEW-B1: isSensitiveSettingKey heuristic gaps panel_settings.go blocklist missing 'key' and 'auth' substrings. Added (api deliberately excluded — too broad). L-NEW-D1: enabled_events UI has dead options Settings.tsx Select included node_down/node_up/block/unblock which have no backend effect. Removed. Kept only implemented events: login/cpu/memory/crash/expiry/traffic. L-NEW-D3: Bot loop hardcodes api.telegram.org bot.go getUpdates/deleteWebhook hardcoded the official Telegram API URL. Now takes apiBase parameter; loop() passes tgClient.apiBase() so custom api_server setting is respected for long-polling. L-NEW-H1: update.sh duplicate CONFIG_DIR Line 11-12 had CONFIG_DIR defined twice. Removed duplicate. == Verification == - go build ./... : PASS - go vet ./... : PASS - go test ./... : 16 packages all PASS - npm run build : PASS - gofmt : clean - sh -n update.sh : OK fix(non-listener): enforcement retry, DB restore warning, security headers, config placeholder, sensitive key gaps, dead UI options, bot API server, update.sh dedup Non-listener comprehensive audit found 4 Medium + 4 Low issues. All fixed. VLESS+REALITY and listener schema untouched. == Medium == M-NEW-C1: Enforcement doesn't retry failed config regen traffic/enforcement.go CheckAndEnforce updated lastBlocked BEFORE calling RegenerateConfig. If regen failed, lastBlocked was already set, so next tick saw no change and never retried — over-quota users stayed connected. Fix: update lastBlocked only after successful regen; preserve old state on failure for retry. M-NEW-C2: DB restore orphans running process's SQLite handle system/api.go RestoreDatabase renames the DB file, but the running panel keeps writing to the old (unlinked) inode. Added prominent [WARNING] log + restart_required:true + *** RESTART REQUIRED *** message in response. In-place GORM reconnect not feasible; restart is the correct approach. M-NEW-G1: Backend doesn't send CSP/security HTTP headers CSP was only in index.html meta tag. Added SecurityHeaders() middleware setting X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, X-XSS-Protection: 1; mode=block on all responses. CSP NOT set on API responses (meta CSP handles the SPA shell). M-NEW-A1: Default config.yaml has placeholder secrets backend/config/config.yaml contained DefaultJWTSecret and DefaultCredentialKey (rejected by Validate → startup failure for developers). Replaced with CHANGE_ME placeholders + comments explaining use install.sh or openssl rand -hex 32. == Low == L-NEW-B1: isSensitiveSettingKey heuristic gaps panel_settings.go blocklist missing 'key' and 'auth' substrings. Added (api deliberately excluded — too broad). L-NEW-D1: enabled_events UI has dead options Settings.tsx Select included node_down/node_up/block/unblock which have no backend effect. Removed. Kept only implemented events: login/cpu/memory/crash/expiry/traffic. L-NEW-D3: Bot loop hardcodes api.telegram.org bot.go getUpdates/deleteWebhook hardcoded the official Telegram API URL. Now takes apiBase parameter; loop() passes tgClient.apiBase() so custom api_server setting is respected for long-polling. L-NEW-H1: update.sh duplicate CONFIG_DIR Line 11-12 had CONFIG_DIR defined twice. Removed duplicate. == Verification == - go build ./... : PASS - go vet ./... : PASS - go test ./... : 16 packages all PASS - npm run build : PASS - gofmt : clean - sh -n update.sh : OK fix(non-listener): enforcement retry, DB restore warning, security headers, config placeholder, sensitive key gaps, dead UI options, bot API server, update.sh dedup Non-listener comprehensive audit found 4 Medium + 4 Low issues. All fixed. VLESS+REALITY and listener schema untouched. == Medium == M-NEW-C1: Enforcement doesn't retry failed config regen traffic/enforcement.go CheckAndEnforce updated lastBlocked BEFORE calling RegenerateConfig. If regen failed, lastBlocked was already set, so next tick saw no change and never retried — over-quota users stayed connected. Fix: update lastBlocked only after successful regen; preserve old state on failure for retry. M-NEW-C2: DB restore orphans running process's SQLite handle system/api.go RestoreDatabase renames the DB file, but the running panel keeps writing to the old (unlinked) inode. Added prominent [WARNING] log + restart_required:true + *** RESTART REQUIRED *** message in response. In-place GORM reconnect not feasible; restart is the correct approach. M-NEW-G1: Backend doesn't send CSP/security HTTP headers CSP was only in index.html meta tag. Added SecurityHeaders() middleware setting X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, X-XSS-Protection: 1; mode=block on all responses. CSP NOT set on API responses (meta CSP handles the SPA shell). M-NEW-A1: Default config.yaml has placeholder secrets backend/config/config.yaml contained DefaultJWTSecret and DefaultCredentialKey (rejected by Validate → startup failure for developers). Replaced with CHANGE_ME placeholders + comments explaining use install.sh or openssl rand -hex 32. == Low == L-NEW-B1: isSensitiveSettingKey heuristic gaps panel_settings.go blocklist missing 'key' and 'auth' substrings. Added (api deliberately excluded — too broad). L-NEW-D1: enabled_events UI has dead options Settings.tsx Select included node_down/node_up/block/unblock which have no backend effect. Removed. Kept only implemented events: login/cpu/memory/crash/expiry/traffic. L-NEW-D3: Bot loop hardcodes api.telegram.org bot.go getUpdates/deleteWebhook hardcoded the official Telegram API URL. Now takes apiBase parameter; loop() passes tgClient.apiBase() so custom api_server setting is respected for long-polling. L-NEW-H1: update.sh duplicate CONFIG_DIR Line 11-12 had CONFIG_DIR defined twice. Removed duplicate. == Verification == - go build ./... : PASS - go vet ./... : PASS - go test ./... : 16 packages all PASS - npm run build : PASS - gofmt : clean - sh -n update.sh : OK fix(non-listener): enforcement retry, DB restore warning, security headers, config placeholder, sensitive key gaps, dead UI options, bot API server, update.sh dedup Non-listener comprehensive audit found 4 Medium + 4 Low issues. All fixed. VLESS+REALITY and listener schema untouched. == Medium == M-NEW-C1: Enforcement doesn't retry failed config regen traffic/enforcement.go CheckAndEnforce updated lastBlocked BEFORE calling RegenerateConfig. If regen failed, lastBlocked was already set, so next tick saw no change and never retried — over-quota users stayed connected. Fix: update lastBlocked only after successful regen; preserve old state on failure for retry. M-NEW-C2: DB restore orphans running process's SQLite handle system/api.go RestoreDatabase renames the DB file, but the running panel keeps writing to the old (unlinked) inode. Added prominent [WARNING] log + restart_required:true + *** RESTART REQUIRED *** message in response. In-place GORM reconnect not feasible; restart is the correct approach. M-NEW-G1: Backend doesn't send CSP/security HTTP headers CSP was only in index.html meta tag. Added SecurityHeaders() middleware setting X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, X-XSS-Protection: 1; mode=block on all responses. CSP NOT set on API responses (meta CSP handles the SPA shell). M-NEW-A1: Default config.yaml has placeholder secrets backend/config/config.yaml contained DefaultJWTSecret and DefaultCredentialKey (rejected by Validate → startup failure for developers). Replaced with CHANGE_ME placeholders + comments explaining use install.sh or openssl rand -hex 32. == Low == L-NEW-B1: isSensitiveSettingKey heuristic gaps panel_settings.go blocklist missing 'key' and 'auth' substrings. Added (api deliberately excluded — too broad). L-NEW-D1: enabled_events UI has dead options Settings.tsx Select included node_down/node_up/block/unblock which have no backend effect. Removed. Kept only implemented events: login/cpu/memory/crash/expiry/traffic. L-NEW-D3: Bot loop hardcodes api.telegram.org bot.go getUpdates/deleteWebhook hardcoded the official Telegram API URL. Now takes apiBase parameter; loop() passes tgClient.apiBase() so custom api_server setting is respected for long-polling. L-NEW-H1: update.sh duplicate CONFIG_DIR Line 11-12 had CONFIG_DIR defined twice. Removed duplicate. == Verification == - go build ./... : PASS - go vet ./... : PASS - go test ./... : 16 packages all PASS - npm run build : PASS - gofmt : clean - sh -n update.sh : OK fix(non-listener): enforcement retry, DB restore warning, security headers, config placeholder, sensitive key gaps, dead UI options, bot API server, update.sh dedup Non-listener comprehensive audit found 4 Medium + 4 Low issues. All fixed. VLESS+REALITY and listener schema untouched. == Medium == M-NEW-C1: Enforcement doesn't retry failed config regen traffic/enforcement.go CheckAndEnforce updated lastBlocked BEFORE calling RegenerateConfig. If regen failed, lastBlocked was already set, so next tick saw no change and never retried — over-quota users stayed connected. Fix: update lastBlocked only after successful regen; preserve old state on failure for retry. M-NEW-C2: DB restore orphans running process's SQLite handle system/api.go RestoreDatabase renames the DB file, but the running panel keeps writing to the old (unlinked) inode. Added prominent [WARNING] log + restart_required:true + *** RESTART REQUIRED *** message in response. In-place GORM reconnect not feasible; restart is the correct approach. M-NEW-G1: Backend doesn't send CSP/security HTTP headers CSP was only in index.html meta tag. Added SecurityHeaders() middleware setting X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, X-XSS-Protection: 1; mode=block on all responses. CSP NOT set on API responses (meta CSP handles the SPA shell). M-NEW-A1: Default config.yaml has placeholder secrets backend/config/config.yaml contained DefaultJWTSecret and DefaultCredentialKey (rejected by Validate → startup failure for developers). Replaced with CHANGE_ME placeholders + comments explaining use install.sh or openssl rand -hex 32. == Low == L-NEW-B1: isSensitiveSettingKey heuristic gaps panel_settings.go blocklist missing 'key' and 'auth' substrings. Added (api deliberately excluded — too broad). L-NEW-D1: enabled_events UI has dead options Settings.tsx Select included node_down/node_up/block/unblock