v0.5.4

What changed

Changed

• Testing ntfy, Pushover or email now tests the Acknowledge button too.
  The test used to send each channel's own hand-written message with nothing
  to press on it. It proved the message arrived and nothing about
  acknowledging it, which is how ntfy's Acknowledge button could do nothing
  (fixed in 0.5.2) while every test passed.

  The test now sends a real alert about a real test incident. It is built by
  the same code as every other alert and carries the same button or link.
  Press Acknowledge on it, on the device, and the settings page says
  Acknowledged via ntfy — acknowledgement works from ntfy. If it was
  acknowledged from the web page instead, or closed without being
  acknowledged, the page says that instead. If web.ack_base_url is not set,
  the alert has no button on it, and the page says so and why.

  A test never escalates and never counts as alerting on the board. If nobody
  acknowledges it, it is closed after fifteen minutes. Pressing test again
  replaces the one still waiting, and a restart closes any test it
  interrupted. Voice and webhooks test the way they did before: nobody
  acknowledges from either.

Fixed

• A fresh install opened straight onto Settings now offers the first
  password. It usually showed a plain Password box instead, with nowhere to
  put the setup token. Anything typed there was refused with "no password is
  set yet". The page drew the card before it knew setup was still needed, and
  did not redraw it once it did. Going to another tab and back got past it.
• A listener bound to this machine's LAN address is no longer called
  unreachable. With web.listen set to an address like
  192.168.1.50:8322, every start warned that nothing was listening where a
  phone could reach it, and advised 0.0.0.0. A phone on that LAN reaches it
  perfectly well. The warning now fires only when the listeners are on
  loopback, which is the case it was written for.

Verifying this release

Every binary is signed. Verification instructions, including how to
rebuild from source and compare hashes, are in
docs/RELEASING.md.

Linux / macOS — cosign (keyless, no key to trust in advance):

cosign verify-blob notifymatrix-linux-amd64 \
  --bundle notifymatrix-linux-amd64.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/suburbazine/Unifi-Notification-Matrix/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Download the .sigstore.json next to the binary; it carries the
signature, the certificate and the transparency-log proof. Keep
--certificate-identity-regexp — without it cosign verifies a
signature from anyone.

Build provenance (any platform):

gh attestation verify notifymatrix-linux-amd64 --repo suburbazine/Unifi-Notification-Matrix

Windows: the .exe is Authenticode-signed and timestamped.
Right-click → Properties → Digital Signatures, or:

Get-AuthenticodeSignature .\notifymatrix-windows-amd64.exe

This is source-available software under the
PolyForm Noncommercial License 1.0.0. Commercial use
requires a licence: licensing@xtremission.com

Full Changelog: v0.5.3...v0.5.4