Istrek 0.9.4

Istrek 0.9.4

The web pages, redesigned after the Mac app, and Microsoft Clarity as a second, optional
analytics tool on the landing page, loaded only after you allow it.

Nothing changes in the API, the Mac app or istrekctl.

Changed

• The web pages look like the Mac app. They are set in your system font (SF Pro on a
  Mac, Segoe UI, Roboto or Helvetica Neue elsewhere, and the system's monospaced font for
  commands and codes), in white and system greys with the app's one green for what is
  primary, selected or a link. Facts are rows in grouped lists, as in the app's settings.
  The pages follow your light or dark setting.
• The landing page opens with the week view of the app, and the pricing follows right
  after it: hosted and self-hosted as two cards of rows. Each section puts the text on the
  left and the app's window on the right; the plain facts are one grouped list.
• Screenshots in dark mode. Each screenshot has a dark copy, shown when your browser is
  set to dark (shot-week-dark.webp, shot-review-dark.webp,
  shot-invoice-detail-dark.webp, shot-design-studio-dark.webp).
• The account area is laid out like System Settings: a sidebar under the account's name
  with Account, Billing (on a server that bills), Devices and Data beside the page (a
  segmented control on a narrow screen). The billing page
  shows the plan's state as rows, with monthly or yearly as a segmented control before the
  payment page. Devices and data are grouped rows. What each page does is unchanged.
• Sign-in, connecting a device, revoking, deleting the account and error pages are one
  narrow column; the sign-in page is centred under the app icon. Notices carry an icon. The
  Cloudflare Turnstile widget keeps its place on the sign-in form.
• The self-hosting guide (/self-hosting) has its contents in a sidebar beside the text
  on a wide screen, kept in view while you scroll, and folded above the text on a narrow one.
  Command blocks scroll sideways and can be reached with Tab.
• The link-preview picture (og-card.png) shows the new headline beside the week view.
• No font files. The web pages no longer carry fonts of their own, so nothing is
  downloaded for them. font-fraunces.woff2, font-plex-sans.woff2, font-plex-mono.woff2
  and font-plex-mono-medium.woff2 are no longer served. The fonts of the PDF documents are
  not affected. The third-party notices list the document fonts only.

New

• Microsoft Clarity on the landing page. Set ISTREK_CLARITY_PROJECT_ID to the ID of a
  Clarity project (6 to 20 lowercase letters and digits; it is public, not a secret). Any
  other value stops the start, and the message does not repeat it. It is independent of
  ISTREK_GA_MEASUREMENT_ID: either, both or neither may be set.

• Only after Allow. With the ID set, the landing page asks along the bottom of the window,
  as it already did for Google Analytics, and names the tools that are set: "Microsoft
  Clarity records clicks, scrolling and session replays, with all text masked." Nothing is
  loaded from Microsoft before you choose Allow. After it, the page sends Clarity its
  consent signal (analytics storage granted, ad storage denied) and loads Clarity's tag from
  https://www.clarity.ms/tag/<id>, which loads its recorder from scripts.clarity.ms.
  No thanks, or a browser without JavaScript, gets the same page and nothing is loaded.

• All text masked. With the ID set, the landing page's <body> carries
  data-clarity-mask="True", which asks Clarity to mask all text on the page, whatever the
  project's own masking setting says.

• Withdrawing stops Clarity at once. Changing your answer to No thanks from the line at
  the foot of the page tells Clarity that analytics storage is denied, on which it erases its
  cookies (_clck, _clsk), and then stops the recording. Allowing again on the same page
  starts it again.

• The Content-Security-Policy names only the hosts of the tags that are set. On the
  landing page alone, and only with an ID set:

  • with ISTREK_GA_MEASUREMENT_ID: https://*.google-analytics.com https://*.googletagmanager.com
    in img-src, https://www.googletagmanager.com in script-src, and
    https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com
    in connect-src, as before;
  • with ISTREK_CLARITY_PROJECT_ID: https://*.clarity.ms https://c.bing.com in img-src,
    https://www.clarity.ms https://scripts.clarity.ms in script-src, and
    https://*.clarity.ms in connect-src;
  • with both, Google's hosts come first in each.

  Every other page, and the landing page without either ID, keeps the strict policy with no
  script. Signed-in pages never load analytics, and the self-hosting guide carries no script
  either.

