Skip to content

CodexMeter 2.0.11

Choose a tag to compare

View all tags
@dlfkdLR dlfkdLR released this 12 Sep 06:10
· 82 commits to main since this release
v2.0.11
2bef51f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CodexMeter 2.0.11

Two fixes from a security review of everything added since 2.0.8.

  • Provider responses are no longer written to the system log. Three
    providers logged the first few hundred bytes of a usage response with
    privacy: .public, which overrides the redaction macOS applies by default.
    That put plan, spend and account identifiers in the clear — readable by other
    processes on the Mac, and captured verbatim by any sysdiagnose bundle. Only
    response sizes are logged now, and a test fails the build if a payload is
    ever marked public again.
  • Provider responses have a ceiling. The nine third-party endpoints the
    notch polls had no size limit, so a vendor incident returning a very large
    body could grow the app's memory until macOS killed it. An oversize response
    now fails that one ring instead. Measured at 0.66 ms against 0.69 ms
    unbounded — an ordinary reading costs nothing extra.

Neither was reachable from outside the Mac, and no credential was exposed. Both
were reported by the review rather than seen in the wild.

Verification

  • 658 automated tests passed, 9 environment-specific checks skipped.
  • The response ceiling is exercised against a real loopback HTTP server: an
    ordinary response, a declared oversize body, an oversize body that declares no
    length at all, and a body exactly at the ceiling.
  • swift build with zero warnings and zero errors.

Installation

  • macOS 14 or later; Universal 2 for Apple Silicon and Intel.
  • Ad-hoc signed and not Apple-notarized. Verify the first download with
    SHA256SUMS.txt; subsequent Sparkle updates are authenticated with Ed25519
    signatures.
  • No usage database migration or automatic credential changes.

Download the DMG and checksum list into the same folder, then verify before
opening:

cd ~/Downloads
grep ' CodexMeter-2.0.11.dmg$' SHA256SUMS.txt | shasum -a 256 -c -
open CodexMeter-2.0.11.dmg

Homebrew users can update with:

brew update
brew upgrade --cask --greedy dlfkdLR/tap/codexmeter
xattr -dr com.apple.quarantine /Applications/CodexMeter.app
open /Applications/CodexMeter.app

Recovery

This release does not migrate any database. Published version tags are
immutable; corrections ship as a new patch release.

Assets 8
Loading