Releases: 291-Group/LAN-Sheriff
Release list
v1.0.1
LAN Sheriff v1.0.1
Nothing leaves town unnoticed.
Fixed in this release
An unbounded allocation reachable from the dashboard. The limit query
parameter was passed to the store unclamped and used as a slice capacity, so a
request such as ?limit=500000000 asked Go for tens of gigabytes in a single
allocation and killed the process. It is now clamped for every endpoint that
takes a limit.
Found by CodeQL. Reachable by anyone who can open the dashboard, which on the
default loopback bind means somebody already on the machine, and on a network
bind means an authenticated user. Upgrading is the fix; there is no workaround
short of not exposing the dashboard.
Download the archive for your platform, unpack it, and run lan-sheriff.
No configuration, no account, and no elevated privileges for Deputy Mode.
Patrol Mode (which sees every device rather than only this machine) is
compiled in. It needs privilege, not a rebuild; the dashboard tells you the
exact command for your system if it is unavailable.
Shipped unsigned by a certificate authority. macOS will say the developer
cannot be verified and Windows SmartScreen will hide the run button; the
README
explains the way past each. A signed build follows as a point release and
changes nothing about the software.
Homebrew and Scoop are published, and both were installed and run from the
published release before this note was written:
brew install 291-group/tap/lan-sheriffscoop bucket add 291group https://github.com/291-Group/scoop-bucket
scoop install lan-sheriffThe Homebrew cask clears the quarantine attribute as it installs, so macOS does
not report the binary as coming from an unverified developer.
Checking what you downloaded
Every archive is listed in checksums.txt, and that file is signed. The
signature is keyless: it is bound to the GitHub Actions run that built this
release and recorded in a public transparency log, so verifying it requires
trusting sigstore rather than trusting us.
cosign verify-blob checksums.txt \
--signature checksums.txt.sig \
--certificate checksums.txt.pem \
--certificate-identity-regexp 'https://github.com/291-Group/LAN-Sheriff' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt --ignore-missinginstall.sh does the checksum half of this for you and refuses to install
without it.
_portable archives are built without packet capture. They run
anywhere and offer Deputy Mode only. Use one if the standard build will not
start, or if you would rather not have a capture library in the process.
Full Changelog: https://github.com/291-Group/LAN-Sheriff/commits/v1.0.0
v1.0.0
LAN Sheriff v1.0.0
Nothing leaves town unnoticed.
Download the archive for your platform, unpack it, and run lan-sheriff.
No configuration, no account, and no elevated privileges for Deputy Mode.
Patrol Mode (which sees every device rather than only this machine) is
compiled in. It needs privilege, not a rebuild; the dashboard tells you the
exact command for your system if it is unavailable.
Shipped unsigned by a certificate authority. macOS will say the developer
cannot be verified and Windows SmartScreen will hide the run button; the
README
explains the way past each. A signed build follows as a point release and
changes nothing about the software.
Homebrew and Scoop are published, and both were installed and run from the
published release before this note was written:
brew install 291-group/tap/lan-sheriffscoop bucket add 291group https://github.com/291-Group/scoop-bucket
scoop install lan-sheriffThe Homebrew cask clears the quarantine attribute as it installs, so macOS does
not report the binary as coming from an unverified developer.
Checking what you downloaded
Every archive is listed in checksums.txt, and that file is signed. The
signature is keyless: it is bound to the GitHub Actions run that built this
release and recorded in a public transparency log, so verifying it requires
trusting sigstore rather than trusting us.
cosign verify-blob checksums.txt \
--signature checksums.txt.sig \
--certificate checksums.txt.pem \
--certificate-identity-regexp 'https://github.com/291-Group/LAN-Sheriff' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt --ignore-missinginstall.sh does the checksum half of this for you and refuses to install
without it.
_portable archives are built without packet capture. They run
anywhere and offer Deputy Mode only. Use one if the standard build will not
start, or if you would rather not have a capture library in the process.
Full Changelog: https://github.com/291-Group/LAN-Sheriff/commits/v1.0.0