Before you update

• No migration and no new required setting. Without ISTREK_CLARITY_PROJECT_ID nothing
  changes. 0.6.0 and later clients are served.
• If you link to the font files under /assets from anywhere, those links now answer 404.
• If you set the Clarity ID, set the project to Strict masking in Clarity's settings as well.
  Clarity sets its own cookies once a visitor allows it; say so wherever you describe the
  cookies of your site.

Known limits

• Google's tag cannot be unloaded: when a visitor withdraws consent, Google Analytics stops
  from the next page on. Clarity stops at once.
• Clarity gets no custom events; the three Google Analytics events are unchanged.
• The Mac app (Istrek-VERSION.dmg) and istrekctl-VERSION.zip are not published yet.
• Only the amd64 build of the server is published.
• Istrek has not been audited or penetration-tested by an outside party.

Istrek 0.9.3

Istrek 0.9.3

The Mac app is ready to be signed with a Developer ID and notarized, and keeps its credential in
your login keychain when it is.

Nothing changes on the server.

Changed

• Where the Mac app keeps its credential. A copy signed with a Developer ID, as the
  downloaded app will be, keeps it in your login keychain as a generic password
  ("Istrek", service app.istrek.mac.connection). Only Istrek reads it without asking; any
  other app has to ask you first. Access is tied to Istrek's signature, so updates keep it
  without asking again.
• A copy you build yourself is ad-hoc signed, and its signature changes with every
  build, so it keeps the credential in the private file
  ~/Library/Application Support/Istrek/connection.json (readable by you only), as before.
  It never reads, writes or deletes a keychain item.
• Moving the credential. When a signed copy starts and finds that file, it copies the
  credential into the keychain, reads it back, compares the two, and only then deletes the
  file. If any step fails, the file stays and is used, and Istrek tries again at the next
  launch. The credential is never removed before a verified copy exists.
• Settings ▸ Connection and the first-run sheet say where the credential is: in your login
  keychain, in the private file because the app is not signed with a Developer ID, or in the
  private file because the keychain could not take it.
• Signing out or deleting the account removes the keychain item and the file on a signed
  copy, and the file on a copy you built yourself.

For people who build Istrek

• Signing needs no provisioning profile and no keychain entitlement: the app's entitlements
  are empty (hardened runtime, no sandbox). ISTREK_PROVISIONING_PROFILE is no longer used.
• scripts/release.sh --signed reads scripts/.env (TEAM_ID, CODESIGN_IDENTITY,
  NOTARYTOOL_PROFILE, GITHUB_REPO; see scripts/.env.example); environment variables
  still take precedence. Before building, it checks the signing identity, the notarization
  profile (and says when an Apple Developer agreement is waiting) and that the Sparkle signing
  key matches the key the app trusts. The app itself is now notarized and stapled as well as
  the DMG.

Before you update

• No migration on the server. 0.6.0 and later clients are served.
• If you go back from a signed copy to one you built yourself, connect it again: it does not
  look in the keychain.

Known limits

• The Mac app (Istrek-VERSION.dmg) and istrekctl-VERSION.zip are not published yet.
• Only the amd64 build of the server is published.
• Istrek has not been audited or penetration-tested by an outside party.

Istrek 0.9.2

Istrek 0.9.2

A bot check for the sign-in form, the licences of everything a download carries, and a
clearer istrekctl login.

A server with a public sign-in page, and above all one with
open sign-up, can now ask Cloudflare Turnstile whether the person asking for a sign-in link is
a person, so scripts can no longer use the form to send e-mail or create accounts. It is off
unless you switch it on.

New

• Cloudflare Turnstile on the sign-in form. Set ISTREK_TURNSTILE_SITEKEY and
  ISTREK_TURNSTILE_SECRET to the keys of a Turnstile widget (Managed mode, your public host
  as its hostname; the free plan is enough). The e-mail form on /signin then shows
  Cloudflare's widget, and the server checks its token with Cloudflare before it does anything
  else with the form. The check covers every request for a link: for an address that has an
  account, for a new one and for one with an invite code, so the form still does not tell who
  has an account.
• When the check does not pass, the form is shown again with "The check that you are not a
  robot did not pass. Try again." and the address you typed. Nothing is sent.
• When Cloudflare cannot be reached within five seconds, the form says so and sends
  nothing until it can. Single sign-on keeps working, and the administrator can still hand out
  a link with Istrek.Release.signin_link.
• Only the sign-in page changes. With the check on, it loads
  https://challenges.cloudflare.com/turnstile/v0/api.js, allows Cloudflare's script and
  frame in its Content-Security-Policy, sends its origin (not its path) as the referrer, and
  says under the form that it uses Cloudflare Turnstile and that Cloudflare receives your IP
  address and browser details while it runs. Every other page keeps no script and no
  referrer. The widget follows your light or dark setting and is reached with Tab.
• Third-party notices. The Linux archive carries istrek/THIRD-PARTY-NOTICES.md:
  Erlang/OTP, Elixir and every library in the release, with their licence texts. It is written when the
  release is built, from what the release contains. The Mac app carries the same for the
  Swift packages it is built with (Sparkle) in Istrek.app/Contents/Resources. The releases
  page has both, as THIRD-PARTY-NOTICES-linux.md and THIRD-PARTY-NOTICES-mac.md.

