QSObook v0.2.0

Release notes

QSObook v0.2.0

This stable release adds optional RadioID autofill to the existing QSO workspace. Ready-made Linux ARM64/AMD64 images and digest-pinned Compose downloads use schema 8. RadioID remains disabled by default; no external account is required.

• Optional RadioID autofill, off by default: Enter first reads SQLite, then performs an exact backend lookup only when necessary. The UI stays editable and reports progress/outcomes in all four languages.
• Missing fields are persisted locally. Manual values, edits made during lookup, and saves before the response arrives take priority. Multiple returned DMR IDs share one station; historical QSOs and closed/removed participations are preserved.
• Persistent retries for incomplete registered stations: at most ten per daily batch, spaced requests, provider cooldowns, seven-day no-match caching and offline manual entry.
• Schema 8 adds consent, retry/origin metadata and participant snapshots; validated backups accept exact schemas 5–8. Back up first: v0.1.0 cannot open schema 8.
• Removed obsolete screenshots/beta text, repeated style rules and duplicate security checks. Current screenshots, licenses, migrations and unique integrity/recovery regressions remain.
• Updated English usage, architecture, security, installation, recovery and contribution guides. No new runtime dependency, authentication model or Host/Origin/CSP policy.

Upgrade from v0.1.0

Back up before upgrading. Preserve the existing project, .env, password files and qsobook_data volume; never use down -v. Download the v0.2.0 release files into a separate directory, verify SHA256SUMS, then replace only your chosen Compose profile and recreate the service. See the update commands.

The first start migrates the notebook transactionally from schema 7 to 8, preserving registrations, QSOs and participation history. RadioID starts off. To use it, enable RadioID autofill under Preferences and press Enter in the QSO callsign field. Manual entry and local lookup continue to work offline. Enabling RadioID permits exact callsign requests and bounded daily retries; no notes or QSO details are sent.

v0.1.0 cannot open a schema-8 notebook. Rollback requires the separately preserved schema-7 backup and old deployment files. Never edit the schema version or point an older image at the only live copy. Schema-8 backups also restore their saved RadioID consent; review that option after restoration.

Validation includes Go tests with the race detector, vet, JavaScript regressions, vulnerability scanning and native Linux AMD64/ARM64 container checks. These checks do not replace a backup or deployment-specific manual testing. The supported access model remains a trusted LAN/VPN, with an optional shared password; this is not a public multi-user service.

QSObook v0.1.0

The first stable release of QSObook, following beta-5 use on the maintainer’s Raspberry Pi. It preserves the minimal Go/SQLite/browser architecture, optional maps, four interface languages and password-free trusted LAN/VPN access.

Reviewed and corrected

• Write targets now come only from the POST body; URL parameters cannot supply a missing record ID or city. Existing CSRF, Host, Origin, CSP and frame controls remain in place.
• Monthly contact totals now normalize stored timestamp offsets before applying the configured calendar-month boundaries.
• Removed unused legacy queries and styles. Consolidated duplicate security and lookup tests while preserving migration, historical-snapshot, backup/restore and replay regressions.
• Stable releases publish to the stable and latest Docker channels. Beta releases keep a separate beta channel. Downloads pin exact image digests, and release versions are never reused.

Included

One QSO workspace for listening or optional named roundtables, remembered round names/editions, explicit QSO confirmation, QRT/return, independent operator/conversation notes, local callsign autofill, responsive white/pastel and dark themes, a Notebook, opt-in cached city maps, recoverable deletion, validated SQLite backup/restoration and previewed ASCII ADIF transfer.

Update safely

Preserve your notebook; do not wipe or reinstall it. Back up first, then use the checksum-verified Compose files with your existing .env, project and qsobook_data volume. Beta 5 and v0.1.0 both use schema 7, so this upgrade introduces no new migration or database format. Older betas migrate transactionally. Never use down -v to update.

See the installation/update guide, data guide and security review.

This is for trusted local/private networks, with an optional shared password. It is not a public multi-user service. Checks are source review, automated regressions, vulnerability scanning and hosted native AMD64/ARM64/container validation, not an independent external security audit. Ordinary simultaneous edits still use the last saved values; backups are unencrypted and must be stored privately. ADIF is contact interchange, not a full backup.