which have no backend effect. Removed. Kept only implemented events: login/cpu/memory/crash/expiry/traffic. L-NEW-D3: Bot loop hardcodes api.telegram.org bot.go getUpdates/deleteWebhook hardcoded the official Telegram API URL. Now takes apiBase parameter; loop() passes tgClient.apiBase() so custom api_server setting is respected for long-polling. L-NEW-H1: update.sh duplicate CONFIG_DIR Line 11-12 had CONFIG_DIR defined twice. Removed duplicate. == Verification == - go build ./... : PASS - go vet ./... : PASS - go test ./... : 16 packages all PASS - npm run build : PASS - gofmt : clean - sh -n update.sh : OK fix(non-listener): enforcement retry, DB restore warning, security headers, config placeholder, sensitive key gaps, dead UI options, bot API server, update.sh dedup Non-listener comprehensive audit found 4 Medium + 4 Low issues. All fixed. VLESS+REALITY and listener schema untouched. == Medium == M-NEW-C1: Enforcement doesn't retry failed config regen traffic/enforcement.go CheckAndEnforce updated lastBlocked BEFORE calling RegenerateConfig. If regen failed, lastBlocked was already set, so next tick saw no change and never retried — over-quota users stayed connected. Fix: update lastBlocked only after successful regen; preserve old state on failure for retry. M-NEW-C2: DB restore orphans running process's SQLite handle system/api.go RestoreDatabase renames the DB file, but the running panel keeps writing to the old (unlinked) inode. Added prominent [WARNING] log + restart_required:true + *** RESTART REQUIRED *** message in response. In-place GORM reconnect not feasible; restart is the correct approach. M-NEW-G1: Backend doesn't send CSP/security HTTP headers CSP was only in index.html meta tag. Added SecurityHeaders() middleware setting X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, X-XSS-Protection: 1; mode=block on all responses. CSP NOT set on API responses (meta CSP handles the SPA shell). M-NEW-A1: Default config.yaml has placeholder secrets backend/config/config.yaml contained DefaultJWTSecret and DefaultCredentialKey (rejected by Validate → startup failure for developers). Replaced with CHANGE_ME placeholders + comments explaining use install.sh or openssl rand -hex 32. == Low == L-NEW-B1: isSensitiveSettingKey heuristic gaps panel_settings.go blocklist missing 'key' and 'auth' substrings. Added (api deliberately excluded — too broad). L-NEW-D1: enabled_events UI has dead options Settings.tsx Select included node_down/node_up/block/unblock which have no backend effect. Removed. Kept only implemented events: login/cpu/memory/crash/expiry/traffic. L-NEW-D3: Bot loop hardcodes api.telegram.org bot.go getUpdates/deleteWebhook hardcoded the official Telegram API URL. Now takes apiBase parameter; loop() passes tgClient.apiBase() so custom api_server setting is respected for long-polling. L-NEW-H1: update.sh duplicate CONFIG_DIR Line 11-12 had CONFIG_DIR defined twice. Removed duplicate. == Verification == - go build ./... : PASS - go vet ./... : PASS - go test ./... : 16 packages all PASS - npm run build : PASS - gofmt : clean - sh -n update.sh : OK fix(non-listener): enforcement retry, DB restore warning, security headers, config placeholder, sensitive key gaps, dead UI options, bot API server, update.sh dedup Non-listener comprehensive audit found 4 Medium + 4 Low issues. All fixed. VLESS+REALITY and listener schema untouched. == Medium == M-NEW-C1: Enforcement doesn't retry failed config regen traffic/enforcement.go CheckAndEnforce updated lastBlocked BEFORE calling RegenerateConfig. If regen failed, lastBlocked was already set, so next tick saw no change and never retried — over-quota users stayed connected. Fix: update lastBlocked only after successful regen; preserve old state on failure for retry. M-NEW-C2: DB restore orphans running process's SQLite handle system/api.go RestoreDatabase renames the DB file, but the running panel keeps writing to the old (unlinked) inode. Added prominent [WARNING] log + restart_required:true + *** RESTART REQUIRED *** message in response. In-place GORM reconnect not feasible; restart is the correct approach. M-NEW-G1: Backend doesn't send CSP/security HTTP headers CSP was only in index.html meta tag. Added SecurityHeaders() middleware setting X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: same-origin, X-XSS-Protection: 1; mode=block on all responses. CSP NOT set on API responses (meta CSP handles the SPA shell). M-NEW-A1: Default config.yaml has placeholder secrets backend/config/config.yaml contained DefaultJWTSecret and DefaultCredentialKey (rejected by Validate → startup failure for developers). Replaced with CHANGE_ME placeholders + comments explaining use install.sh or openssl rand -hex 32. == Low == L-NEW-B1: isSensitiveSettingKey heuristic gaps panel_settings.go blocklist missing 'key' and 'auth' substrings. Added (api deliberately excluded — too broad). L-NEW-D1: enabled_events UI has dead options Settings.tsx Select included node_down/node_up/block/unblock which have no backend effect. Removed. Kept only implemented events: login/cpu/memory/crash/expiry/traffic. L-NEW-D3: Bot loop hardcodes api.telegram.org bot.go getUpdates/deleteWebhook hardcoded the official Telegram API URL. Now takes apiBase parameter; loop() passes tgClient.apiBase() so custom api_server setting is respected for long-polling. L-NEW-H1: update.sh duplicate CONFIG_DIR Line 11-12 had CONFIG_DIR defined twice. Removed duplicate. == Verification == - go build ./... : PASS - go vet ./... : PASS - go test ./... : 16 packages all PASS - npm run build : PASS - gofmt : clean - sh -n update.sh : OK |
||
|
Z User
|
dbec0b3099 |
fix(scripts): install/update/uninstall port handling
Three script-level port UX issues found and fixed: == install.sh: re-install with PANEL_PORT now updates existing config == write_config previously returned early when config.yaml already existed, ignoring PANEL_PORT env var. Re-running 'PANEL_PORT=9000 bash install.sh' on an existing install silently kept the old port. Fix: when config.yaml exists and PANEL_PORT/THREE_M_UI_PORT is explicitly set, sed-update the port/listen/public_url in the existing file. First- time install (no config.yaml) still writes full config with random keys. == update.sh: show panel port after successful update == Update completed with no indication of which port the panel is on. Users had to check config.yaml manually. Fix: after '[5/5] Update completed', read server.port from config.yaml and display: Panel: http://SERVER_IP:<port>/ (to change port: 3m-ui config port <new-port>) Also added CONFIG_DIR constant (was missing). == uninstall.sh: show previous panel port before removing config == Uninstall removed config without telling the user what port was in use. Fix: before rm -rf $CONFIG_DIR, read and display: Previous panel port: <port> fix(scripts): install/update/uninstall port handling Three script-level port UX issues found and fixed: == install.sh: re-install with PANEL_PORT now updates existing config == write_config previously returned early when config.yaml already existed, ignoring PANEL_PORT env var. Re-running 'PANEL_PORT=9000 bash install.sh' on an existing install silently kept the old port. Fix: when config.yaml exists and PANEL_PORT/THREE_M_UI_PORT is explicitly set, sed-update the port/listen/public_url in the existing file. First- time install (no config.yaml) still writes full config with random keys. == update.sh: show panel port after successful update == Update completed with no indication of which port the panel is on. Users had to check config.yaml manually. Fix: after '[5/5] Update completed', read server.port from config.yaml and display: Panel: http://SERVER_IP:<port>/ (to change port: 3m-ui config port <new-port>) Also added CONFIG_DIR constant (was missing). == uninstall.sh: show previous panel port before removing config == Uninstall removed config without telling the user what port was in use. Fix: before rm -rf $CONFIG_DIR, read and display: Previous panel port: <port> fix(scripts): install/update/uninstall port handling Three script-level port UX issues found and fixed: == install.sh: re-install with PANEL_PORT now updates existing config == write_config previously returned early when config.yaml already existed, ignoring PANEL_PORT env var. Re-running 'PANEL_PORT=9000 bash install.sh' on an existing install silently kept the old port. Fix: when config.yaml exists and PANEL_PORT/THREE_M_UI_PORT is explicitly set, sed-update the port/listen/public_url in the existing file. First- time install (no config.yaml) still writes full config with random keys. == update.sh: show panel port after successful update == Update completed with no indication of which port the panel is on. Users had to check config.yaml manually. Fix: after '[5/5] Update completed', read server.port from config.yaml and display: Panel: http://SERVER_IP:<port>/ (to change port: 3m-ui config port <new-port>) Also added CONFIG_DIR constant (was missing). == uninstall.sh: show previous panel port before removing config == Uninstall removed config without telling the user what port was in use. Fix: before rm -rf $CONFIG_DIR, read and display: Previous panel port: <port> fix(scripts): install/update/uninstall port handling Three script-level port UX issues found and fixed: == install.sh: re-install with PANEL_PORT now updates existing config == write_config previously returned early when config.yaml already existed, ignoring PANEL_PORT env var. Re-running 'PANEL_PORT=9000 bash install.sh' on an existing install silently kept the old port. Fix: when config.yaml exists and PANEL_PORT/THREE_M_UI_PORT is explicitly set, sed-update the port/listen/public_url in the existing file. First- time install (no config.yaml) still writes full config with random keys. == update.sh: show panel port after successful update == Update completed with no indication of which port the panel is on. Users had to check config.yaml manually. Fix: after '[5/5] Update completed', read server.port from config.yaml and display: Panel: http://SERVER_IP:<port>/ (to change port: 3m-ui config port <new-port>) Also added CONFIG_DIR constant (was missing). == uninstall.sh: show previous panel port before removing config == Uninstall