Skip to content

Flagpost v1.7.0 — Module SDK & marketplace, cross-competition skills, challenge sharing

Choose a tag to compare

View all tags
@tbcsec tbcsec released this 13 Oct 21:22
· 57 commits to main since this release
v1.7.0
c2de9ba
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Flagpost v1.7.0 — the module SDK & marketplace, a cross-competition skills web, and shareable challenge links, on top of a new default object store and a broad pre-release security pass. Every issue in the v1.7.0 milestone is closed.

🧩 Module SDK & marketplace (ADR-0040)

Flagpost can now import modules and content from an open, mirrorable registry — and ships the tooling to author them.

  • Content packs (Tier 0). Install challenge packs (into a competition) and theme packs (site-wide) through the existing, validated importers — behind a new install_content_pack permission.
  • Signed, trust-tiered protocol. A documented registry protocol + manifest v2: code-based resolve → confirmation/trust screen → signature + digest verification → install → audit. The registry's trust claims are display hints; the instance re-verifies every artifact against its own policy. Default policy is verified with no root key configured, so nothing installs from the hosted registry until an operator opts in — safe by default. A configurable marketplace_url (default marketplace.flagpost.io) keeps the OSS core independent of any hosted service; mirrorable and air-gappable, and a single marketplace_enabled kill switch fully disables the surface.
  • Authoring SDK. backend/sdk/ — deterministic, content-addressed build, detached-signature sign, manifest/package validate, and a scaffold CLI, plus docs/MODULE_SDK.md.

Scope note: v1 ships content packs + the import client + the SDK. Declarative (Tier 1) and signed-code (Tier 2) modules are designed in ADR-0040 but intentionally not built in this release; Tier 3 sandboxing stays out of scope.

🕸️ Cross-competition skills web (#364, ADR-0039)

The first participant-facing consolidation view — a per-player skill profile that spans every competition on the instance, gated site-wide by a skills_enabled switch.

  • For competitors: a personal skills radar and an at-a-glance stats strip (most/least-solved category, totals) on the profile.
  • For organisers: an Administrator users × skills matrix that answers "who's proficient, who's struggling, who's fresh" — difficulty-weighted scores (decay rarity priced in at solve time), coverage against each player's genuine opportunity, a percentile heat-map as the cross-competition comparator, efficiency (attempts/hints per solve) and first-blood signals, activity-window filters, a per-user drill-down, a population footer, and CSV export.

🔗 Challenge sharing — invite & view links (#427)

Organisers can share a competition with a direct link, not just a code.

  • Join links (public and private competitions) and view links (public-only, read-only) — each revocable, expiring, and use-capped, managed under a new manage_invite_links grant in Settings → Sharing.
  • A public landing page at /invite/{token} walks recipients from link → sign-in/register (the token survives the auth round-trip, including SSO) → joined, honouring the rules, email-verification, registration-field and registration-window gates.

💾 RustFS replaces MinIO (ADR-0041)

The default object store is now RustFS, with vendor-neutral S3_* configuration. Upgrading from v1.6 or earlier is a hard break: the MINIO_* variables were renamed (MINIO_ROOT_USER→S3_ACCESS_KEY, etc.) and the backend refuses to start while any MINIO_* variable is still set, printing the mapping. See the README's "Deploying to production" → upgrade notes for the one-time object migration.

🔒 Security

A broad pre-release hardening pass across authentication, SSO, real-time, automations, webhooks, challenge instancing, import/export and the gameplay gates — including a dedicated multi-agent security review whose Medium findings were all fixed before this tag (hint status/pause gating, the marketplace kill-switch covering every path, an activity-room draft-challenge leak, and two concurrency caps made atomic). Several earlier GHSA-tracked fixes also land in this release.

📝 Also new

  • An in-app changelog at /changelog, linked from the footer.
  • Boot-time baseline import from a platform export (#357), for provisioning a fresh install from a known-good template.

Full history: the in-app /changelog and the v1.7.0 milestone. Source builds now report 1.7.0-src; pull the pinned images from GHCR by tag.

Assets 2
Loading