QSObook v0.1.0

QSObook v0.1.0

The first stable release of QSObook, following beta-5 use on the maintainer’s Raspberry Pi. It preserves the minimal Go/SQLite/browser architecture, optional maps, four interface languages and password-free trusted LAN/VPN access.

Reviewed and corrected

• Write targets now come only from the POST body; URL parameters cannot supply a missing record ID or city. Existing CSRF, Host, Origin, CSP and frame controls remain in place.
• Monthly contact totals now normalize stored timestamp offsets before applying the configured calendar-month boundaries.
• Removed unused legacy queries and styles. Consolidated duplicate security and lookup tests while preserving migration, historical-snapshot, backup/restore and replay regressions.
• Stable releases publish to the stable and latest Docker channels. Beta releases keep a separate beta channel. Downloads pin exact image digests, and release versions are never reused.

Included

One QSO workspace for listening or optional named roundtables, remembered round names/editions, explicit QSO confirmation, QRT/return, independent operator/conversation notes, local callsign autofill, responsive white/pastel and dark themes, a Notebook, opt-in cached city maps, recoverable deletion, validated SQLite backup/restoration and previewed ASCII ADIF transfer.

Update safely

Preserve your notebook; do not wipe or reinstall it. Back up first, then use the checksum-verified Compose files with your existing .env, project and qsobook_data volume. Beta 5 and v0.1.0 both use schema 7, so this upgrade introduces no new migration or database format. Older betas migrate transactionally. Never use down -v to update.

See the installation/update guide, data guide and security review.

This is for trusted local/private networks, with an optional shared password. It is not a public multi-user service. Checks are source review, automated regressions, vulnerability scanning and hosted native AMD64/ARM64/container validation, not an independent external security audit. Ordinary simultaneous edits still use the last saved values; backups are unencrypted and must be stored privately. ADIF is contact interchange, not a full backup.

QSObook v0.1.0-beta.5

QSObook test beta 5

This beta unifies the live QSO workflow and adds data recovery and portability while preserving Go, SQLite and the compact browser interface. Linux AMD64 and ARM64 images are published after native tests and real container integration checks.

Included

• QSO mode in the main navigation, replacing duplicate entry panels. Start an ordinary listening session or opt into a named roundtable with an optional edition; the last name/edition is remembered locally.

• One entry form and live participant list. Adding a station never confirms a QSO; use the unchecked confirmation box or the row action. Permanent and conversation notes remain separate. QRT dims/moves departed stations below active ones, with a return action.

• White light mode with restrained pastel accents, dark/system themes, compact phone controls, current screenshots and a starter English Wiki.

• Recoverable deletion of QSOs and stations, with confirmation and a Trash screen. Historical snapshots, links and replay keys remain intact; no permanent purge.

• Consistent online SQLite backup downloads and validated full-notebook restoration. Review the preview before confirming; a durable pre-restore recovery snapshot is saved first, replacement is transactional and old forms expire.

• Fifty-row pagination, callsign/name/city search with common Latin accent folding and local-calendar date ranges.

• ADIF ASCII ADI export/import with preview, explicit unsupported-field disclosure, conservative duplicate handling and preservation of current registrations. Unicode/custom QSObook values survive in APP_QSOBOOK_DATA; other programs may ignore this extension. ADX and non-ASCII ADI are not supported.

• Offline coordinate corrections and explicit retries for cached/no-match cities under the existing map opt-in, geographic-only requests and cooldowns. Imports never geocode automatically.

• Installed version/source/schema display, -version, English documentation and current desktop/mobile screenshots. Four interface languages remain supported.

Upgrade carefully

Back up before updating. Schema 7 adds nullable deletion timestamps/indexes plus optional round editions and remembered roundtable names. The migration preserves existing data; beta 4 cannot open the upgraded notebook. Keep a pre-upgrade schema-5 snapshot for rollback. A raw database copied while running may be incomplete without its journals; use a consistent snapshot or the stopped-directory backup procedure.