removed config without telling the user what port was in use. Fix: before rm -rf $CONFIG_DIR, read and display: Previous panel port: <port> fix(scripts): install/update/uninstall port handling Three script-level port UX issues found and fixed: == install.sh: re-install with PANEL_PORT now updates existing config == write_config previously returned early when config.yaml already existed, ignoring PANEL_PORT env var. Re-running 'PANEL_PORT=9000 bash install.sh' on an existing install silently kept the old port. Fix: when config.yaml exists and PANEL_PORT/THREE_M_UI_PORT is explicitly set, sed-update the port/listen/public_url in the existing file. First- time install (no config.yaml) still writes full config with random keys. == update.sh: show panel port after successful update == Update completed with no indication of which port the panel is on. Users had to check config.yaml manually. Fix: after '[5/5] Update completed', read server.port from config.yaml and display: Panel: http://SERVER_IP:<port>/ (to change port: 3m-ui config port <new-port>) Also added CONFIG_DIR constant (was missing). == uninstall.sh: show previous panel port before removing config == Uninstall removed config without telling the user what port was in use. Fix: before rm -rf $CONFIG_DIR, read and display: Previous panel port: <port> fix(scripts): install/update/uninstall port handling Three script-level port UX issues found and fixed: == install.sh: re-install with PANEL_PORT now updates existing config == write_config previously returned early when config.yaml already existed, ignoring PANEL_PORT env var. Re-running 'PANEL_PORT=9000 bash install.sh' on an existing install silently kept the old port. Fix: when config.yaml exists and PANEL_PORT/THREE_M_UI_PORT is explicitly set, sed-update the port/listen/public_url in the existing file. First- time install (no config.yaml) still writes full config with random keys. == update.sh: show panel port after successful update == Update completed with no indication of which port the panel is on. Users had to check config.yaml manually. Fix: after '[5/5] Update completed', read server.port from config.yaml and display: Panel: http://SERVER_IP:<port>/ (to change port: 3m-ui config port <new-port>) Also added CONFIG_DIR constant (was missing). == uninstall.sh: show previous panel port before removing config == Uninstall removed config without telling the user what port was in use. Fix: before rm -rf $CONFIG_DIR, read and display: Previous panel port: <port> fix(scripts): install/update/uninstall port handling Three script-level port UX issues found and fixed: == install.sh: re-install with PANEL_PORT now updates existing config == write_config previously returned early when config.yaml already existed, ignoring PANEL_PORT env var. Re-running 'PANEL_PORT=9000 bash install.sh' on an existing install silently kept the old port. Fix: when config.yaml exists and PANEL_PORT/THREE_M_UI_PORT is explicitly set, sed-update the port/listen/public_url in the existing file. First- time install (no config.yaml) still writes full config with random keys. == update.sh: show panel port after successful update == Update completed with no indication of which port the panel is on. Users had to check config.yaml manually. Fix: after '[5/5] Update completed', read server.port from config.yaml and display: Panel: http://SERVER_IP:<port>/ (to change port: 3m-ui config port <new-port>) Also added CONFIG_DIR constant (was missing). == uninstall.sh: show previous panel port before removing config == Uninstall removed config without telling the user what port was in use. Fix: before rm -rf $CONFIG_DIR, read and display: Previous panel port: <port> fix(scripts): install/update/uninstall port handling Three script-level port UX issues found and fixed: == install.sh: re-install with PANEL_PORT now updates existing config == write_config previously returned early when config.yaml already existed, ignoring PANEL_PORT env var. Re-running 'PANEL_PORT=9000 bash install.sh' on an existing install silently kept the old port. Fix: when config.yaml exists and PANEL_PORT/THREE_M_UI_PORT is explicitly set, sed-update the port/listen/public_url in the existing file. First- time install (no config.yaml) still writes full config with random keys. == update.sh: show panel port after successful update == Update completed with no indication of which port the panel is on. Users had to check config.yaml manually. Fix: after '[5/5] Update completed', read server.port from config.yaml and display: Panel: http://SERVER_IP:<port>/ (to change port: 3m-ui config port <new-port>) Also added CONFIG_DIR constant (was missing). == uninstall.sh: show previous panel port before removing config == Uninstall removed config without telling the user what port was in use. Fix: before rm -rf $CONFIG_DIR, read and display: Previous panel port: <port> fix(scripts): install/update/uninstall port handling Three script-level port UX issues found and fixed: == install.sh: re-install with PANEL_PORT now updates existing config == write_config previously returned early when config.yaml already existed, ignoring PANEL_PORT env var. Re-running 'PANEL_PORT=9000 bash install.sh' on an existing install silently kept the old port. Fix: when config.yaml exists and PANEL_PORT/THREE_M_UI_PORT is explicitly set, sed-update the port/listen/public_url in the existing file. First- time install (no config.yaml) still writes full config with random keys. == update.sh: show panel port after successful update == Update completed with no indication of which port the panel is on. Users had to check config.yaml manually. Fix: after '[5/5] Update completed', read server.port from config.yaml and display: Panel: http://SERVER_IP:<port>/ (to change port: 3m-ui config port <new-port>) Also added CONFIG_DIR constant (was missing). == uninstall.sh: show previous panel port before removing config == Uninstall removed config without telling the user what port was in use. Fix: before rm -rf $CONFIG_DIR, read and display: Previous panel port: <port> fix(scripts): install/update/uninstall port handling Three script-level port UX issues found and fixed: == install.sh: re-install with PANEL_PORT now updates existing config == write_config previously returned early when config.yaml already existed, ignoring PANEL_PORT env var. Re-running 'PANEL_PORT=9000 bash install.sh' on an existing install silently kept the old port. Fix: when config.yaml exists and PANEL_PORT/THREE_M_UI_PORT is explicitly set, sed-update the port/listen/public_url in the existing file. First- time install (no config.yaml) still writes full config with random keys. == update.sh: show panel port after successful update == Update completed with no indication of which port the panel is on. Users had to check config.yaml manually. Fix: after '[5/5] Update completed', read server.port from config.yaml and display: Panel: http://SERVER_IP:<port>/ (to change port: 3m-ui config port <new-port>) Also added CONFIG_DIR constant (was missing). == uninstall.sh: show previous panel port before removing config == Uninstall removed config without telling the user what port was in use. Fix: before rm -rf $CONFIG_DIR, read and display: Previous panel port: <port> fix(scripts): install/update/uninstall port handling Three script-level port UX issues found and fixed: == install.sh: re-install with PANEL_PORT now updates existing config == write_config previously returned early when config.yaml already existed, ignoring PANEL_PORT env var. Re-running 'PANEL_PORT=9000 bash install.sh' on an existing install silently kept the old port. Fix: when config.yaml exists and PANEL_PORT/THREE_M_UI_PORT is explicitly set, sed-update the port/listen/public_url in the existing file. First- time install (no config.yaml) still writes full config with random keys. == update.sh: show panel port after successful update == Update completed with no indication of which port the panel is on. Users had to check config.yaml manually. Fix: after '[5/5] Update completed', read server.port from config.yaml and display: Panel: http://SERVER_IP:<port>/ (to change port: 3m-ui config port <new-port>) Also added CONFIG_DIR constant (was missing). == uninstall.sh: show previous panel port before removing config == Uninstall removed config without telling the user what port was in use. Fix: before rm -rf $CONFIG_DIR, read and display: Previous panel port: <port> fix(scripts): install/update/uninstall port handling Three script-level port UX issues found and fixed: == install.sh: re-install with PANEL_PORT now updates existing config == write_config previously returned early when config.yaml already existed, ignoring PANEL_PORT env var. Re-running 'PANEL_PORT=9000 bash install.sh' on an existing install silently kept the old port. Fix: when config.yaml exists and PANEL_PORT/THREE_M_UI_PORT is explicitly set, sed-update the port/listen/public_url in the existing file. First- time install (no config.yaml) still writes full config with random keys. == update.sh: show panel port after successful update == Update completed with no indication of which port the panel is on. Users had to check config.yaml manually. Fix: after '[5/5] Update completed', read server.port from config.yaml and display: Panel: http://SERVER_IP:<port>/ (to change port: 3m-ui config port <new-port>) Also added CONFIG_DIR constant (was missing). == uninstall.sh: show previous panel port before removing config == Uninstall removed config without telling the user what port was in use. Fix: before rm -rf $CONFIG_DIR, read and display: Previous panel port: <port> |
||
|
Z User
|
2fd6992574 |
feat(scripts): add config port command to 3m-ui management scripts
