5.0.3

Fixed

• On POSIX, --debug-logs creates or reopens b2_cli.log with owner-only permissions (0600) when O_NOFOLLOW, O_NONBLOCK, and fchmod are available. The command exits if a required control is unavailable, the log path is a symlink, has multiple hard links, or is a non-regular file, the file is owned by another user, or an existing file cannot be secured.
• The bucket notification-rule create and bucket notification-rule update commands no longer log signing secrets or custom header values in command arguments or SDK call traces. The bucket notification-rule delete command also suppresses these values in SDK call traces.
• The bucket notification-rule create and bucket notification-rule update commands no longer echo invalid --sign-secret values in validation errors.

Infrastructure

• Updated development tooling dependencies to incorporate compatible security fixes. (#1201)
• Make the .sdkharness files.list conformance check upload a nested name, so a client that ignores ls --recursive fails it.
• Make the .sdkharness upload.stall recovery check run: it stalls the upload for 130 s, longer than the 128 s upload timeout of b2sdk, instead of reporting that no client option can shorten it.