Skip to content

v0.4.1 - security update

Latest
Latest

Choose a tag to compare

View all tags
@jpelaez-23blocks jpelaez-23blocks released this 28 Oct 16:36
v0.4.1
ae938c8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security update, 2026-10-28

  • aid-token.sh: the auth server URL is passed to jq as an argument, never spliced into the program text; the token cache is created 0600 and its directory 0700.
  • aid-helper.sh: the private key is generated under umask 077.
  • gateway and verifier: engines.node is now >=22 (Node 20 is end of life). Both packages have no dependencies and npm audit is clean.

Open: install.sh run through curl | bash downloads from the main branch without a checksum. See CHANGELOG.md.

Assets 2
Loading