Skip to content

v1.0.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Jul 18:29
v1.0.1
This tag was signed with the committer’s verified signature.
devitway DevITWay | Pavel Volkov
GPG key ID: D6087CFCCD2B26F9
Verified
Learn about vigilant mode.
c63b569
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🔒 NORA 1.0.1

Patch release over 1.0.0 — a security fix for private deployments plus three infrastructure features. All of it is community work by @jgrund.

Security

  • Browse UI gated on private deployments — with auth enabled and anonymous_read off, the browse UI, its JSON API (/ui, /api/ui), and the API docs (/api-docs) were served unauthenticated, enumerating every repository and package a private registry exists to hide. They now require credentials unless anonymous_read (which already exposes the same names via the read APIs) or the new auth.public_web_ui (NORA_AUTH_PUBLIC_WEB_UI, default false) opens them. /metrics gets its own auth.public_metrics (default true — its labels name registry formats, not repositories); health/readiness probes stay public. (#850)
    • Behavior change: operators who relied on an anonymous web UI while keeping the registry APIs authenticated must now set public_web_ui = true (or enable anonymous_read).

Added

  • Native Google Cloud Storage backend (storage.mode = "gcs") — no longer only via the S3 interop layer. Credentials resolve as explicit service-account JSON, then ambient GOOGLE_*, then the metadata server, so GKE Workload Identity and GCE service accounts work with no key material. nora migrate accepts gcs as source/destination. (#842)
  • Streaming raw uploads and downloads — PUT/GET /raw/{path} no longer buffer the body in memory: O(frame) peak RAM at any size, with raw.max_file_size enforced incrementally as frames arrive. Download integrity is verified while streaming. (#845)
  • rpm/deb repository reconcile (POST /{rpm,deb}/{repo}/-/reindex) — heals a repository whose storage changed behind the API's back (filesystem-is-the-database, ADR-2): orphan sidecars dropped, unadopted packages parsed and validated, indexes rebuilt and re-signed under the publish lock. Also the re-sign hook after a signing-key change. (#847)

Thanks 🤝

Every change in 1.0.1 was contributed by Joe Grund (@jgrund) — the GCS backend, streaming raw transfers, the reconcile endpoint, and the UI-gating security fix. Thank you!

Install

# x86_64
curl -LO https://github.com/getnora-io/nora/releases/download/v1.0.1/nora-linux-amd64
chmod +x nora-linux-amd64
sudo mv nora-linux-amd64 /usr/local/bin/nora

# ARM64 (Apple Silicon, Graviton, Ampere)
curl -LO https://github.com/getnora-io/nora/releases/download/v1.0.1/nora-linux-arm64
chmod +x nora-linux-arm64
sudo mv nora-linux-arm64 /usr/local/bin/nora

Docker

docker pull getnora/nora:1.0.1
Variant Image Platforms
Alpine (default) getnora/nora:1.0.1 amd64, arm64
RED OS getnora/nora:1.0.1-redos amd64
Astra Linux SE getnora/nora:1.0.1-astra amd64
GHCR ghcr.io/getnora-io/nora:1.0.1 amd64, arm64

DEB / RPM

# Debian / Ubuntu / Astra Linux (amd64)
curl -LO https://github.com/getnora-io/nora/releases/download/v1.0.1/nora-amd64.deb
sudo dpkg -i nora-amd64.deb

# RHEL / Fedora / RED OS (amd64)
curl -LO https://github.com/getnora-io/nora/releases/download/v1.0.1/nora-amd64.rpm
sudo rpm -i nora-amd64.rpm

Changelog

See CHANGELOG.md

Assets 17
Loading