Skip to content

WolfStack v25.26.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Sep 04:19
· 10 commits to master since this release
v25.26.1
02672ff

v25.26.1: a viewer account can no longer change anything — the read-only role is now enforced on every route

WolfStack users have an admin or viewer role and the docs promise that
viewer means read-only. That promise was enforced on three endpoints
(user management, per-user cluster access, diagnostics). Every other
authenticated route accepted a viewer session: package installs,
container and VM lifecycle, backups, settings, API-key minting, and the
command-execution and console sinks behind require_operator_auth, which
fell through to require_auth with no role check. An OIDC login mapped to
viewer was only ever logged; the session recorded just a username.

Now a session records whether the identity is read-only, decided at
login from the user's role (anything but "admin" is read-only, so a
mistyped role fails closed). require_auth, the single authentication
chokepoint, refuses a read-only session every non-safe method except the
self-service set a viewer needs (logout, own password/email/2FA, own
passkeys, UI preferences). require_operator_auth refuses read-only
sessions regardless of method, and the node proxy tells the far node when
the forwarded actor is read-only so the refusal holds cluster-wide. The
handlers that read the cookie directly (secret rotation, at-rest
credential migration, GitHub Sponsor toggle), the TUI container action
links and the WolfHost middleware apply the same refusal. User creation
accepts only the two documented roles. Linux accounts have no role and
are unchanged.

The dashboard shows a permanent "Read-only viewer" badge and turns every
refused action into a visible error toast keyed on the
X-WolfStack-Role header.

Reported-by: VolkSec (@volksec)
Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: IntelligentWolf Ltd paul@wolf.uk.com

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/intelligentwolf/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo intelligentwolf/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

  • wolfstack-x86_64 / wolfstack-aarch64 / wolfstack-armv7 — static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).
  • wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
  • SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.

Contributors

volksec
Assets 9
Loading