Users changing the panel port from the web UI had to SSH in and run 'systemctl restart 3m-ui' manually — easy to forget and not discoverable. Now both the 3m-ui entry script and 3m-ui.sh manager support: 3m-ui config show — display config.yaml 3m-ui config port <1-65535> — change port + auto-restart The interactive menu (running '3m-ui' with no args) also gains: 9. 修改面板端口 (interactive port change with current/new display) a. 卸载 3m-ui (moved from slot 9 to 'a') Flow: 1. Reads current port from config.yaml 2. Validates new port (1-65535, numeric) 3. sed replaces ' port: N' line in config.yaml 4. Restarts the service 5. Waits 1s, checks if active 6. Prints new access URL or failure message This closes the UX gap: web UI saves port → user runs '3m-ui config port 9000' → script restarts and confirms. feat(scripts): add config port command to 3m-ui management scripts Users changing the panel port from the web UI had to SSH in and run 'systemctl restart 3m-ui' manually — easy to forget and not discoverable. Now both the 3m-ui entry script and 3m-ui.sh manager support: 3m-ui config show — display config.yaml 3m-ui config port <1-65535> — change port + auto-restart The interactive menu (running '3m-ui' with no args) also gains: 9. 修改面板端口 (interactive port change with current/new display) a. 卸载 3m-ui (moved from slot 9 to 'a') Flow: 1. Reads current port from config.yaml 2. Validates new port (1-65535, numeric) 3. sed replaces ' port: N' line in config.yaml 4. Restarts the service 5. Waits 1s, checks if active 6. Prints new access URL or failure message This closes the UX gap: web UI saves port → user runs '3m-ui config port 9000' → script restarts and confirms. feat(scripts): add config port command to 3m-ui management scripts Users changing the panel port from the web UI had to SSH in and run 'systemctl restart 3m-ui' manually — easy to forget and not discoverable. Now both the 3m-ui entry script and 3m-ui.sh manager support: 3m-ui config show — display config.yaml 3m-ui config port <1-65535> — change port + auto-restart The interactive menu (running '3m-ui' with no args) also gains: 9. 修改面板端口 (interactive port change with current/new display) a. 卸载 3m-ui (moved from slot 9 to 'a') Flow: 1. Reads current port from config.yaml 2. Validates new port (1-65535, numeric) 3. sed replaces ' port: N' line in config.yaml 4. Restarts the service 5. Waits 1s, checks if active 6. Prints new access URL or failure message This closes the UX gap: web UI saves port → user runs '3m-ui config port 9000' → script restarts and confirms. feat(scripts): add config port command to 3m-ui management scripts Users changing the panel port from the web UI had to SSH in and run 'systemctl restart 3m-ui' manually — easy to forget and not discoverable. Now both the 3m-ui entry script and 3m-ui.sh manager support: 3m-ui config show — display config.yaml 3m-ui config port <1-65535> — change port + auto-restart The interactive menu (running '3m-ui' with no args) also gains: 9. 修改面板端口 (interactive port change with current/new display) a. 卸载 3m-ui (moved from slot 9 to 'a') Flow: 1. Reads current port from config.yaml 2. Validates new port (1-65535, numeric) 3. sed replaces ' port: N' line in config.yaml 4. Restarts the service 5. Waits 1s, checks if active 6. Prints new access URL or failure message This closes the UX gap: web UI saves port → user runs '3m-ui config port 9000' → script restarts and confirms. feat(scripts): add config port command to 3m-ui management scripts Users changing the panel port from the web UI had to SSH in and run 'systemctl restart 3m-ui' manually — easy to forget and not discoverable. Now both the 3m-ui entry script and 3m-ui.sh manager support: 3m-ui config show — display config.yaml 3m-ui config port <1-65535> — change port + auto-restart The interactive menu (running '3m-ui' with no args) also gains: 9. 修改面板端口 (interactive port change with current/new display) a. 卸载 3m-ui (moved from slot 9 to 'a') Flow: 1. Reads current port from config.yaml 2. Validates new port (1-65535, numeric) 3. sed replaces ' port: N' line in config.yaml 4. Restarts the service 5. Waits 1s, checks if active 6. Prints new access URL or failure message This closes the UX gap: web UI saves port → user runs '3m-ui config port 9000' → script restarts and confirms. feat(scripts): add config port command to 3m-ui management scripts Users changing the panel port from the web UI had to SSH in and run 'systemctl restart 3m-ui' manually — easy to forget and not discoverable. Now both the 3m-ui entry script and 3m-ui.sh manager support: 3m-ui config show — display config.yaml 3m-ui config port <1-65535> — change port + auto-restart The interactive menu (running '3m-ui' with no args) also gains: 9. 修改面板端口 (interactive port change with current/new display) a. 卸载 3m-ui (moved from slot 9 to 'a') Flow: 1. Reads current port from config.yaml 2. Validates new port (1-65535, numeric) 3. sed replaces ' port: N' line in config.yaml 4. Restarts the service 5. Waits 1s, checks if active 6. Prints new access URL or failure message This closes the UX gap: web UI saves port → user runs '3m-ui config port 9000' → script restarts and confirms. feat(scripts): add config port command to 3m-ui management scripts Users changing the panel port from the web UI had to SSH in and run 'systemctl restart 3m-ui' manually — easy to forget and not discoverable. Now both the 3m-ui entry script and 3m-ui.sh manager support: 3m-ui config show — display config.yaml 3m-ui config port <1-65535> — change port + auto-restart The interactive menu (running '3m-ui' with no args) also gains: 9. 修改面板端口 (interactive port change with current/new display) a. 卸载 3m-ui (moved from slot 9 to 'a') Flow: 1. Reads current port from config.yaml 2. Validates new port (1-65535, numeric) 3. sed replaces ' port: N' line in config.yaml 4. Restarts the service 5. Waits 1s, checks if active 6. Prints new access URL or failure message This closes the UX gap: web UI saves port → user runs '3m-ui config port 9000' → script restarts and confirms. feat(scripts): add config port command to 3m-ui management scripts Users changing the panel port from the web UI had to SSH in and run 'systemctl restart 3m-ui' manually — easy to forget and not discoverable. Now both the 3m-ui entry script and 3m-ui.sh manager support: 3m-ui config show — display config.yaml 3m-ui config port <1-65535> — change port + auto-restart The interactive menu (running '3m-ui' with no args) also gains: 9. 修改面板端口 (interactive port change with current/new display) a. 卸载 3m-ui (moved from slot 9 to 'a') Flow: 1. Reads current port from config.yaml 2. Validates new port (1-65535, numeric) 3. sed replaces ' port: N' line in config.yaml 4. Restarts the service 5. Waits 1s, checks if active 6. Prints new access URL or failure message This closes the UX gap: web UI saves port → user runs '3m-ui config port 9000' → script restarts and confirms. feat(scripts): add config port command to 3m-ui management scripts Users changing the panel port from the web UI had to SSH in and run 'systemctl restart 3m-ui' manually — easy to forget and not discoverable. Now both the 3m-ui entry script and 3m-ui.sh manager support: 3m-ui config show — display config.yaml 3m-ui config port <1-65535> — change port + auto-restart The interactive menu (running '3m-ui' with no args) also gains: 9. 修改面板端口 (interactive port change with current/new display) a. 卸载 3m-ui (moved from slot 9 to 'a') Flow: 1. Reads current port from config.yaml 2. Validates new port (1-65535, numeric) 3. sed replaces ' port: N' line in config.yaml 4. Restarts the service 5. Waits 1s, checks if active 6. Prints new access URL or failure message This closes the UX gap: web UI saves port → user runs '3m-ui config port 9000' → script restarts and confirms. feat(scripts): add config port command to 3m-ui management scripts Users changing the panel port from the web UI had to SSH in and run 'systemctl restart 3m-ui' manually — easy to forget and not discoverable. Now both the 3m-ui entry script and 3m-ui.sh manager support: 3m-ui config show — display config.yaml 3m-ui config port <1-65535> — change port + auto-restart The interactive menu (running '3m-ui' with no args) also gains: 9. 修改面板端口 (interactive port change with current/new display) a. 卸载 3m-ui (moved from slot 9 to 'a') Flow: 1. Reads current port from config.yaml 2. Validates new port (1-65535, numeric) 3. sed replaces ' port: N' line in config.yaml 4. Restarts the service 5. Waits 1s, checks if active 6. Prints new access URL or failure message This closes the UX gap: web UI saves port → user runs '3m-ui config port 9000' → script restarts and confirms. feat(scripts): add config port command to 3m-ui management scripts Users changing the panel port from the web UI had to SSH in and run 'systemctl restart 3m-ui' manually — easy to forget and not discoverable. Now both the 3m-ui entry script and 3m-ui.sh manager support: 3m-ui config show — display config.yaml 3m-ui config port <1-65535> — change port + auto-restart The interactive menu (running '3m-ui' with no args) also gains: 9. 修改面板端口 (interactive port change with current/new display) a. 卸载 3m-ui (moved from slot 9 to 'a') Flow: 1. Reads current port from config.yaml 2. Validates new port (1-65535, numeric) 3. sed replaces ' port: N' line in config.yaml 4. Restarts the service 5. Waits 1s, checks if active 6. Prints new access URL or failure message This closes the UX gap: web UI saves port → user runs '3m-ui config port 9000' → script restarts and confirms. feat(scripts): add config port command to 3m-ui management scripts Users changing the panel port from the web UI had to SSH in and run 'systemctl restart 3m-ui' manually — easy to forget and not discoverable. Now both the 3m-ui entry script and 3m-ui.sh manager support: 3m-ui config show — display config.yaml 3m-ui config port <1-65535> — change port + auto-restart The interactive menu (running '3m-ui' with no args) also gains: 9. 修改面板端口 (interactive port change with current/new display) a. 卸载 3m-ui (moved from slot 9 to 'a') Flow: 1. Reads current port from config.yaml 2. Validates new port (1-65535, numeric) 3. sed replaces ' port: N' line in config.yaml 4. Restarts the service 5. Waits 1s, checks if active 6. Prints new access URL or failure message This closes the UX gap: web UI saves port → user runs '3m-ui config port 9000' → script restarts and confirms. |
||
|
風雪
|
7bc01e0298 |
fix(installers): Mihomo checksum via GitHub API digest, best-effort by default
The previous verify_mihomo_sha256 tried to download a SHA256SUMS file
from MetaCubeX/mihomo releases. Mihomo does NOT publish such a file
(verified across v1.17.0 — v1.19.30, all 404), so every install that
reached the Mihomo step failed with:
'Error: Mihomo checksum verification failed.
