Skip to content

v0.3.0 — Security hardening

Choose a tag to compare

View all tags
@nikicat nikicat released this 08 Jul 14:18
v0.3.0
ca1605d
This commit was signed with the committer’s verified signature.
nikicat Nik B
GPG key ID: 846FFFEFC1039264
Verified
Learn about vigilant mode.

Security review follow-up: seven findings fixed (see per-commit detail).

Fixes

  • GPG signing oracle — the approval prompt/notification/UI now derive the displayed author/committer/message from the exact commit bytes being signed (WYSIWYS); client display fields are discarded.
  • Login token amplification — the session cookie is now an independent, revocable server-side session ID (never the master token), and the login link is single-use.
  • Batch GetSecrets — every item in a batch is authorized, not just the first; deny fires on any in-scope item, approve/auto-approve only when all items are covered.
  • Ephemeral auto-approve — keyed on the non-spoofable invoker /proc/exe, not the spoofable comm.
  • trusted_signers silent path — gated on the request arriving through our own gpg-sign thin client, so forged repo/file fields can't obtain a silent signature. Any-ancestor exe_path matching (e.g. an editor) is preserved.
  • process.unit matcher — now matches the caller's real systemd unit (via GetUnitByPID); name documented as advisory (spoofable comm).
  • Notification markup injection — all client-controlled fields are HTML-escaped in the notification body.

Breaking / behavior changes

  • API wire rename: sender_info.unit_name → sender_info.invoker_name, plus a new systemd_unit field. Affects only custom clients of the local API; the bundled web UI is updated.
  • A daemon restart now invalidates existing browser sessions (in-memory sessions) — re-login required.
  • unit: trust rules now match the real systemd unit rather than the process comm.
Assets 4
Loading