v0.1.73

v0.1.73

Security

• Fixed a missing-authorisation flaw in the admin REST API (#84, CWE-862, CVSS 8.8). The API validated the session token but did not check administrator rights, so any logged-in user could reach admin-only operations such as creating admin accounts or resetting passwords. Admin endpoints now enforce administrator status, re-checked against the database on every request. Upgrading is strongly recommended for any multi-user deployment. Reported by @djnnvx.

Highlights

• UEFI Secure Boot bootloader-set wiring and Windows 24H2/25H2 network boot support; proxyDHCP now advertises the active set's bootfiles. Thanks to @NPetersenDK (#96).
• In-process NFS server with a UI option for streamed live-distro roots.
• New bootimus user set-password <user> command: reset a password directly against the database without starting the server (interactive prompt, or --password for scripts). Requested by @adrianipopescu (#81).
• New bootimus profiles update command: refresh the built-in distro profiles from the CLI.

Fixes

• Image download descriptions are now saved. Reported by @rgl (#89).
• ISO filenames with an uppercase .ISO extension are handled correctly. Reported by @TannenBaum1337 (#68).
• MAC address substitution in the kernel boot line. Thanks to @codyro (#86).
• Corrected admin ASCII-art table alignment. Thanks to @rgl (#91).
• Updated distro profiles (Ubuntu 26.04 URLs, Linux Mint links). Thanks to @AgentK7 (#75, #83).

Notes

• Releases are now built by GitHub Actions: tagged binaries with checksums, plus multi-arch Docker images.

Thanks to everyone who reported issues and contributed to this release: @djnnvx, @NPetersenDK, @adrianipopescu, @rgl, @TannenBaum1337, @codyro, @AgentK7.

What's Changed

• Updated distro-profiles.json to reflect Ubuntu 26.04 release in Download URLs, fixed Linux Mint Download links by @AgentK7 in #75
• fix the admin ascii-art table alignment by @rgl in #91
• Add MAC substition in kernel boot line by @codyro in #86
• Updated distro-profiles.json by @AgentK7 in #83
• Fix Secure Boot bootloader-set wiring and Windows 24H2+ netboot by @NPetersenDK in #96
• 0.1.73 Fix admin API auth bypass, add set-password CLI, ISO/description fixes by @garybowers in #97

New Contributors

• @AgentK7 made their first contribution in #75
• @rgl made their first contribution in #91
• @codyro made their first contribution in #86
• @NPetersenDK made their first contribution in #96
• @garybowers made their first contribution in #97

Full Changelog: v0.1.70...v0.1.73