Skip to content

FreeSBC v0.6.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 02:05
· 15 commits to main since this release
v0.6.2
4c237ef
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

FreeSBC v0.6.2 is the first signed release: SHA256SUMS now carries a Sigstore signature, and install.sh checks it when cosign is installed. It also fixes the WebUI's colour lag on a scheme change. The SIP and media plane is unchanged from v0.6.1, and configuration is unchanged: a v0.6.1 file loads as is.

curl -fsSL https://github.com/rasonyang/freesbc/releases/latest/download/install.sh | sh

Breaking changes

None. Under the default FREESBC_VERIFY=auto, install.sh behaves as before when cosign is missing or the release is unsigned (v0.6.1 and older).

Security

  • Signed SHA256SUMS (#261, closes #246). release.yml signs SHA256SUMS with Sigstore keyless signing through GitHub OIDC, so there is no signing key to leak. The signature is the new asset SHA256SUMS.sigstore.json. SHA256SUMS lists every tarball and install.sh, so this one signature covers them all. The certificate names release.yml of this repository and the ref it ran from, and the signature is logged in Rekor.
  • install.sh checks it. It verifies the signature before the tarball's hash. FREESBC_VERIFY=require makes a missing cosign (v2.4.2 or later, v3 recommended) or a missing bundle an error, and off skips the check for mirrors without the bundle. A failed check installs nothing.
  • To check by hand, or to verify install.sh before running it, see Integrity.

Fixes

  • WebUI colours lagged a scheme change (#260, closes #255). After a light/dark switch, the outline buttons, the theme icon and the active nav link faded from the old colours over 150 ms. Transitions are now off for the two frames around a scheme change, so everything switches at once. Hover fades are unchanged.

Known limitations and follow-ups

  • #257: the next monthly three-host run re-measures the carrier-in ceiling with the 8 MiB buffer, and the GC cuts of #170 and #173. Until then 3500 CPS is the loss-free carrier-in figure on 4 vCPU.
  • If verification can't reach Sigstore, the check fails and nothing is installed. This applies under require, and under auto when cosign is installed.
Assets 9
Loading