Release v2.8.0 · jp1337/easywall

Changelog

2a70251: security(web): stop an unauthenticated logout from erasing the audit log (@jp1337)
4d2b41f: security(web): the demo shows the password form and writes nothing (@jp1337)

73371e4: feat(core): debounce the three login events a stranger can trigger (@jp1337)
bd9b4fb: feat(protocol): LOG_EVENT, the eighteenth command (@jp1337)
be422a5: feat(web): RFC 6238 TOTP, against the RFC's own vectors (@jp1337)
744d646: feat(web): eight one-time recovery codes, argon2-hashed (@jp1337)
90a8a9d: feat(web): enrol a second factor from the password page (@jp1337)
471091e: feat(web): hold a half-finished first run in memory (@jp1337)
c87adc2: feat(web): login events reach the core without a login waiting on it (@jp1337)
041cd40: feat(web): remember the last accepted TOTP step (@jp1337)
f6ab08d: feat(web): the first-run wizard can switch a second factor on (@jp1337)
4334e53: feat(web): the login gets a second step (@jp1337)
f5f7ddc: feat(web): the login's intermediate state, in its own cookie (@jp1337)
905e577: feat(web): the nine login events are labelled, documented and uncoloured (@jp1337)
bf37cc2: feat(web): web.toml carries the second factor, and the fingerprint covers it (@jp1337)

6601d81: fix(ci): Renovate found every Go pin and updated none of them (@jp1337)
7a8de38: fix(ci): install the .deb in a container, not on the runner (@jp1337)
5444b37: fix(test): correct TestShapes_DoNotOverlap expectations (@jp1337)
c48c855: fix(web): annotate three gosec findings the way gosec reads (@jp1337)
183cd74: fix(web): close the escape hatch's remaining gaps in the first-run wizard (@jp1337)
e86d749: fix(web): colour the first-run success flash green, not red (@jp1337)
be243d5: fix(web): don't drop recovery codes when first-run staging fails (@jp1337)
357a767: fix(web): keep the TLS key write atomic (@jp1337)
5ca174d: fix(web): make TestDemoModeSaysWhyItRefused actually exercise the guard (@jp1337)
47678b0: fix(web): show the version the binary actually is (@jp1337)
39aed4c: fix(web): shrink the QR at phone width so the 2FA escape hatch clears the fold (@jp1337)
f63dbf2: fix(web): tighten the 2FA escape hatch further and name it in the clock-skew message (@jp1337)

1ac372a: build(css): rebuild the committed stylesheets (@jp1337)
3987575: chore(deps): rebuild the diagrams for mermaid 11.17.0 (@jp1337)
aed4348: chore(deps): update dependency mermaid to v11.17.0 (@renovate[bot])
817f822: chore(go): move the derived pins to 1.27 and re-render the diagram (@jp1337)
f2942ea: chore(go): update go toolchain to v1.27.0 (@renovate[bot])
122bc82: chore(release): 2.8.0 (@jp1337)
7e3428b: refactor(web): SaveFirstRun takes one value (@jp1337)
21b2d4a: test(ci): teach the package-install guard about the container (@jp1337)
b99b0fe: test(ui): drive enrolment and the second step in a browser (@jp1337)
7a0369c: test(web): cover handle2FAConfirm's demo guard directly (@jp1337)
45a0793: test(web): fix cleanup to restore writable directory permissions (@jp1337)
be52f18: test(web): make TOTP replay permission test falsifiable (@jp1337)
fa20f03: test(web): make TestConfig_DisablingClearsBothKeys able to see a fallback (@jp1337)
ff6daf2: test(web): make the audit-event drain and dispatcher wiring falsifiable (@jp1337)