The restore UI accepts exact schema-5/6/7 snapshots up to 64 MiB, replacing the complete notebook only after confirmation. ADIF imports are limited to 16 MiB/10,000 records and do not replace a full backup. Recovery copies stay on the server until managed manually; download an external offline copy. See data and recovery procedures.

Use the downloaded checksum-verified, digest-pinned Compose files and preserve .env, the project name and qsobook_data. Password-free trusted LAN/VPN deployment remains available in compose.lan.yaml; optional shared-password access uses compose.auth.yaml. Host/Origin/CSRF/CSP protections remain in place. Do not expose the unauthenticated configuration to the internet. Never use down -v to update.

This remains a testing beta. Native hosted ARM64/container checks do not replace physical Raspberry Pi testing. Downloading a new GitHub commit does not deploy to your Pi. Follow the installation/update guide.

QSObook v0.1.0-beta.4

A testing beta of QSObook, a free local amateur radio notebook.

• A unified Records screen: register an operator and optionally confirm a QSO without starting a roundtable. Confirmation starts unchecked; country has no default.
• Local country dropdowns in four UI languages, common modes and wavelength bands, custom values and an optional roundtable name.
• Transactional form replay protection, automatic timestamps, independent notes and preserved historical snapshots.
• A smaller monthly/total/city summary; optional cached map, approximate home marker, mode colors and local mode/band filters.
• Opt-in city geocoding when saving a location or confirmed contact. User-triggered geographic queries only, caching, bounded requests and rate limits; provider failure never discards a saved contact. No startup batches or external autocomplete.
• More compact rounded mobile forms; original SVG branding; bundled SIL OFL Atkinson Hyperlegible fonts and Unicode-licensed country data. No new runtime dependencies or remote fonts.
• Existing roundtables, participants, QRT and history remain accessible. Passwords remain optional for private LAN/VPN use; Host/Origin/CSRF/frame protections are unchanged.

Back up before upgrading: this release migrates SQLite schema 4 to 5. Existing records, IDs, links and cache are retained. Band starts blank for older contacts; home city is empty and geocoding-on-save is disabled until selected. An older beta cannot open the upgraded notebook. Keep the stopped pre-upgrade backup and earlier release files for rollback; do not delete or recreate the data volume.

Download compose.lan.yaml for LAN/VPN access without a password, compose.auth.yaml for optional shared-password access, or compose.yaml for loopback-only access. Images support Linux ARM64 and AMD64, and release Compose assets pin their exact digest. Read the installation, backup and update guide. Reload open browser pages after updating.

Maps require opt-in and internet for tiles/geocoding; core recording and lookup remain local/offline. Follow the Nominatim policy and manage aggregate usage across instances. Unmapped older cities need an explicit location action; no-match results are cached. Independent concurrent edits still use last-write-wins. No individual accounts, automatic deployment, in-app backup/restore or ADIF export yet. Without a password, network/VPN rules must restrict access to the port. This beta is not an external security audit.

QSObook v0.1.0-beta.3

A testing beta of QSObook, a free local amateur radio notebook.

This release fixes native browser form submissions being rejected with “Origem não permitida” when starting a round, saving a contact or changing map/language preferences. The previous no-referrer policy caused browsers to send Origin: null; same-origin preserves legitimate form Origins while keeping external referrers private. Null/external Origins, invalid CSRF tokens and cross-site requests remain rejected. No database or dependency changes. Reload open pages after updating.

• QSO rounds with independent participation, QRT status and explicit contact confirmation.
• Safe local callsign lookup, reusable operators, independent notes and preserved contact snapshots.
• Portuguese, English, Spanish and French, light/dark themes and a responsive phone layout.
• Optional OpenStreetMap city map, disabled until explicitly enabled.
• Ready-to-run Linux ARM64 and AMD64 images at ghcr.io/erickfaria/qsobook.
• Private-LAN/VPN access with an optional shared password and explicit allowed hostnames.

Download compose.lan.yaml for private LAN/VPN access without a password, compose.auth.yaml to require a shared password, or compose.yaml for loopback-only use. Published Compose assets pin the image digest. Installation, password setup, cold backups and manual updates are explained in the beta installation guide.

