RNS 1.3.9

Critical Security Update: This release fixes a severe security flaw in rnsh. Due to the nature of the issue, I will not disclose any further details for the time being. Once operators have had time to update, I will provide a full report for transparency. If you use rnsh, update right now.

Important: The new version of rnsh changes default identity file locations, and these will now be sourced from ~/.rnsh/identity (initiator) and ~/.rnsh/identity.default (listener). Make sure you copy your old files to this directory, or specify a custom identity path using the command line arguments. The --config argument has also been renamed to --rnsconfig, and the --config argument will now specify the rnsh configuration directory instead of the RNS configuration directory, bringing the behavior into alignment with other RNS utilities.

Additionally, this release includes automated blocking of fast-flapping clients on BackboneInterface listeners (see the Interfaces chapter of the manual for details), and a number of improvements to resource handling. The logging system has also been improved, and path and destination information moved to a new LOG_PATHING loglevel, to decrease log noise.

Changes

• Fixed a critical security issue in rnsh
• Added automated blocking of fast-flapping clients to BackboneInterface
• Added new LOG_PATHING loglevel, improved logging
• Added ability to make internal-mode interfaces discoverable
• Added ability to get discoverable interface location from external script
• Added RESOURCE_RCL signal on resource receiver cancel
• Improved resource handling and reliability
• Updated rnsh config args to work similarly to other RNS utilities

Verified Retrieval
You can retrieve and verify this release over Reticulum using the built-in rngit release utility. To retrieve only the installation .whl package, and the release manifest for future updates, you can use:

rngit release rns://7649a50d84610232d1416b41d2896aff/reticulum/reticulum fetch "latest:rns-*.whl" --signer bc7291552be7a58f361522990465165c

To download all artifacts, including the documentation and source archive, you can use the following command:

rngit release rns://7649a50d84610232d1416b41d2896aff/reticulum/reticulum fetch latest:all --signer bc7291552be7a58f361522990465165c

Release Signatures
Release artifacts include a signed rsm release manifest and rsg signature files that can be validated against the RNS release signing identity <bc7291552be7a58f361522990465165c> using rngit or rnid. To perform an offline verification of all release artifacts using a manifest:

rngit release rns_*.rsm verify --signer bc7291552be7a58f361522990465165c

To verify release artifacts using individual rsg files, while also verifying the manifest itself, download the rsm and rsg signatures, make sure they are in the same folder as the release artifact, and run rnid signature verification with the release identity as the required signer:

rnid -i bc7291552be7a58f361522990465165c -V rns_*.rsm *.rsg

The rnid utility will then verify the signatures, and display whether they are valid. If the signature cannot be verified, the release has been tampered with and should be discarded.