Skip to content

Order Samurai 2.2.1

Choose a tag to compare

View all tags
@Gemkai Gemkai released this 16 Oct 14:42
v2.2.1
959f3c5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Order Samurai 2.2.1

A security update. Please install it. It fixes issues found in an Oct 13 security audit of the installer and licensing code. The three installer and file issues below need a file already placed on your machine, or another user account on it, before they can do anything. They're still worth closing.

To upgrade: re-run the installer from the website, or download order-samurai-core.zip below and check it against order-samurai-core.zip.sha256. Then run samurai doctor.

Security fixes

  • The piped installer always downloads the release. On macOS's built-in bash, running curl … | bash from a folder that happened to contain bin/samurai ran that local copy instead of downloading and checksum-verifying the release. The installer now uses a local copy only when you run the script file yourself. Homebrew bash wasn't affected.
  • Licensing ignores planted code. samurai license and the Pro check could load Python code placed in the folder above your install, in the current folder, or on PYTHONPATH. They now load only Order Samurai's own bundled code.
  • The license backup is private from the start. When you uninstall, the license backup is created readable by you alone. Before, other users on the same machine could briefly read it, and a link placed at the backup path could redirect where it was written.
  • Lemon Squeezy refunds revoke Pro. A Lemon Squeezy license marked disabled or refunded now switches the machine back to Free at the next re-check, the same as a Gumroad refund. Going offline still never costs you Pro.

Licensing change

  • New license keys activate through Gumroad only. The Lemon Squeezy fallback could accept keys Gumroad didn't recognise, so it's retired for new activations. If you already activated through Lemon Squeezy, nothing changes for you.

Documentation

  • The privacy policy and onboarding guide now describe the license re-check as it actually works. Pro is re-checked at most once a day during the 21-day refund window, and a network failure never revokes it. After the window closes, the license is only re-checked when you run samurai license --refresh.

Full details are in CHANGELOG.md.

Assets 4
Loading