Skip to content

WolfStack v25.23.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Sep 07:43
· 38 commits to master since this release
v25.23.5
fa2a857

v25.23.5: cross-cluster transfer tokens are compared in constant time

The X-Transfer-Token header is one of three independently sufficient
credentials on the LXC/VM import endpoints, but validate_transfer_token
and peek_transfer_token matched it with a plain string equality that
returns at the first mismatching byte, so response timing exposed how
many leading bytes of a guess were correct (CWE-208). Both now compare
each candidate with validate_cluster_secret, the same full-walk
constant-time routine the cluster secret already uses. Regression tests
pin exact-match, near-miss, prefix, expiry and single-use behaviour.

Reported by Abdurazzoqov Javohir (abdurazzoqovjavohir700-dev).

Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: IntelligentWolf Ltd paul@wolf.uk.com
Claude-Session: https://claude.ai/code/session_017hmDbmDSCBJEEyUrP37f8g

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/intelligentwolf/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo intelligentwolf/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

  • wolfstack-x86_64 / wolfstack-aarch64 / wolfstack-armv7 — static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).
  • wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
  • SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.

Assets 9
Loading