Skip to content

v5.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Oct 08:04
· 3 commits to main since this release
v5.3.0
This tag was signed with the committer’s verified signature.
toomore Toomore Chiang
GPG key ID: F8C295EF0A1671AE
Verified
Learn about vigilant mode.
5462c26
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Send v5.3.0

The image now runs Node 24, and the release pipeline is tightened. If you run
v5.2.1 or earlier, upgrade to this one.

This is the build that powers send.anoni.net.

Nothing about how Send works has changed

The wire protocol, the URL format and the encryption are untouched. Existing
share links and ffsend keep working. /__version__ reports version: v3.4.27
and release: v5.3.0.

What changed

  • Node 24. The image moves to node:24-alpine3.24, running Node 24.21.0.
    Node 22 reaches end of life on 2027-04-30. CI runs lint and both test suites
    on Node 24, and still checks that Node 22 and Node 24 build byte-identical
    output.
  • Verify against version tags only. The documented cosign identity is now
    publish.yml@refs/tags/v.*$. The previous publish.yml@.*$ also accepted a
    signature from a run on any branch, and a manual run from a branch could
    publish one. Only main and v* tags publish now. Use the new identity below.
  • Signing permission only where signing happens, pinned test tooling
    (Playwright from the lockfile, Redis by digest, the ffsend binary checked
    against a recorded sha256), and postcss-selector-parser 7.1.6 for a
    build-time advisory.
  • Docs. The test guide matches the current setup, and SECURITY.md lists
    GitHub private vulnerability reporting next to whisper@anoni.net.

Details are in CHANGELOG.md.

Verify this release

docker pull ghcr.io/anoni-net/send:5.3.0

cosign verify ghcr.io/anoni-net/send:5.3.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/anoni-net/send/.github/workflows/publish.yml@refs/tags/v.*$'

SHA256SUMS.txt below lists the sha256 of every file the server serves to a
browser, and it is signed:

cosign verify-blob SHA256SUMS.txt \
  --bundle SHA256SUMS.txt.cosign.bundle \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/anoni-net/send/.github/workflows/publish.yml@refs/tags/v.*$'

VERIFYING.md walks
through checking what an instance served you, the image signature, and rebuilding
from source.

Pin by digest in production so the tag cannot move under you:
ghcr.io/anoni-net/send@sha256:3f512daea37589ec7038301b97e929d50f10234e333f29cbda6b0266a1a5edc1

Credit

Send was built by Mozilla and kept alive by
Tim Visée after Firefox Send shut down. This
release stands on both. We are not affiliated with, nor endorsed by, either.

Send v5.3.0（正體中文）

映像改用 Node 24 執行，發布流程也收緊了。執行 v5.2.1 或更早版本的營運者請升級到這個版本。

這就是 send.anoni.net 所使用的版本。

Send 的運作方式沒有改變

通訊協定、網址格式與加密方式都沒有變動，既有的分享連結與 ffsend 照常可用。/__version__ 回報 version: v3.4.27 與 release: v5.3.0。

改了什麼

  • Node 24：映像改用 node:24-alpine3.24，Node 版本是 24.21.0。Node 22 在 2027-04-30 停止支援。CI 的 lint 與兩組測試都改在 Node 24 上執行，也持續確認 Node 22 與 Node 24 建置出的檔案位元一致
  • 驗證時只接受版本 tag：文件裡的 cosign 身分改成 publish.yml@refs/tags/v.*$。原本的 publish.yml@.*$ 也會接受任何分支執行產生的簽章，而從分支手動執行就可能發布出這樣的映像。現在只有 main 與 v* tag 會發布。請改用下方的新身分驗證
  • 其他發布流程的調整：簽章權限只留在負責簽章的 job。測試工具都固定版本：Playwright 跟著 lockfile、CI 的 Redis 固定 digest、ffsend 執行檔先比對 sha256。postcss-selector-parser 升到 7.1.6，修補一個只影響建置階段的漏洞
  • 文件：測試說明改寫成現況，SECURITY.md 在 whisper@anoni.net 之外列出 GitHub 的私下回報漏洞管道

詳細內容見 CHANGELOG.md。

驗證這個版本

docker pull ghcr.io/anoni-net/send:5.3.0

cosign verify ghcr.io/anoni-net/send:5.3.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/anoni-net/send/.github/workflows/publish.yml@refs/tags/v.*$'

下方的 SHA256SUMS.txt 列出伺服器會送給瀏覽器的每一個檔案的 sha256，而且有簽章：

cosign verify-blob SHA256SUMS.txt \
  --bundle SHA256SUMS.txt.cosign.bundle \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/anoni-net/send/.github/workflows/publish.yml@refs/tags/v.*$'

VERIFYING.md 說明如何檢查某個實例送給你的檔案、映像簽章，以及從原始碼重新建置。

正式環境請用 digest 固定版本，tag 才不會在你不知情的情況下被移動：
ghcr.io/anoni-net/send@sha256:3f512daea37589ec7038301b97e929d50f10234e333f29cbda6b0266a1a5edc1

致謝

Send 由 Mozilla 打造，並在 Firefox Send 關閉之後由 Tim Visée 維持存續，這個版本建立在兩者之上。我們與他們沒有從屬關係，也未獲得他們背書。

Assets 4
Loading