Skip to content

REL-v0.5.8

REL-v0.5.8: chore(release): v0.5.8 (#310)
@kernalix7 kernalix7 tagged this 24 May 12:38 
* chore(release): v0.5.8

Version bump + docs sync for the 0.5.8 release.

- pyproject.toml + __init__.py: 0.5.7 -> 0.5.8
- debian/changelog: 0.5.8 stanza (contributor-credited)
- CHANGELOG.md + docs/CHANGELOG.ko.md: Unreleased -> [0.5.8] with
  Highlights + the #269 urlacl fix, #288 podman-compose, #287
  recover-oem, #126 dynamic+generous timeouts, #255 wizard
  completion, #227 fat AppImage, #301 RPM license entries
- README.md + docs/README.ko.md: status line -> v0.5.8 feature
  summary, .deb/.rpm filename examples bumped
- docs/USAGE.md + .ko: new winpodx pod recover-oem / setup-host /
  setup --customize full-provision commands

Contributors credited: @ismikes (#269), @leandromqrs (#227),
@xiyeming (#126), @ankranidiotis (#287), @magicdiablo (#288).

* chore(release): address v0.5.8 security + license review findings

Security/legal/release-cleanliness review before tagging. Fixes:

License (MUST-FIX before release):
- AppImage now bundles every third-party component's license + NOTICE
  text. appimage-publish.yml copies Fedora /usr/share/licenses/<pkg>
  (FreeRDP/Podman/podman-compose/conmon/crun/netavark/slirp4netns/passt)
  + a podman-compose GPL-2.0 source-offer note into AppDir/usr/share/
  doc/winpodx/third-party/, and winpodx LICENSE + THIRD_PARTY_LICENSES.md
  + the python-build-standalone license into usr/share/doc/winpodx/ --
  satisfying Apache 4(d) / LGPL 4 / GPL-2.0 1+3 / PSF redistribution
  obligations. (Previously zero third-party texts shipped + README
  falsely claimed they were present.)
- THIRD_PARTY_LICENSES.md: add rcedit + reverse-open-shim sections;
  add a 'fat AppImage redistributes these' section so the
  'not vendored' runtime-deps wording isn't contradicted by the
  artifact. debian/copyright: add the shim .exe.
- GPL-2.0 podman-compose confirmed mere-aggregation (subprocess, not
  linked) -- winpodx stays MIT; documented the boundary + source offer.

Security:
- H1: recover-oem HTTP server now tars + serves a dedicated
  /tmp/winpodx-recover dir (one file) instead of all of /storage,
  so it never exposes data.img; the agent_token in the tarball is
  already held by the guest.
- M1: pkexec apply script binds the username to a shell var once
  (shlex-quoted) and references "$wpu" everywhere, removing the
  raw-interpolation quoting class entirely (defense-in-depth).
- M2: verify the python-build-standalone tarball against its upstream
  .sha256 sidecar before extracting into the AppImage (supply-chain).

Cleanliness:
- .gitignore: ignore *.AppImage + squashfs-root/ (local AppImage builds).

Tests: setup_wizard pkexec assertions updated for the $wpu form (6 pass).
Reviews returned no Critical security findings; version consistency +
lint + build + secrets all clean.

* docs(appimage): correct README to describe the fat CI artifact (MF-1b)

Second-pass legal review caught that packaging/appimage/README.md
still described the OLD lean AppImage -- 'Not bundled: FreeRDP /
Podman / podman-compose' + 'fat AppImage is a follow-up tracked
separately' -- which directly contradicts the fat artifact the CI
workflow actually ships (and the corrected THIRD_PARTY_LICENSES.md).
The first pass fixed the THIRD_PARTY half but not this README.

Rewritten to: (1) distinguish the two build paths (CI = fat, ships;
build.sh = lean dev convenience), (2) list what the fat CI AppImage
actually bundles vs what stays host-resolved, (3) Licensing section
now states winpodx stays MIT (podman-compose GPL = subprocess mere-
aggregation), lists the bundled third-party license texts + the
usr/share/doc/winpodx/third-party/ path + GPL source offer, matching
what appimage-publish.yml produces.

* ci(appimage): fail closed if a required third-party license dir is missing

Final-pass legal review flagged that the license-copy loop used
`2>/dev/null || true`, so if a future Fedora image stopped shipping
/usr/share/licenses/<pkg>/ the AppImage would silently ship missing a
required NOTICE / GPL text -- a breach of that component's license
(never an MIT issue for winpodx, but a compliance regression).

Split into REQUIRED (podman-compose GPL-2.0 + freerdp/podman Apache-2.0
NOTICE) which now abort the build if absent, and OPTIONAL (libs that
share a parent package's license dir on Fedora) which stay best-effort.
winpodx itself remains plain MIT -- this only hardens the obligation
to ship the bundled components' texts.
Assets 2
Loading