Set THREE_M_UI_INSECURE=1 to bypass (NOT recommended).'
Two-part fix:
1. Use GitHub's Release API per-asset 'digest' field instead of a
SHA256SUMS file. GitHub computes sha256 server-side when an asset
is uploaded, so the digest is authoritative even though Mihomo
itself publishes no checksums. Added github_asset_digest() helper
that queries /repos/{repo}/releases/tags/{tag} and parses the
matching asset's digest field (no jq dependency, pure awk).
2. Make Mihomo verification best-effort by default. Anonymous GitHub
API is rate-limited to 60 requests/hour/IP, so hard-failing would
break installs for anyone sharing a NAT IP or after a few retries.
The fail-closed guarantee already covers our own 3m-ui binary
(SHA256SUMS + cosign). Mihomo integrity is additionally protected
by HTTPS transport + the ELF smoke-test.
Users who want strict Mihomo verification can set
THREE_M_UI_VERIFY_MIHOMO=1 to make verification failures abort
(requires GitHub API to be reachable).
Threat model unchanged: our binary is fully verified end-to-end;
Mihomo is an independent project we can only best-effort verify.
The HTTPS download to GitHub + ELF check catches the realistic
threats (network MITM, truncated download, wrong file).
fix(installers): Mihomo checksum via GitHub API digest, best-effort by default
The previous verify_mihomo_sha256 tried to download a SHA256SUMS file
from MetaCubeX/mihomo releases. Mihomo does NOT publish such a file
(verified across v1.17.0 — v1.19.30, all 404), so every install that
reached the Mihomo step failed with:
'Error: Mihomo checksum verification failed.
Set THREE_M_UI_INSECURE=1 to bypass (NOT recommended).'
Two-part fix:
1. Use GitHub's Release API per-asset 'digest' field instead of a
SHA256SUMS file. GitHub computes sha256 server-side when an asset
is uploaded, so the digest is authoritative even though Mihomo
itself publishes no checksums. Added github_asset_digest() helper
that queries /repos/{repo}/releases/tags/{tag} and parses the
matching asset's digest field (no jq dependency, pure awk).
2. Make Mihomo verification best-effort by default. Anonymous GitHub
API is rate-limited to 60 requests/hour/IP, so hard-failing would
break installs for anyone sharing a NAT IP or after a few retries.
The fail-closed guarantee already covers our own 3m-ui binary
(SHA256SUMS + cosign). Mihomo integrity is additionally protected
by HTTPS transport + the ELF smoke-test.
Users who want strict Mihomo verification can set
THREE_M_UI_VERIFY_MIHOMO=1 to make verification failures abort
(requires GitHub API to be reachable).
Threat model unchanged: our binary is fully verified end-to-end;
Mihomo is an independent project we can only best-effort verify.
The HTTPS download to GitHub + ELF check catches the realistic
threats (network MITM, truncated download, wrong file).
fix(installers): Mihomo checksum via GitHub API digest, best-effort by default
The previous verify_mihomo_sha256 tried to download a SHA256SUMS file
from MetaCubeX/mihomo releases. Mihomo does NOT publish such a file
(verified across v1.17.0 — v1.19.30, all 404), so every install that
reached the Mihomo step failed with:
'Error: Mihomo checksum verification failed.
Set THREE_M_UI_INSECURE=1 to bypass (NOT recommended).'
Two-part fix:
1. Use GitHub's Release API per-asset 'digest' field instead of a
SHA256SUMS file. GitHub computes sha256 server-side when an asset
is uploaded, so the digest is authoritative even though Mihomo
itself publishes no checksums. Added github_asset_digest() helper
that queries /repos/{repo}/releases/tags/{tag} and parses the
matching asset's digest field (no jq dependency, pure awk).
2. Make Mihomo verification best-effort by default. Anonymous GitHub
API is rate-limited to 60 requests/hour/IP, so hard-failing would
break installs for anyone sharing a NAT IP or after a few retries.
The fail-closed guarantee already covers our own 3m-ui binary
(SHA256SUMS + cosign). Mihomo integrity is additionally protected
by HTTPS transport + the ELF smoke-test.
Users who want strict Mihomo verification can set
THREE_M_UI_VERIFY_MIHOMO=1 to make verification failures abort
(requires GitHub API to be reachable).
Threat model unchanged: our binary is fully verified end-to-end;
Mihomo is an independent project we can only best-effort verify.
The HTTPS download to GitHub + ELF check catches the realistic
threats (network MITM, truncated download, wrong file).
fix(installers): Mihomo checksum via GitHub API digest, best-effort by default
The previous verify_mihomo_sha256 tried to download a SHA256SUMS file
from MetaCubeX/mihomo releases. Mihomo does NOT publish such a file
(verified across v1.17.0 — v1.19.30, all 404), so every install that
reached the Mihomo step failed with:
'Error: Mihomo checksum verification failed.
Set THREE_M_UI_INSECURE=1 to bypass (NOT recommended).'
Two-part fix:
1. Use GitHub's Release API per-asset 'digest' field instead of a
SHA256SUMS file. GitHub computes sha256 server-side when an asset
is uploaded, so the digest is authoritative even though Mihomo
itself publishes no checksums. Added github_asset_digest() helper
that queries /repos/{repo}/releases/tags/{tag} and parses the
matching asset's digest field (no jq dependency, pure awk).
2. Make Mihomo verification best-effort by default. Anonymous GitHub
API is rate-limited to 60 requests/hour/IP, so hard-failing would
break installs for anyone sharing a NAT IP or after a few retries.
The fail-closed guarantee already covers our own 3m-ui binary
(SHA256SUMS + cosign). Mihomo integrity is additionally protected
by HTTPS transport + the ELF smoke-test.
Users who want strict Mihomo verification can set
THREE_M_UI_VERIFY_MIHOMO=1 to make verification failures abort
(requires GitHub API to be reachable).
Threat model unchanged: our binary is fully verified end-to-end;
Mihomo is an independent project we can only best-effort verify.
The HTTPS download to GitHub + ELF check catches the realistic
threats (network MITM, truncated download, wrong file).
fix(installers): Mihomo checksum via GitHub API digest, best-effort by default
The previous verify_mihomo_sha256 tried to download a SHA256SUMS file
from MetaCubeX/mihomo releases. Mihomo does NOT publish such a file
(verified across v1.17.0 — v1.19.30, all 404), so every install that
reached the Mihomo step failed with:
'Error: Mihomo checksum verification failed.
