v1.2.0 — Correctness & Hardening Release

Note: v1.1.0 was tagged against an older commit and is superseded by this release.

This release audits and corrects the previous build's scripts, build system, and CI. No new features; every change below is a fix.

Security

OpenSSL 3.3.7 → 3.5.7 (LTS). The 3.3.x branch left upstream support in April 2026. 3.5 is the current LTS branch, supported until April 2030, and keeps the same libssl.so.3 ABI — a drop-in replacement. 3.5.7 additionally fixes CVE-2026-45447 (heap use-after-free in PKCS7_verify()), CVE-2026-34182, CVE-2026-34183, CVE-2026-42764, and others.
Update checker no longer disables TLS verification. check_update.sh previously used wget --no-check-certificate. It now prefers the bundled curl (linked against the patched OpenSSL) with certificate verification, and it now checks this repository's releases instead of the upstream fork's — previously it would report "updates" from a different project entirely.
CGI input validation tightened.
- validate.sh gains the missing validateDT() — set_configs.sh has been calling it since the fork, so TIMELAPSE_DT changes were silently rejected.
- validateDir() and eventsfile.sh now use an allowlist (record directories are machine-generated alphanumeric names) instead of a character blocklist.
- The remaining blocklists (eventsfiledel.sh, eventsdirdel.sh, validate.sh) now also reject backticks, |, <, >, &, and — where filenames permit — /. The previous lists allowed slashes.
- Fixed the if ! $(validateX ...) anti-pattern (executes the function's output rather than checking its status) in proxy.sh, preset.sh, service.sh, and set_configs.sh.

README restored. A prior commit truncated README.md mid-code-block, deleting the final deploy steps, the config-hardening instructions, and the entire build guide.
service.sh: mismatched [[ ... ] bracket broke the watermark check in ONVIF profile setup.
snapshot.sh: OUTPUT_FILE=$(validateFile ...) captured the function's empty output and wiped the filename, silently breaking snapshot-to-file.
record.sh: invalid time values were never rejected — the script compared the variable against a string the validator never produces. Now checks the validator's return status.
ptz_presets.sh: removed a redundant --* case pattern shadowed by -*.
system.sh: ~ inside quotes never expands, so the .ash_history → /dev/null symlink check always re-ran; now uses $HOME.
launch.sh: self-unquoting debug_flag="-d "$debug_level"" assignments (×3) fixed.
.gitattributes was named gitattributes (no dot), so the line-ending rules were never applied.

ShellCheck lint now gates the build. The step previously ended in || true (could never fail) and excluded codes from an outdated shellcheck, flooding logs with 553 findings. The job now uses a documented busybox-ash exclusion list, and the tree is lint-clean under it.
Mosquitto build target uses the same extract guard as other packages instead of wiping and re-extracting each run.
scripts/ renamed to toolchain/ (it only contains cross-compile definition files); Makefile and Dockerfile references