Skip to content

Flytower 1.4.1-native.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Nov 18:29
native-1.4.1-native.1
83545e6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The native build of 1.4.1. It's the same code as 1.4.1, published so panels on the Native channel get the security fixes too. The Rust system helper gets the same hardening as the Bun one. It only accepts the panel's own user, keeps its files where only root can change them, and makes updates and rollbacks safe.

Testing: follow Testing the Rust agent on a spare VPS.

Features

  • rust-agent: helpers for writing and copying files without following links (51ccd75)
  • agent: helpers for writing and copying files without following links (610a2fe)

Fixes

  • let the box itself see versions on the health check under Bun (a42cc78)
  • rust-agent: move agent state and server archives out of the panel's folder (3faccb8)
  • rust-agent: one update at a time, recorded before the updater starts, and no downgrades (13f5560)
  • rust-agent: keep database copies root-only and never delete a live file the updater did not save (42d0063)
  • agent: clean up database copies in the agent's folder, and serialise with updates (bc45cce)
  • agent: move agent state and server archives out of the panel's folder (f0bf531)
  • agent: one update at a time, recorded before the updater starts, and no downgrades (b4eca6a)
  • agent: keep database copies root-only and never delete a live file the updater did not save (b216eac)
  • health check only tells versions to signed-in people and the box itself (62950a4)
  • type the export and past world delete calls (42d6105)
  • refuse changes from other sites and close the /api/_ gap (20d9f41)
  • check lockfile paths before moving or removing content (a07ef8b)
  • setup token guesses are limited per address and counted up front (5579a94)
  • check the panel's user, not its group, on the Rust agent socket (1be77d0)
  • run servers in their own group and hide the agent from them (b799c9e)
  • removing a passkey signs out your other devices (0003816)
  • past worlds to start a new server from only come from servers you can see (364fa28)
  • only follow jobs that exist and that you can see (c593802)
  • recovery-code sign-in checks one code instead of every code (d88de71)
  • rate limiter forgets old windows and counts the proxy's own hop (4a8a639)
  • deleting an export or past world needs a passkey check (8466d05)
  • validate level-name and keep world readers inside the server folder (53e098e)
  • cancelling an invite needs the standing to have made it (8857b08)
  • Discord role mappings follow the no-more-than-you-have rule (6fdd6b4)
  • write server-folder files through random exclusive temp files (16841c4)
  • only send a saved notification secret back to the same site (36d6b12)

Docs

  • release notes for 1.4.1 and its native build (e5de53f)
  • where the agent keeps its state, database copies and archives (2fcc26f)
  • deleting an export or past world asks for your passkey (fb292d6)
  • passkey removal signs out other devices; Discord role mapping limits (3327a12)

Other

  • pin version ordering in both agents (33dad60)
  • share compareVersions between the panel and the agent (9d2be54)
  • check a running server can't see the agent or the panel's data (1793857)

Full diff: native-1.4.0-native.1...native-1.4.1-native.1

Assets 7
Loading