v0.10.3
Security hardening. No feature or keybinding changed, so nothing you use day to day moves. Upgrading is still worth doing, particularly on a shared machine or on Windows.
What was wrong
Logs opened with e sat in a shared temp directory. They were written to /tmp/lazygocd-<pipeline> at a predictable path with default permissions. A GoCD console log routinely carries build secrets, so on a multi-user Linux box any other local user could read one. The predictable name also meant someone could pre-create a symlink there and redirect the write. Logs now go in a private per-user directory, mode 0700, with files at 0600.
The dashboard cache was world-readable. dashboard_cache.json lists every pipeline and group name on your server, and it was written at 0644. It and favorites.json are now 0600, and the config directory is created 0700.
The config file was briefly readable. It was written and then chmodded, which left the credential at default permissions for the moment in between. It is now created owner-only. A file left behind at looser permissions by an older version is tightened on the next write.
A crafted material URL could run a command on Windows. Pressing o opens a commit in your browser, and on Windows that goes through cmd /C start, which re-parses &, | and ^ that Rust's argument quoting leaves alone. The host, owner and repo came straight out of a GoCD Git material description with no validation, so anyone who could configure a pipeline's material could reach a Windows user who pressed o. Those parts are now validated, and the browser handoff rejects anything unexpected.
Names were interpolated raw into request paths. Pipeline, stage, job and branch names are now percent-encoded.
The GitHub token could go out over plain http. It is now only sent to an https API base.
Also in this release
Docs now say what skipping TLS verification actually costs: your credential goes out on every request over a connection nothing authenticates. In CI, the Snyk token reaches only the scan step rather than the steps that run crates.io build scripts, and the release workflow passes the ref name through the environment instead of interpolating it into a shell command.
Upgrading
brew update && brew upgrade lazygocd
brew update matters. Homebrew refreshes a tap at most once a day, so without it brew upgrade can report that an older version is already the latest.