Skip to content

v0.3.1 — Security follow-ups & AUR packaging

Choose a tag to compare

View all tags
@nikicat nikicat released this 10 Jul 16:46
v0.3.1
81218b3
This commit was signed with the committer’s verified signature.
nikicat Nik B
GPG key ID: 846FFFEFC1039264
Verified
Learn about vigilant mode.

Patch release: hardening follow-ups from the v0.3.0 security review, a dependency security bump, and automated AUR publishing.

Fixes

  • Malformed input now fails loudly at the entry point — gpg-sign requests with an empty commit_object are rejected with 400 (nothing to sign, nothing to bind the approval display to), and JWTs without a jti are rejected instead of silently sharing "" as a single-use nonce, which would have voided replay protection after the first redemption.
  • Notification escaping no longer mangles quotes — bodies escape only the markup-significant & < >, so commit subjects with apostrophes render correctly in dunst/mako/GNOME Shell; the v0.3.0 anti-spoofing property is unchanged.

Security

  • golang.org/x/crypto bumped v0.48.0 → v0.54.0, clearing all 13 open Dependabot advisories — mostly in ssh/ssh/agent (key/agent constraint enforcement, @revoked bypass, U2F presence-check bypass, several DoS vectors), which the SSH agent proxy uses directly.

Packaging

  • Releases now publish to the AUR automatically — the release workflow renders the PKGBUILD template, test-builds it in an Arch container, and pushes to the AUR. workflow_dispatch can republish an existing tag after a template fix.
Assets 4
Loading