Skip to content

v1.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 09:50
· 146 commits to master since this release
v1.1.0
e2065f7

Changes

  • Certificates that do not load are isolated (certificate-isolation-v1). When a node cannot load a certificate of a revision, for example an EC certificate with explicit curve parameters, it now applies the rest of the revision instead of rejecting all of it. Sites and layer-4 applications using that certificate keep the earlier material the node already holds for it. If there is none, their TLS handshakes are refused; the node never presents another certificate in its place. The node reports these certificates to the console (ReportStatusRequest.certificate_failures, proto v1.1.0), and the console shows them on the certificate and on the node.
  • Identity headers of former access authentication rules are removed (auth-identity-headers-v1). The console now sends Site.auth_identity_headers: the headers that disabled and deleted rules set. The node removes them from every request of the site before the rules or the origin see them, also on a site with no rules left.
  • Path prefixes of access control scopes now ignore ASCII case. This covers the geo, user agent and hotlink path prefixes, so /ADMIN/ is in the scope of /admin/. Excluded prefixes, the hotlink redirect target and CORS prefixes still match exactly.
  • The site's request body limit now applies to bodies without Content-Length: chunked HTTP/1.1 uploads, and HTTP/2 and HTTP/3 bodies. Before, they were bounded only by the node-wide limit. The node reads such a body, then answers 413 body-too-large when it is over the site's limit or a config rule's limit.
  • A hotlink redirect to a site path that cannot be exempted from the check (one with //, a dot segment, ; or a percent-escape) now answers 403 instead of redirecting.
  • WebP / AVIF conversion:
    • Output is bounded by the original's size.
    • The WebP or AVIF container is checked before caching.
    • The conversion process sets no_new_privs.

Neither proto field is required. With an older console the node still isolates certificates (the console does not show the failures) and removes the identity headers of the enabled rules only.

Upgrade: use the console's node upgrade, or the install command with --version 1.1.0.

Changelog

  • 77ab63b build(proto): generate from proto/v1.1.0
  • e2065f7 docs(architecture): certificate isolation, identity headers, scopes, body limits and image conversion
  • d8cd9a8 feat(agent): isolate a certificate the node cannot load
  • a47e674 feat(lua): remove the identity headers of a site's former rules
  • 8c6e3d1 fix(imageconv): bounded output, checked containers, no_new_privs
  • f7e46aa fix(lua): a hotlink redirect target no request could be exempt for answers 403
  • 7dc8ac4 fix(lua): access control scope prefixes ignore ASCII case
  • 8bcfb12 fix(lua): request bodies without Content-Length count against the site's limit

Verify

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/marvinli001/edgeweir-node/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt
sha256sum --ignore-missing -c checksums.txt
gh attestation verify <artifact> --repo marvinli001/edgeweir-node
Assets 26
Loading