Skip to content

OwnTransit 1.0.3 hotfix

Choose a tag to compare

View all tags
@sentrybottale sentrybottale released this 05 Oct 09:08
Immutable release. Only release title and notes can be modified.
v1.0.3
5bb0162
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OwnTransit 1.0.3 hotfix

Fixes a reconnect failure when the Target committed a credential renewal but the Client missed the response until it expired. Retrying the retained request previously returned the same expired response and failed with a local-state error.

The Client now authenticates that exact response as a receipt, saves a fresh renewal request and new operational keys atomically, and requires current authorization before opening the tunnel. Existing pairing identity, pinned trust, Relay URL and SSH settings are preserved. An interruption resumes the saved request.

Upgrade the Client

This fix requires upgrading the Client computer. The Target and Relay do not need an upgrade for this recovery.

Apple-silicon Mac — run as your ordinary user, without sudo:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.3/install-macos.sh | sh -s -- client

Linux amd64 or arm64 Client:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v1.0.3/install-linux.sh | sudo sh -s -- client

Then retry your existing SSH command or choose Continue tunnel for the existing tunnel in owntransit-client setup. Do not create a new pairing or delete saved state to recover this condition. Recognized 1.0.2 installations upgrade while retaining their pairing and previous software.

The fix applies to a renewal the Target already committed. Initial pairing expiry and expired requests that were never committed remain outside this recovery path. Local alarms and revocation continue to block access. Existing broken SSH streams require a new SSH command.

Included and verified

  • Recovery regression tests cover expired responses and operational certificates, interrupted fresh exchanges, retained identity/trust, local alarms, revocation, and incorrectly signed or bound receipts.
  • The existing wire and private-state schemas, independent TLS boundaries, fixed Target destination tcp4 127.0.0.1:22, and distribution signer remain unchanged.
  • The three platform capsules and both installers identify 1.0.3. The release retains the existing nine-asset format and signature namespace. The initial installer download trusts GitHub HTTPS; the installer then authenticates the pinned signer, signed inventory and selected archive.
  • Release assets are built from the tagged source, signed with the existing distribution key, and downloaded and verified before publication. No manual live-host recovery or deployment is claimed by this release.

Change and CI evidence (#37) · Recovery guide · Full comparison

Assets 12
Loading