Set THREE_M_UI_INSECURE=1 to bypass (NOT recommended).'
Two-part fix:
1. Use GitHub's Release API per-asset 'digest' field instead of a
SHA256SUMS file. GitHub computes sha256 server-side when an asset
is uploaded, so the digest is authoritative even though Mihomo
itself publishes no checksums. Added github_asset_digest() helper
that queries /repos/{repo}/releases/tags/{tag} and parses the
matching asset's digest field (no jq dependency, pure awk).
2. Make Mihomo verification best-effort by default. Anonymous GitHub
API is rate-limited to 60 requests/hour/IP, so hard-failing would
break installs for anyone sharing a NAT IP or after a few retries.
The fail-closed guarantee already covers our own 3m-ui binary
(SHA256SUMS + cosign). Mihomo integrity is additionally protected
by HTTPS transport + the ELF smoke-test.
Users who want strict Mihomo verification can set
THREE_M_UI_VERIFY_MIHOMO=1 to make verification failures abort
(requires GitHub API to be reachable).
Threat model unchanged: our binary is fully verified end-to-end;
Mihomo is an independent project we can only best-effort verify.
The HTTPS download to GitHub + ELF check catches the realistic
threats (network MITM, truncated download, wrong file).
fix(installers): Mihomo checksum via GitHub API digest, best-effort by default
The previous verify_mihomo_sha256 tried to download a SHA256SUMS file
from MetaCubeX/mihomo releases. Mihomo does NOT publish such a file
(verified across v1.17.0 — v1.19.30, all 404), so every install that
reached the Mihomo step failed with:
'Error: Mihomo checksum verification failed.
Set THREE_M_UI_INSECURE=1 to bypass (NOT recommended).'
Two-part fix:
1. Use GitHub's Release API per-asset 'digest' field instead of a
SHA256SUMS file. GitHub computes sha256 server-side when an asset
is uploaded, so the digest is authoritative even though Mihomo
itself publishes no checksums. Added github_asset_digest() helper
that queries /repos/{repo}/releases/tags/{tag} and parses the
matching asset's digest field (no jq dependency, pure awk).
2. Make Mihomo verification best-effort by default. Anonymous GitHub
API is rate-limited to 60 requests/hour/IP, so hard-failing would
break installs for anyone sharing a NAT IP or after a few retries.
The fail-closed guarantee already covers our own 3m-ui binary
(SHA256SUMS + cosign). Mihomo integrity is additionally protected
by HTTPS transport + the ELF smoke-test.
Users who want strict Mihomo verification can set
THREE_M_UI_VERIFY_MIHOMO=1 to make verification failures abort
(requires GitHub API to be reachable).
Threat model unchanged: our binary is fully verified end-to-end;
Mihomo is an independent project we can only best-effort verify.
The HTTPS download to GitHub + ELF check catches the realistic
threats (network MITM, truncated download, wrong file).
fix(installers): Mihomo checksum via GitHub API digest, best-effort by default
The previous verify_mihomo_sha256 tried to download a SHA256SUMS file
from MetaCubeX/mihomo releases. Mihomo does NOT publish such a file
(verified across v1.17.0 — v1.19.30, all 404), so every install that
reached the Mihomo step failed with:
'Error: Mihomo checksum verification failed.
Set THREE_M_UI_INSECURE=1 to bypass (NOT recommended).'
Two-part fix:
1. Use GitHub's Release API per-asset 'digest' field instead of a
SHA256SUMS file. GitHub computes sha256 server-side when an asset
is uploaded, so the digest is authoritative even though Mihomo
itself publishes no checksums. Added github_asset_digest() helper
that queries /repos/{repo}/releases/tags/{tag} and parses the
matching asset's digest field (no jq dependency, pure awk).
2. Make Mihomo verification best-effort by default. Anonymous GitHub
API is rate-limited to 60 requests/hour/IP, so hard-failing would
break installs for anyone sharing a NAT IP or after a few retries.
The fail-closed guarantee already covers our own 3m-ui binary
(SHA256SUMS + cosign). Mihomo integrity is additionally protected
by HTTPS transport + the ELF smoke-test.
Users who want strict Mihomo verification can set
THREE_M_UI_VERIFY_MIHOMO=1 to make verification failures abort
(requires GitHub API to be reachable).
Threat model unchanged: our binary is fully verified end-to-end;
Mihomo is an independent project we can only best-effort verify.
The HTTPS download to GitHub + ELF check catches the realistic
threats (network MITM, truncated download, wrong file).
fix(installers): Mihomo checksum via GitHub API digest, best-effort by default
The previous verify_mihomo_sha256 tried to download a SHA256SUMS file
from MetaCubeX/mihomo releases. Mihomo does NOT publish such a file
(verified across v1.17.0 — v1.19.30, all 404), so every install that
reached the Mihomo step failed with:
'Error: Mihomo checksum verification failed.
Set THREE_M_UI_INSECURE=1 to bypass (NOT recommended).'
Two-part fix:
1. Use GitHub's Release API per-asset 'digest' field instead of a
SHA256SUMS file. GitHub computes sha256 server-side when an asset
is uploaded, so the digest is authoritative even though Mihomo
itself publishes no checksums. Added github_asset_digest() helper
that queries /repos/{repo}/releases/tags/{tag} and parses the
matching asset's digest field (no jq dependency, pure awk).
2. Make Mihomo verification best-effort by default. Anonymous GitHub
API is rate-limited to 60 requests/hour/IP, so hard-failing would
break installs for anyone sharing a NAT IP or after a few retries.
The fail-closed guarantee already covers our own 3m-ui binary
(SHA256SUMS + cosign). Mihomo integrity is additionally protected
by HTTPS transport + the ELF smoke-test.
Users who want strict Mihomo verification can set
THREE_M_UI_VERIFY_MIHOMO=1 to make verification failures abort
(requires GitHub API to be reachable).
Threat model unchanged: our binary is fully verified end-to-end;
Mihomo is an independent project we can only best-effort verify.
The HTTPS download to GitHub + ELF check catches the realistic
threats (network MITM, truncated download, wrong file).
fix(installers): Mihomo checksum via GitHub API digest, best-effort by default
The previous verify_mihomo_sha256 tried to download a SHA256SUMS file
from MetaCubeX/mihomo releases. Mihomo does NOT publish such a file
(verified across v1.17.0 — v1.19.30, all 404), so every install that
reached the Mihomo step failed with:
'Error: Mihomo checksum verification failed.
Set THREE_M_UI_INSECURE=1 to bypass (NOT recommended).'
Two-part fix:
1. Use GitHub's Release API per-asset 'digest' field instead of a
SHA256SUMS file. GitHub computes sha256 server-side when an asset
is uploaded, so the digest is authoritative even though Mihomo
itself publishes no checksums. Added github_asset_digest() helper
that queries /repos/{repo}/releases/tags/{tag} and parses the
matching asset's digest field (no jq dependency, pure awk).
2. Make Mihomo verification best-effort by default. Anonymous GitHub
API is rate-limited to 60 requests/hour/IP, so hard-failing would
break installs for anyone sharing a NAT IP or after a few retries.
The fail-closed guarantee already covers our own 3m-ui binary
(SHA256SUMS + cosign). Mihomo integrity is additionally protected
by HTTPS transport + the ELF smoke-test.
Users who want strict Mihomo verification can set
THREE_M_UI_VERIFY_MIHOMO=1 to make verification failures abort
(requires GitHub API to be reachable).
Threat model unchanged: our binary is fully verified end-to-end;
Mihomo is an independent project we can only best-effort verify.
The HTTPS download to GitHub + ELF check catches the realistic
threats (network MITM, truncated download, wrong file).
fix(installers): Mihomo checksum via GitHub API digest, best-effort by default
The previous verify_mihomo_sha256 tried to download a SHA256SUMS file
from MetaCubeX/mihomo releases. Mihomo does NOT publish such a file
(verified across v1.17.0 — v1.19.30, all 404), so every install that
reached the Mihomo step failed with:
'Error: Mihomo checksum verification failed.
Set THREE_M_UI_INSECURE=1 to bypass (NOT recommended).'
Two-part fix:
1. Use GitHub's Release API per-asset 'digest' field instead of a
SHA256SUMS file. GitHub computes sha256 server-side when an asset
is uploaded, so the digest is authoritative even though Mihomo
itself publishes no checksums. Added github_asset_digest() helper
that queries /repos/{repo}/releases/tags/{tag} and parses the
matching asset's digest field (no jq dependency, pure awk).
2. Make Mihomo verification best-effort by default. Anonymous GitHub
API is rate-limited to 60 requests/hour/IP, so hard-failing would
break installs for anyone sharing a NAT IP or after a few retries.
The fail-closed guarantee already covers our own 3m-ui binary
(SHA256SUMS + cosign). Mihomo integrity is additionally protected
by HTTPS transport + the ELF smoke-test.
Users who want strict Mihomo verification can set
THREE_M_UI_VERIFY_MIHOMO=1 to make verification failures abort
(requires GitHub API to be reachable).
Threat model unchanged: our binary is fully verified end-to-end;
Mihomo is an independent project we can only best-effort verify.
