Safe Online Exam 1.0.7

Safe Online Exam 1.0.7 is a backward-compatible Canvas detector compatibility
hotfix. It adds no database migration, OAuth scope, LTI registration URL, or
public compatibility endpoint.

Sharded Canvas installations

• Keep hidden-course-navigation launches working when Canvas's External Tools
  API returns a shard-local Developer Key ID for the globally qualified LTI
  client ID.
• Preserve exact client-ID matching and continue rejecting malformed, zero,
  or unrelated IDs while retaining the existing LTI version and deployment-ID
  checks.

See the v1.0.7 changelog for the canonical release record.

Published container image

ghcr.io/jsb2010/safe-online-exam@sha256:4da146026db2218c4162c875f72ec26f8cd2997895f67705a90d3d9c3d38bacd

Production deployments must use this immutable digest. The 1.0.7,
major/minor, major, and latest tags are discovery and notification aliases,
not deployment pins.

Verify provenance

Install Docker, the GitHub CLI (gh), and jq, then authenticate gh.
Verify the image against the exact release workflow, source commit, and tag:

gh attestation verify \
  oci://ghcr.io/jsb2010/safe-online-exam@sha256:4da146026db2218c4162c875f72ec26f8cd2997895f67705a90d3d9c3d38bacd \
  --repo JSB2010/safe-online-exam \
  --signer-workflow JSB2010/safe-online-exam/.github/workflows/publish-release-image.yml \
  --source-digest c627bc57e9c725328dabf287281b493ad64269f0 \
  --source-ref refs/tags/v1.0.7

Cloud Run install or upgrade

The Cloud Run bundle uses plain gcloud, docker, jq, openssl, and
curl. It pins exact Secret Manager versions, runs the database migration
before application traffic changes, verifies a tagged no-traffic revision, and
then performs an explicit 100% cutover.

VERSION=1.0.7
curl -fLO "https://github.com/JSB2010/safe-online-exam/releases/download/v${VERSION}/safe-online-exam-${VERSION}-cloud-run.tar.gz"
curl -fLO "https://github.com/JSB2010/safe-online-exam/releases/download/v${VERSION}/safe-online-exam-${VERSION}-cloud-run.tar.gz.sha256"
sha256sum --check "safe-online-exam-${VERSION}-cloud-run.tar.gz.sha256"
tar -xzf "safe-online-exam-${VERSION}-cloud-run.tar.gz"
cd "safe-online-exam-${VERSION}-cloud-run"
./setup.sh

The guided setup walks through configuration, Cloud SQL cost selection,
protected secret generation, the Canvas Developer Key handoff, installation,
LTI registration, and finalization. Use ./setup.sh --help for resumable
stages and the fully unattended file-based interface. The lower-level phase
commands remain available for explicit orchestration.

For an existing installation, merge new keys from cloudrun.env.example into
the protected prior cloudrun.env, set the new digest, and run:

./upgrade.sh cloudrun.env

The upgrade creates and verifies a backup of the configured
SQL_INSTANCE. Application rollback does not reverse database migrations.

Docker Compose install or upgrade

VERSION=1.0.7
curl -fLO "https://github.com/JSB2010/safe-online-exam/releases/download/v${VERSION}/safe-online-exam-${VERSION}-compose.tar.gz"
curl -fLO "https://github.com/JSB2010/safe-online-exam/releases/download/v${VERSION}/safe-online-exam-${VERSION}-compose.tar.gz.sha256"
sha256sum --check "safe-online-exam-${VERSION}-compose.tar.gz.sha256"
tar -xzf "safe-online-exam-${VERSION}-compose.tar.gz"
cd "safe-online-exam-${VERSION}"
./setup.sh

The guided setup covers HTTPS mode, Canvas values, protected secret
generation, validation, startup, and readiness. Use ./setup.sh --help for
the non-interactive configuration-and-secret-file interface.

On an upgrade, preserve the existing secret files and database volume, merge
new keys from the downloaded .env.compose.secrets.example into the protected
.env.secrets, and run ./upgrade.sh .env.secrets. The command creates a
validated PostgreSQL backup before pulling or restarting containers.

The published multi-architecture manifest contains linux/amd64 and
linux/arm64. The published digest in this section is
sha256:4da146026db2218c4162c875f72ec26f8cd2997895f67705a90d3d9c3d38bacd.