Skip to content

Nexus v0.1.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Oct 11:11
· 21 commits to main since this release
v0.1.3
f691560
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

An important security update. Please install it.

Security

  • Nexus now checks a server's identity before connecting. Until now, terminal sessions, SFTP and "Test Connection" accepted any server key without asking, even if the key had changed. That means someone between you and the server could have posed as it and seen your password and session. Now:

    • The first time you connect to a server, Nexus shows its fingerprint and asks whether to trust it. Always Accept remembers it; Accept Once trusts it just this time.
    • Known servers connect without asking.
    • If a server's key changes, you get a clear warning, and nothing connects until you decide.

    Because no keys were saved before this update, every server asks once after you install it. (#10)

Under the hood

  • New automated tests: a terminal session, an SFTP download, and the trust prompt, all against a local test server. (#9, #10)

Vault sync over SFTP gets the same protection in a follow-up release.

Full Changelog: v0.1.2...v0.1.3

Assets 10
Loading