The HTTPS download to GitHub + ELF check catches the realistic
threats (network MITM, truncated download, wrong file).
fix(installers): Mihomo checksum via GitHub API digest, best-effort by default
The previous verify_mihomo_sha256 tried to download a SHA256SUMS file
from MetaCubeX/mihomo releases. Mihomo does NOT publish such a file
(verified across v1.17.0 — v1.19.30, all 404), so every install that
reached the Mihomo step failed with:
'Error: Mihomo checksum verification failed.
Set THREE_M_UI_INSECURE=1 to bypass (NOT recommended).'
Two-part fix:
1. Use GitHub's Release API per-asset 'digest' field instead of a
SHA256SUMS file. GitHub computes sha256 server-side when an asset
is uploaded, so the digest is authoritative even though Mihomo
itself publishes no checksums. Added github_asset_digest() helper
that queries /repos/{repo}/releases/tags/{tag} and parses the
matching asset's digest field (no jq dependency, pure awk).
2. Make Mihomo verification best-effort by default. Anonymous GitHub
API is rate-limited to 60 requests/hour/IP, so hard-failing would
break installs for anyone sharing a NAT IP or after a few retries.
The fail-closed guarantee already covers our own 3m-ui binary
(SHA256SUMS + cosign). Mihomo integrity is additionally protected
by HTTPS transport + the ELF smoke-test.
Users who want strict Mihomo verification can set
THREE_M_UI_VERIFY_MIHOMO=1 to make verification failures abort
(requires GitHub API to be reachable).
Threat model unchanged: our binary is fully verified end-to-end;
Mihomo is an independent project we can only best-effort verify.
The HTTPS download to GitHub + ELF check catches the realistic
threats (network MITM, truncated download, wrong file).
fix(installers): Mihomo checksum via GitHub API digest, best-effort by default
The previous verify_mihomo_sha256 tried to download a SHA256SUMS file
from MetaCubeX/mihomo releases. Mihomo does NOT publish such a file
(verified across v1.17.0 — v1.19.30, all 404), so every install that
reached the Mihomo step failed with:
'Error: Mihomo checksum verification failed.
Set THREE_M_UI_INSECURE=1 to bypass (NOT recommended).'
Two-part fix:
1. Use GitHub's Release API per-asset 'digest' field instead of a
SHA256SUMS file. GitHub computes sha256 server-side when an asset
is uploaded, so the digest is authoritative even though Mihomo
itself publishes no checksums. Added github_asset_digest() helper
that queries /repos/{repo}/releases/tags/{tag} and parses the
matching asset's digest field (no jq dependency, pure awk).
2. Make Mihomo verification best-effort by default. Anonymous GitHub
API is rate-limited to 60 requests/hour/IP, so hard-failing would
break installs for anyone sharing a NAT IP or after a few retries.
The fail-closed guarantee already covers our own 3m-ui binary
(SHA256SUMS + cosign). Mihomo integrity is additionally protected
by HTTPS transport + the ELF smoke-test.
Users who want strict Mihomo verification can set
THREE_M_UI_VERIFY_MIHOMO=1 to make verification failures abort
(requires GitHub API to be reachable).
Threat model unchanged: our binary is fully verified end-to-end;
Mihomo is an independent project we can only best-effort verify.
The HTTPS download to GitHub + ELF check catches the realistic
threats (network MITM, truncated download, wrong file).
|
||
|
風雪
|
8d730a2d08 |
fix(installers): cosign verify accepts tag-ref or main-branch identity
The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so its OIDC certificate identity is .../release.yml@refs/heads/main rather than the tag-ref identity .../release.yml@refs/tags/v1.0.0 that tag-pushed releases produce. Make verify_release_cosign try both identities so verification works for both normal tag-triggered releases and workflow_dispatch back-fills. If either matches, verification passes. fix(installers): cosign verify accepts tag-ref or main-branch identity The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so its OIDC certificate identity is .../release.yml@refs/heads/main rather than the tag-ref identity .../release.yml@refs/tags/v1.0.0 that tag-pushed releases produce. Make verify_release_cosign try both identities so verification works for both normal tag-triggered releases and workflow_dispatch back-fills. If either matches, verification passes. fix(installers): cosign verify accepts tag-ref or main-branch identity The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so its OIDC certificate identity is .../release.yml@refs/heads/main rather than the tag-ref identity .../release.yml@refs/tags/v1.0.0 that tag-pushed releases produce. Make verify_release_cosign try both identities so verification works for both normal tag-triggered releases and workflow_dispatch back-fills. If either matches, verification passes. fix(installers): cosign verify accepts tag-ref or main-branch identity The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so its OIDC certificate identity is .../release.yml@refs/heads/main rather than the tag-ref identity .../release.yml@refs/tags/v1.0.0 that tag-pushed releases produce. Make verify_release_cosign try both identities so verification works for both normal tag-triggered releases and workflow_dispatch back-fills. If either matches, verification passes. fix(installers): cosign verify accepts tag-ref or main-branch identity The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so its OIDC certificate identity is .../release.yml@refs/heads/main rather than the tag-ref identity .../release.yml@refs/tags/v1.0.0 that tag-pushed releases produce. Make verify_release_cosign try both identities so verification works for both normal tag-triggered releases and workflow_dispatch back-fills. If either matches, verification passes. fix(installers): cosign verify accepts tag-ref or main-branch identity The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so its OIDC certificate identity is .../release.yml@refs/heads/main rather than the tag-ref identity .../release.yml@refs/tags/v1.0.0 that tag-pushed releases produce. Make verify_release_cosign try both identities so verification works for both normal tag-triggered releases and workflow_dispatch back-fills. If either matches, verification passes. fix(installers): cosign verify accepts tag-ref or main-branch identity The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so its OIDC certificate identity is .../release.yml@refs/heads/main rather than the tag-ref identity .../release.yml@refs/tags/v1.0.0 that tag-pushed releases produce. Make verify_release_cosign try both identities so verification works for both normal tag-triggered releases and workflow_dispatch back-fills. If either matches, verification passes. fix(installers): cosign verify accepts tag-ref or main-branch identity The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so its OIDC certificate identity is .../release.yml@refs/heads/main rather than the tag-ref identity .../release.yml@refs/tags/v1.0.0 that tag-pushed releases produce. Make verify_release_cosign try both identities so verification works for both normal tag-triggered releases and workflow_dispatch back-fills. If either matches, verification passes. fix(installers): cosign verify accepts tag-ref or main-branch identity The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so its OIDC certificate identity is .../release.yml@refs/heads/main rather than the tag-ref identity .../release.yml@refs/tags/v1.0.0 that tag-pushed releases produce. Make verify_release_cosign try both identities so verification works for both normal tag-triggered releases and workflow_dispatch back-fills. If either matches, verification passes. fix(installers): cosign verify accepts tag-ref or main-branch identity The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so its OIDC certificate identity is .../release.yml@refs/heads/main rather than the tag-ref identity .../release.yml@refs/tags/v1.0.0 that tag-pushed releases produce. Make verify_release_cosign try both identities so verification works for both normal tag-triggered releases and workflow_dispatch back-fills. If either matches, verification passes. fix(installers): cosign verify accepts tag-ref or main-branch identity The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so its OIDC certificate identity is .../release.yml@refs/heads/main rather than the tag-ref identity .../release.yml@refs/tags/v1.0.0 that tag-pushed releases produce. Make verify_release_cosign try both identities so verification works for both normal tag-triggered releases and workflow_dispatch back-fills. If either matches, verification passes. fix(installers): cosign verify accepts tag-ref or main-branch identity The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so its OIDC certificate identity is .../release.yml@refs/heads/main rather than the tag-ref identity .../release.yml@refs/tags/v1.0.0 that tag-pushed releases produce. Make verify_release_cosign try both identities so verification works for both normal tag-triggered releases and workflow_dispatch back-fills. If either matches, verification passes. |
||
|
風雪
|
4f038eba42 |
