v7.4.7 — "0nceMatters"

Pre-release from the dev branch, like 7.4.1 to 7.4.6 before it. main and the Docker latest tag stay on 7.4.0 until the next main release, and no Docker image is published for this one. To run it, download the tarball below, or build an image from the tag: docker build -t remotepower:7.4.7 https://github.com/tyxak/remotepower.git#v7.4.7.

Check the download with sha256sum -c remotepower-7.4.7.tar.gz.sha256 and gpg --verify remotepower-7.4.7.tar.gz.asc remotepower-7.4.7.tar.gz (signing key E7B5AD456728B8462A8B54BFD488AF115D2CCDBF).

---

RemotePower v7.4.7 — "0nceMatters"

A patch release for two requests (#56 and #57), with the Thermal, Disk and Host metrics work that followed 7.4.6. Every
problem is on one list, once; a switch decides which CVE findings the numbers count; the Thermal page charts any sensor;
the disk views list a filesystem once; and the page no longer sits under the sidebar while alerts are open.

After upgrading, hard-reload the dashboard once so the new front-end loads. The agents changed only in their version number.

One list of problems

A service fails, an alert fires, Needs Attention lists the failed unit and the Systemd units check turns critical. That is
one problem in three places, and closing it in one place did not close it in the others. Monitoring → Problems joins
them: a row is one kind of problem on one host, with every alert, Needs Attention item and failing check that belongs to it
listed under it.

Each row has a state, so you can tell what is still wrong. An alert you resolved by hand while the host still reports the
problem reads Resolved, still failing, and Resolved, waiting for the host until the host has reported since. An open
alert that Needs Attention and Checks no longer list reads Alert open, no longer listed.

• Four views (All problems, Alerts, Needs Attention and Checks) filter the one list, each with its count. Four tiles count the
  states that need you, and you can filter by state and by text.
• History. The clock button opens everything that happened to a problem: each alert raised (and how often it came
  again), acknowledged and resolved, by whom and how, with the note.
• Actions on the row. Resolve closes every open alert of the problem at once. Mute, Snooze 24 h, Ignore, Disable check and
  Fix are in the row's menu. Each one sends the request the page it comes from sends, so a role needs the permission it always
  needed, and Mute, Snooze, Ignore and Disable check offer an Undo.
• The other pages say it too. The Alerts page tags an alert the host disagrees with (Still failing, Waiting for the
  host, No longer listed), Needs Attention and Checks tag an item or a check whose alert someone resolved, and a bar under
  the title of those three pages links the four. See problems.md.

Count only what an update can fix

On a host with hundreds of findings that no update for its release can clear, a count of every finding is a number nobody can
act on. Settings → Security → CVE counts has a new switch, Count only CVEs an update can fix, or that are known to be
exploited, off by default. With it on, the sidebar badge, the severity tiles, Needs attention, the risk score, Checks, the
scheduled digest and the Fleet query leave out a finding that is fixed only in a newer release or has no fix yet. Every finding
stays on the CVE page, and the CVE page says when the switch is on. See cve.md.

Two things changed whether the switch is on or off. The badge and Checks no longer count a finding you accepted as a risk, as the
CVE page, the dashboard and Needs attention never did, and the badge, Needs attention and the digest count monitored hosts only,
as the badge's description always said.

Thermal, Disk and Host metrics

• Chart any sensor. Every row of the Thermal page's sensor table has a Chart button: a board sensor, a drive or a GPU.
  The ranges are 24 hours, 8 days and 30 days. History starts when the server starts collecting it, so the 24-hour view fills
  first. See thermal.md.
• One entry for each filesystem. A btrfs volume reports each subvolume as a mount of its own, all with the size and use of the
  volume, so Host metrics and the Trends chart showed one disk seven times and the figures looked as if they never moved. Mounts
  with the same size and use are one entry now, named for the shortest mount point with a count of the others.
• The Disk chart says what it plots and fits its axis, and Host metrics says when its figures were reported ("Reported 7m
  ago"). The Disk I/O table says what its figures cover: an average over about 10 minutes.

The page makes room for the sidebar

With open alerts the sidebar pins itself open at 248 px as an overlay, and the page kept the margin of the closed rail, so the left
192 px of every page (its title, its first filter and its first columns) sat under it. The page and the top bar take the sidebar's
width while it is pinned, and a hover over the closed rail is still an overlay. The My Account setting Keep hiding while alerts
are open and a manual collapse are unchanged.

Also fixed

• The drawer of a switch or an access point names its SSH port box and its three SNMP lists now, so a screen reader
  announces them instead of an unlabelled field.
• The thermal roll-up and the Trends history of a host no longer fail as a whole because one stored row is not shaped
  like what the server writes.

Security review

One low issue was fixed before release, in five readers. A stored alert that is not shaped like what the server writes (a payload
that is a string, an event or a host id that is a list, a time that is not a number) made the Problems list, the Alerts inbox,
the dashboard and the resolution stats answer 500 to everyone for as long as the row stayed, and stopped the autonomy sweep.
Only a hand edit or an import can store such a row. The readers skip what they cannot read now. The new routes held up against
users scoped to a group, a tag and a tenant, against hostile parameters, against markup planted in everything the new pages
print, and against 18 hostile heartbeats from a host with a valid token. See
security-review-7.4.7.md.

Translations

The text this release added is available in Chinese, Hindi, Spanish, Arabic, German and French. A native speaker has not read it
yet; if a line reads wrong, tell us.