Skip to content

v1.0.0-rc1

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Aug 00:55
· 4 commits to main since this release
v1.0.0-rc1
1e046d6
This commit was created on GitHub.com and signed with GitHub鈥檚 verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A release candidate for 1.0.0. It carries 52 pull requests since v0.7.2 and closes two rounds of security and correctness review.

Upgrading

Re-sign every URL before you deploy this. Two changes to the signature mean no existing signed URL validates.

  • Every query parameter now takes part in the signature. Only the parameters named by _keys did before, which left overlay unprotected, so a caller holding one valid signed watermark URL could point the overlay at any address the service could reach.
  • The signed message is canonical. It holds the command path, the image URL, then the signed parameters as percent-encoded name=value pairs ordered by name, one field per line. The parameter name is part of the message, so two requests that differ only in where a character sits between adjacent parameters no longer share a signature.

DIMS_SIGNING_COMPAT=legacy accepts the mod_dims _keys signature. It does not accept signatures made by an earlier go-dims release.

The signing page carries the construction with a working implementation in PHP, Python, JavaScript, and Ruby.

Check these defaults against your traffic. Each one refuses a request that an earlier release served.

Setting Default What it refuses
DIMS_ALLOW_PRIVATE_NETWORKS false An origin that resolves to a loopback, link local, or private address. Set it to true when the origin sits inside your network.
DIMS_MAX_SOURCE_BYTES 64 MB A larger source image, with 400.
DIMS_MAX_SOURCE_PIXELS 100 MP A larger source image, with 400.
DIMS_MAX_OUTPUT_PIXELS 50 MP A larger result, with 400.
DIMS_MAX_CONCURRENT CPU count Work past the limit queues for DIMS_MAX_CONCURRENT_WAIT, then returns 503.

An unknown command name now returns an error. It used to be ignored, which served a differently processed image without saying so.

Terraform. signing_key is required, development_mode defaults to false, and the Lambda function URL defaults to AWS_IAM. A precondition blocks a public unsigned deployment.

Security

  • The source address is checked at the socket, once per connection. A name that resolves to a private address is refused whatever it is called, and a redirect is checked the same way as the original request. DIMS_ALLOWED_HOSTS and DIMS_MAX_REDIRECTS narrow it further.
  • The file backend is contained with os.OpenRoot, so a path cannot leave the base directory, including by way of a symlink.
  • Signatures are compared in constant time, and the digest is the full HMAC-SHA256.
  • Two data races are fixed, on the shared configuration and on the HTTP client.

Added

  • Conditional requests. A response carries an ETag, and a request sending a matching If-None-Match gets 304.
  • Source and output pixel caps, a source byte cap, and separate limits on how many images are processed and downloaded at once.
  • Server read, write, and idle timeouts, and a graceful shutdown that lets requests in flight finish.
  • The libvips operation cache and thread count are configurable.
  • The sepia command.
  • Twenty settings in total. The configuration reference lists them.

This candidate

dims version reports 1.0.0-rc1. The container is published as ghcr.io/beetlebugorg/go-dims:1.0.0-rc1 and :next. The :latest tag still points at the last finished release.

What's Changed

New Contributors

Full Changelog: v0.7.2...v1.0.0-rc1

Contributors

beetlebugorg and dependabot
Assets 6
Loading