v0.4.42

If you already run this distribution, this release is the one that repairs the in-app updater — and you have to install it by hand, once.

curl -fsSL https://github.com/inkly/CasaOS-Install/releases/latest/download/install.sh | sudo bash

After that the dashboard's update panel follows this distribution on its own.

Why the updater never offered an update

It was watching someone else's releases. Four files shipped by CasaOS still carried alvins82's fork URLs, and one of them — the setup script inside this installer's compatibility overlay — wrote them into /etc/casaos/casaos.conf on every install, where CasaOS prefers them over its own built-in addresses.

So a host installed from here polled a feed whose newest release (v0.4.39) was older than what it was running, concluded it was up to date, and said so for good. Had the update ever fired, it would have fetched that fork's installer over this one. An installation made before today cannot repair itself, because the broken setting is exactly what the updater reads — hence the manual run above.

CasaOS now carries a test that fails if a shipped file and the built-in addresses ever disagree again, which is the check that was missing when the distribution was first retargeted.

Also fixed

• The gateway's health check against its own listener retried forever instead of ten times: the countdown ran through an unsigned integer, so the last decrement wrapped to 18 446 744 073 709 551 615. A listener that never answered left the gateway probing once a second rather than returning the error its caller expects.

Documentation

Every component repository now has a README that describes what that service actually does — its routes, where its data and configuration live, what this distribution changed in it, and how to build and test it. Each one was fact-checked against the code, which caught a fair number of confident inventions along the way.

Components

CasaOS v0.4.42, Gateway v0.4.20, CasaOS-UI v0.4.32, AppManagement v0.4.21, MessageBus v0.4.19, UserService v0.4.18, LocalStorage v0.4.29. The exact commits are in components.lock; every package the installer downloads is verified against a digest taken from the component's own release.

v0.4.41

curl -fsSL https://github.com/inkly/CasaOS-Install/releases/latest/download/install.sh | sudo bash

Running it on an existing install upgrades it.

Security

The file manager API (/v1/file, /v1/folder, /v1/batch, /v1/image) required no token when the request came from loopback, and loopback is not the same as root: any unprivileged local process, or a store app running with network_mode: host, could read, write and delete any file on the host as root. It is now behind the same token as the rest, like the Samba and package routes since v0.4.40.

Reported upstream as CasaOS #2566. Its "path traversal" framing does not hold — the paths are absolute by design — and its sanitizer is not adopted: confining the file manager to a fixed set of roots would break browsing /mnt and /media, i.e. every USB drive and every cloud mount.

Added

• A share can be marked as a Time Machine destination. It gets Apple's SMB extensions and smbd advertises it over mDNS, so Macs on the network offer it as a backup disk. Only that share is touched, and a host missing Samba's vfs_fruit module is told so instead of getting a share that refuses every connection (#1030).
• The gateway can bind its public port to one address (address= in /etc/casaos/gateway.ini) instead of every interface (Gateway #56).

Fixed

• A $ in an environment variable no longer doubles on every save: $2a$12$… became $$2a$$12$$… then $$$$2a$$$$…, breaking password hashes (#1988).
• journald no longer receives an access-log line for the internal status posts the services exchange every 5 seconds — about 17 000 lines a day. The telemetry rate is unchanged, so the dashboard graphs keep updating (#2211).
• The App Store no longer stops rendering when no category has any app, which happened with only a third-party store registered (#2537, UI #274).
• App Store entries declaring an empty architecture list are shown rather than hidden, and category counts match the apps actually listed on the host.
• The updater panel printed the version twice over (vv0.4.40).

Components

CasaOS v0.4.41, CasaOS-UI v0.4.32, AppManagement v0.4.21, Gateway v0.4.19, MessageBus v0.4.19, UserService v0.4.18, LocalStorage v0.4.29. The exact commits are in components.lock; every package the installer downloads is verified against a digest taken from the component's own release.

v0.4.40

CasaOS-Install v0.4.40 - first release of the inkly distribution