Changed

• istrekctl login first prints the server it signs in to. Its help now says what the
  default is: without a URL and without ISTREK_URL it signs in to the hosted service at
  https://istrek.souris.cloud. To sign in to your own server, give its address:
  istrekctl login https://time.example.com. What it does is unchanged.
• LICENSE.md says where the third-party notices are.
• Starting with only one of the two Turnstile keys set stops the start with a message that
  names the missing one.
• Checks count 20 a minute per client address, apart from the sign-in limits.

Before you update

• No migration. Without the two new settings nothing changes. 0.6.0 and later clients are
  served.
• The check runs on the server's outgoing HTTPS connection to challenges.cloudflare.com. If
  your firewall limits outgoing traffic, allow it before you set the keys.
• Single sign-on is not checked: the provider signs the person in before an account is made,
  so the provider is the gate. Restrict who may use the application there if
  ISTREK_OIDC_SIGNUP=open.

Known limits

• One library of the server, ex_maybe (used by qr_code), names "BSD" in its package
  metadata but ships no licence text, and its repository has none either. The notices say
  so.
• The check needs JavaScript; without it the sign-in form cannot be sent. The page says so.
• The Mac app (Istrek-VERSION.dmg) and istrekctl-VERSION.zip are not published yet.
• Only the amd64 build of the server is published.
• Istrek has not been audited or penetration-tested by an outside party.

Istrek 0.9.1

Istrek 0.9.1

Self-hosting, documented and downloadable. The server for Linux is published on the public
releases page together with a guide to run it and the licence it is used under. The Mac app
and istrekctl follow once they are signed and notarized.

New

• Public releases at https://github.com/souriscloud/istrek-releases/releases. Each release
  carries istrek-VERSION-linux-amd64.tar.gz, its .sha256 (check it with
  sha256sum -c istrek-VERSION-linux-amd64.tar.gz.sha256) and LICENSE.md.
• The self-hosting guide is the README of that repository: download and check the
  archive, Typst, PostgreSQL, the environment file, a hardened systemd unit, Caddy in front,
  connecting the Mac app, istrekctl and agents, backups, upgrading and troubleshooting.
  Its server steps (download and checksum, database, environment file, the systemd unit with
  its hardening, the first credential, backups and restore, upgrading) were run on Ubuntu
  24.04 with PostgreSQL 16 under systemd. The Caddy step was not.
• The licence. Istrek is free to use and not open source: you may run it on computers you
  control, for yourself or your business, and connect your own programs and agents; you may
  not redistribute it or offer it to others as a hosted service. The Linux archive now
  carries LICENSE.md at its top (istrek/LICENSE.md).
• /self-hosting on a hosted server shows the same guide as a web page, linked from the
  pricing section and the footer of the landing page. Like the landing page it is the same
  for everyone, sets no cookie and runs no script. A self-hosted server does not serve it.

Changed

• The Mac app looks for updates at
  https://raw.githubusercontent.com/souriscloud/istrek-releases/main/appcast.xml, and every
  update in that feed is downloaded from the public releases page.
• The sitemap of a hosted server lists /self-hosting beside /.

Before you update

• No migration and no new setting. 0.6.0 and later clients are served.
• One-off commands (istrek eval …) must start in a folder the server's account can read;
  started from another user's home folder they stop with Kernel pid terminated. The guide's
  istrek-eval helper changes to /var/lib/istrek first.

Known limits

• The Mac app (Istrek-VERSION.dmg) and istrekctl-VERSION.zip are not published yet. They
  need Developer ID signing and notarization, and will appear on the same releases page.
  Until then the server, its web pages, its API and its MCP endpoint are what you can use.
• Only the amd64 build of the server is published.
• Istrek has not been audited or penetration-tested by an outside party.