Skip to content

Nexus v0.1.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Oct 13:41
· 19 commits to main since this release
v0.1.4
fae9b97
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A security update for vault sync over SFTP. Please install it.

Security

  • Vault sync over SFTP now checks the server's identity. This is the follow-up promised in v0.1.3. Until now, syncing your vault over SFTP accepted any server key, so someone between you and your sync server could have posed as it, seen your SFTP login, or handed you a different vault file. Now:

    • Background syncs only connect to a server you've already trusted. If the server is unknown, or its key has changed, the sync stops with a clear message and never pops up a prompt out of nowhere.
    • To trust your sync server, open Settings → Vault Sync and click Test Connection. Check the fingerprint and choose Always Accept. If you already trusted the same server from a terminal connection, there's nothing to do.

    After installing: if you sync over SFTP, run Test Connection once, or syncing will pause. (#12)

Fixes

  • Test Connection in Vault Sync now says why a connection failed (for example, a rejected or changed host key) instead of just "Connection failed". (#12)

Under the hood

  • New automated tests for SFTP sync host-key checks, against a local test server, plus an end-to-end test of the Vault Sync settings. (#12)

Full Changelog: v0.1.3...v0.1.4

Assets 10
Loading