Skip to content

v0.5.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Jul 02:33
Immutable release. Only release title and notes can be modified.
v0.5.2
41249c0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's new in v0.5.2

Fixed

  • A slow keychain read can no longer crash the setup page or leak a secret to
    the log.     When security returned a secret just after its timeout,
    CommandRunner left that output — the raw secret — in the calling process's
    mailbox; a GenServer caller (the setup LiveView, BootReport) then crashed on
    the unexpected port message and the secret was written into the crash log. The
    runner now drains and flushes any late child output on timeout, so it never
    reaches the caller.
  • Honest Computer Use install error. A failed Computer Use install now says
    the native helper "hasn't been published for this platform yet" rather than
    "…for this Fermix version yet", which wrongly implied a fermix upgrade would
    help. (The helper's first release is still pending.)

Changed

  • macOS keychain secrets are stored with an open access list (-A). Without
    it, each item's ACL is pinned to the exact code signature of the writing
    binary; the daemon — an ad-hoc-signed, per-version binary the keychain can't
    reliably match — is then treated as an untrusted app and macOS blocks every
    read on an authorization prompt the headless service can't answer, so reads
    hang and time out (slow boot, slow/failed setup). -A lets the daemon read
    headlessly. Trade-off: any process running as the same user can read the item
    without a prompt — no weaker than the pre-keychain plaintext-in-config
    baseline, and still keychain-stored. The proper long-term fix is Developer-ID
    signing the release binary. Existing secrets keep their old ACL until
    re-stored (re-enter them in fermix setup, or security add-generic-password -U -A …).

Fixed

  • The daemon no longer crashes at boot when the login keychain is locked. A
    required secret stored under @keyring (e.g. OPENAI_API_KEY) whose keychain
    read timed out — common when the login keychain is locked or slow at daemon
    launch — raised during config hydration and took down the whole node, leaving
    the setup UI (the very surface used to fix it) unreachable. Boot now leaves the
    @keyring sentinel in place and logs the failure (the same graceful handling
    optional secrets already had) instead of crashing; the secret resolves on the
    next boot once the keychain is reachable.
  • fermix setup no longer opens the browser before the endpoint is live. On a
    readiness timeout the launcher printed the URL but still opened the browser,
    landing on "Safari can't connect to the server". It now opens the browser only
    once the endpoint actually answers; on timeout it hands back the URL to open
    manually.
  • The setup 403 page is now actionable. Reaching the token-gated /setup page
    without an authorized session returns setup authorization required plus a line
    telling you to run fermix setup (the only thing that authorizes a browser
    session), instead of a bare error.

Verifying signatures

Each binary is signed with cosign using GitHub Actions OIDC keyless signing. Verify a download with:

cosign verify-blob \
  --certificate fermix_<target>.pem \
  --signature  fermix_<target>.sig \
  --certificate-identity-regexp "https://github.com/tezra-io/fermix/.github/workflows/release.yml@.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  fermix_<target>

The releases.json artifact lists every binary's URL, sha256, and signature URLs.

Assets 20
Loading