Images are built and tested natively on both architectures after Go tests, vet, vulnerability checks and JavaScript regressions. Container tests cover authentication, HTTP security, duplicate confirmation, stopped-database backup integrity and persistence after recreation. The publication includes GitHub provenance attestations. This is not a security audit or a guarantee of defect-free software.

Known limits: private/trusted networks only; HTTP does not encrypt passwords or contacts. Use HTTPS/VPN for untrusted networks or remote access. No individual user accounts, automatic updates, in-app backup/restore, ADIF export or supported stable release line yet. Keep offline backups before upgrades. Physical Raspberry Pi testing is the next step; hosted ARM64 tests do not replace it. Without a password, anyone who can reach the published port can read/change the notebook. Network/VPN rules must restrict access. Upgrading from beta.1 preserves the data volume and existing password file; use compose.auth.yaml to keep authentication. No database schema changes.

QSObook v0.1.0-beta.2

A testing beta of QSObook, a free local amateur radio notebook.

• QSO rounds with independent participation, QRT status and explicit contact confirmation.
• Safe local callsign lookup, reusable operators, independent notes and preserved contact snapshots.
• Portuguese, English, Spanish and French, light/dark themes and a responsive phone layout.
• Optional OpenStreetMap city map, disabled until explicitly enabled.
• Ready-to-run Linux ARM64 and AMD64 images at ghcr.io/erickfaria/qsobook.
• Private-LAN/VPN access with an optional shared password and explicit allowed hostnames.

Download compose.lan.yaml for private LAN/VPN access without a password, compose.auth.yaml to require a shared password, or compose.yaml for loopback-only use. Published Compose assets pin the image digest. Installation, password setup, cold backups and manual updates are explained in the beta installation guide.

Images are built and tested natively on both architectures after Go tests, vet, vulnerability checks and JavaScript regressions. Container tests cover authentication, HTTP security, duplicate confirmation, stopped-database backup integrity and persistence after recreation. The publication includes GitHub provenance attestations. This is not a security audit or a guarantee of defect-free software.

Known limits: private/trusted networks only; HTTP does not encrypt passwords or contacts. Use HTTPS/VPN for untrusted networks or remote access. No individual user accounts, automatic updates, in-app backup/restore, ADIF export or supported stable release line yet. Keep offline backups before upgrades. Physical Raspberry Pi testing is the next step; hosted ARM64 tests do not replace it. Without a password, anyone who can reach the published port can read/change the notebook. Network/VPN rules must restrict access. Upgrading from beta.1 preserves the data volume and existing password file; use compose.auth.yaml to keep authentication. No database schema changes.

QSObook v0.1.0-beta.1

A testing beta of QSObook, a free local amateur radio notebook.

• QSO rounds with independent participation, QRT status and explicit contact confirmation.
• Safe local callsign lookup, reusable operators, independent notes and preserved contact snapshots.
• Portuguese, English, Spanish and French, light/dark themes and a responsive phone layout.
• Optional OpenStreetMap city map, disabled until explicitly enabled.
• Ready-to-run Linux ARM64 and AMD64 images at ghcr.io/erickfaria/qsobook.
• Optional private-LAN access with a mandatory shared password and explicit allowed hostnames.

Download compose.lan.yaml for Tortuga/private-LAN use, or compose.yaml for loopback-only use. Published Compose assets pin the image digest. Installation, password setup, cold backups and manual updates are explained in the beta installation guide.

Images are built and tested natively on both architectures after Go tests, vet, vulnerability checks and JavaScript regressions. Container tests cover authentication, HTTP security, duplicate confirmation, stopped-database backup integrity and persistence after recreation. The publication includes GitHub provenance attestations. This is not a security audit or a guarantee of defect-free software.

Known limits: private/trusted networks only; HTTP does not encrypt passwords or contacts. Use HTTPS/VPN for untrusted networks or remote access. No individual user accounts, automatic updates, in-app backup/restore, ADIF export or supported stable release line yet. Keep offline backups before upgrades. Physical Raspberry Pi testing is the next step; hosted ARM64 tests do not replace it. The default local-only configuration does not require a password; do not expose that configuration to the LAN or internet.