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS feat(release): cosign keyless signing of SHA256SUMS Closes M-10 (supply-chain authenticity). Replaces the TODO comment with a working cosign keyless OIDC signing flow. Workflow (release.yml): - Add id-token: write permission (required for GitHub OIDC token). - Add sigstore/cosign-installer@v3 step. - After SHA256SUMS is generated, cosign sign-blob --yes produces SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature). These are uploaded alongside the existing release assets. - No long-lived secret is stored on GitHub; the signing identity is the ephemeral GitHub Actions OIDC token bound to this workflow + tag. - Release notes body updated with the cosign verify-blob command so users know how to verify authenticity end-to-end. Installers (install.sh / update.sh): - Add verify_release_cosign() function. OPT-IN via THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX simple — SHA256SUMS integrity is already fail-closed). - When enabled AND cosign is installed, downloads SHA256SUMS.pem + SHA256SUMS.sig and runs cosign verify-blob against the identity 'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'. - If cosign is missing or the release predates signing, prints a warning and continues (does not hard-fail). - If verification runs and FAILS, aborts (fail-closed, bypassable via THREE_M_UI_INSECURE=1). Threat model: - Before: SHA256SUMS provided integrity but not authenticity — an attacker who could modify the release assets could also modify SHA256SUMS, defeating the checksum. - After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC identity, so a modified sums file fails signature verification even if the attacker controls the release CDN. Verification command (for end users): cosign verify-blob \ --certificate SHA256SUMS.pem \ --signature SHA256SUMS.sig \ --certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ SHA256SUMS |
||
|
風雪
|
39608cd0fb |
fix(infra): fail-closed checksums, sandbox hardening, non-root Docker
Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' fix(infra): fail-closed checksums, sandbox hardening, non-root Docker Critical (supply chain): - C-3: Mihomo binary download had no checksum. Add verify_mihomo_sha256() downloading MetaCubeX SHA256SUMS and verifying the .gz BEFORE decompression. Mismatch is fatal. - C-4: verify_release_sha256 soft-failed (return 0) when SHA256SUMS was missing or asset unlisted. Now fail-closed: err exit unless the operator sets THREE_M_UI_INSECURE=1 (prints a loud WARNING). sha256 tooling is now a hard dependency. - C-5: Downloaded binaries were executed as root (--version / -v) for smoke-testing. Remove every invocation; rely on checksum + 'file' ELF check instead. - H-1: Drop raw.githubusercontent.com fallback for helper scripts. Missing release asset now hard-fails (supply-chain posture). Sandbox: - H-2: systemd unit gains UMask=0077, ProtectSystem=strict, ProtectHome, PrivateTmp, PrivateDevices, ProtectKernelTunables/ Modules/Logs, ProtectControlGroups, ReadWritePaths, RestrictAddressFamilies, RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, SystemCallArchitectures=native, SystemCallFilter=@system-service ~@privileged @resources. CapabilityBoundingSet now includes CAP_NET_ADMIN for Mihomo TUN. - C-4(Docker): Dockerfile creates non-root user 3m-ui (UID 10001), pre-creates & chowns volumes, sets USER 10001:10001. - M-3: docker-compose ports 8080:8080 -> 127.0.0.1:8080:8080 (loopback-only by default; operator uses reverse proxy). - M-9: docker-compose gains security notes (reverse-proxy guidance, admin/admin + forced first-login change, THREE_M_UI_ADMIN_PASSWORD example, UID 10001 volume ownership). - M-10: release.yml gains a TODO comment for cosign keyless signing. - LOW: AGENTS.md Go 1.24+ -> Go 1.25+; install.sh final message now 'Initial administrator: admin / admin. You MUST change the password on first login.' |
||
|
風雪
|
1d1a69bf74 | feat(nat): custom panel port/listen/public_url via env, API, settings UI, install.sh | ||
|
風雪
|
bb875405b3 | fix(scripts): update.sh match SHA256SUMS with or without ./ prefix | ||
|
風雪
|
5cdbedaabf | fix: restore install.sh + SHA256SUMS basename matching | ||
|
風雪
|
52a66c88cc | fix: SHA256SUMS basename match; attach scripts to release assets | ||
|
風雪
|
1a79102cac |
revert(scripts): restore pre-s-ui menu/banner versions
revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions |
||
|
風雪
|
29ccad2597 |
revert(scripts): restore pre-s-ui menu/banner versions
revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions revert(scripts): restore pre-s-ui menu/banner versions |
||
|
風雪
|
6a859d2e60 | feat(install): s-ui style finish banner with panel URLs | ||
|
風雪
|
392649c005 | feat(scripts): s-ui style installer UX — colors, menu, panel URL, one-liner | ||
|
風雪
|
4585f304a6 | fix(scripts): checksum verify, versioned update, backup retention, safer traps | ||
|
風雪
|
82713edf82 |
fix: panel must start even if Mihomo/SSL fails on boot
- Soft-fail ApplyConfig / config generation / SSL bind so the management UI remains reachable after deploy - Preserve os.IsNotExist in ConfigManager.ReadConfig (first-boot path) - systemd unit: CAP_NET_BIND_SERVICE + LimitNOFILE for optional ACME fix: panel must start even if Mihomo/SSL fails on boot - Soft-fail ApplyConfig / config generation / SSL bind so the management UI remains reachable after deploy - Preserve os.IsNotExist in ConfigManager.ReadConfig (first-boot path) - systemd unit: CAP_NET_BIND_SERVICE + LimitNOFILE for optional ACME fix: panel must start even if Mihomo/SSL fails on boot - Soft-fail ApplyConfig / config generation / SSL bind so the management UI remains reachable after deploy - Preserve os.IsNotExist in ConfigManager.ReadConfig (first-boot path) - systemd unit: CAP_NET_BIND_SERVICE + LimitNOFILE for optional ACME fix: panel must start even if Mihomo/SSL fails on boot - Soft-fail ApplyConfig / config generation / SSL bind so the management UI remains reachable after deploy - Preserve os.IsNotExist in ConfigManager.ReadConfig (first-boot path) - systemd unit: CAP_NET_BIND_SERVICE + LimitNOFILE for optional ACME fix: panel must start even if Mihomo/SSL fails on boot - Soft-fail ApplyConfig / config generation / SSL bind so the management UI remains reachable after deploy - Preserve os.IsNotExist in ConfigManager.ReadConfig (first-boot path) - systemd unit: CAP_NET_BIND_SERVICE + LimitNOFILE for optional ACME fix: panel must start even if Mihomo/SSL fails on boot - Soft-fail ApplyConfig / config generation / SSL bind so the management UI remains reachable after deploy - Preserve os.IsNotExist in ConfigManager.ReadConfig (first-boot path) - systemd unit: CAP_NET_BIND_SERVICE + LimitNOFILE for optional ACME fix: panel must start even if Mihomo/SSL fails on boot - Soft-fail ApplyConfig / config generation / SSL bind so the management UI remains reachable after deploy - Preserve os.IsNotExist in ConfigManager.ReadConfig (first-boot path) - systemd unit: CAP_NET_BIND_SERVICE + LimitNOFILE for optional ACME fix: panel must start even if Mihomo/SSL fails on boot - Soft-fail ApplyConfig / config generation / SSL bind so the management UI remains reachable after deploy - Preserve os.IsNotExist in ConfigManager.ReadConfig (first-boot path) - systemd unit: CAP_NET_BIND_SERVICE + LimitNOFILE for optional ACME fix: panel must start even if Mihomo/SSL fails on boot - Soft-fail ApplyConfig / config generation / SSL bind so the management UI remains reachable after deploy - Preserve os.IsNotExist in ConfigManager.ReadConfig (first-boot path) - systemd unit: CAP_NET_BIND_SERVICE + LimitNOFILE for optional ACME fix: panel must start even if Mihomo/SSL fails on boot - Soft-fail ApplyConfig / config generation / SSL bind so the management UI remains reachable after deploy - Preserve os.IsNotExist in ConfigManager.ReadConfig (first-boot path) - systemd unit: CAP_NET_BIND_SERVICE + LimitNOFILE for optional ACME fix: panel must start even if Mihomo/SSL fails on boot - Soft-fail ApplyConfig / config generation / SSL bind so the management UI remains reachable after deploy - Preserve os.IsNotExist in ConfigManager.ReadConfig (first-boot path) - systemd unit: CAP_NET_BIND_SERVICE + LimitNOFILE for optional ACME fix: panel must start even if Mihomo/SSL fails on boot - Soft-fail ApplyConfig / config generation / SSL bind so the management UI remains reachable after deploy - Preserve os.IsNotExist in ConfigManager.ReadConfig (first-boot path) - systemd unit: CAP_NET_BIND_SERVICE + LimitNOFILE for optional ACME |
||
|
風雪
|
4d6241740d |
feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring
Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. feat: complete panel ACME SSL, sub HTML templates, Telegram alerts wiring Wire acme/subpage into app and router, native v2ray/base64 subscription, Delete depleted UI, Settings panels for SSL and subscription theme, Telegram traffic/expiry thresholds. Docker + static multi-arch scripts. |
||
|
風雪
|
40ab85ee74 | feat(scripts): update.sh multi-arch static download + README docs | ||
|
風雪
|
2d647ef468 | feat(scripts): full Linux arch/distro support; README static multi-arch docs | ||
|
風雪
|
d9dacf0f6f | fix: preserve default initial admin password in installer | ||
|
風雪
|
5442b1c3a2 | fix: update installer bootstrap credential message | ||
|
風雪
|
43a1d4767f | fix updater repository owner | ||
|
風雪
|
6613dd925a | fix installer repository owner | ||
|
dzx941
|
5b4cb63a73 |
fix: align listener generation with mihomo official spec
- Port now supports mihomo ports format (single/range/list) - Add explicit RoutingMark field support - Auto-propagate UDP flag for vmess/vless/trojan/anytls/trusttunnel - Update validator to accept port ranges - Sync visual config and client converter port types - Rename module from dzx941 to kazeyukiro - Fix missing ExpiresAt in JWTClaims - Fix nodeDTO Port type to string - Fix frontend tsconfig and add missing dependencies |