Skip to content

v0.2.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Sep 06:54
· 22 commits to master since this release
v0.2.3
This tag was signed with the committer’s verified signature. The key has expired.
franzos Franz Geffke
GPG key ID: 1B3418BA53820C4C
Expired
Verified
Learn about vigilant mode.
9ce5069
This commit was signed with the committer’s verified signature. The key has expired.
franzos Franz Geffke
GPG key ID: 1B3418BA53820C4C
Expired
Verified
Learn about vigilant mode.

Added

  • [proxy].trusted_hops picks the client from the forwarded-for chain
  • [database].max_connections and acquire_timeout_secs

Changed

  • Licences signed by the shop's web key are accepted alongside the root key
  • The host client reads its daemon socket path from the binary, not the environment

Security

  • The host client rejected malformed POSIX names only at the server
  • Outbound fetches followed redirects and could buffer an uncapped body
  • Client-supplied client_uri and logo_uri were rendered unchecked

Container image: ghcr.io/franzos/forseti:0.2.3

Verify a download:

sha256sum -c forseti-x86_64-unknown-linux-gnu.tar.gz.sha256
slsa-verifier verify-artifact forseti-x86_64-unknown-linux-gnu.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/franzos/forseti --source-tag v0.2.3

Install steps: README quickstart

Changes since v0.2.2: compare

Assets 7
Loading