Skip to content

v1.2.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Sep 20:29
· 39 commits to master since this release
v1.2.2
a14b01f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Ubuntu Hello v1.2.2 - Verified Model Downloads, Keyring Seal Safety, SonarQube Cloud

This release closes an integrity gap in how the setup wizard fetches the face-recognition models, which it downloads and unpacks as root, and fixes four ways enabling keyring unlock could go wrong: losing the previous seal, choosing TPM sealing on a partial tpm2-tools install, accepting an empty piped password, and a Settings edit deleting comments from config.ini. Under the hood, the project now runs SonarQube Cloud static analysis locally and in CI, and went from 356 findings to none.

🔧 What's in this release

  • 🛡️ Security: the setup wizard now verifies the face models it downloads. When the models are missing, the wizard runs dlib-data/install.sh as root to fetch the three dlib archives and unpack them. It unpacked whatever arrived: there was no integrity check, and the github.com/.../raw/ URLs it used answer with a redirect. Each archive is now checked against a pinned SHA-256 before anything is unpacked. The pins are the same ones package-configure.sh already used for the packaged install path, so the two paths now agree where before only one of them verified. Redirects are also refused: the canonical raw.githubusercontent.com URLs serve the files directly, and wget gets --max-redirect=0 while curl gets --max-redirs 0 --proto-redir =https. A mismatch aborts the download, and the wizard reports it as a failed download.
  • 🔐 Fix: switching keyring unlock between TPM and software sealing could lose the seal. Each sealing path deleted the other mechanism's credential before writing its own, so a failure in between (a TPM command, encryption or a file write) left the user with no usable seal. The previous credential is now kept until its replacement is on disk.
  • 🧰 Fix: keyring enable could fail mid-seal on a partial tpm2-tools install. It chose TPM sealing when tpm2_createprimary and tpm2_unseal were present, but sealing also runs tpm2_create and restoring runs tpm2_load. All four are now required; if any is missing it falls back to software sealing.
  • 🚫 Fix: an empty piped password was sealed and reported as success. echo | ubuntu-hello keyring enable (EOF or a bare newline) sealed an empty string, but unsealing treats an empty result as failure, so the seal never unlocked anything. It is now rejected, as the interactive prompt already did.
  • 📝 Fix: a Settings edit deleted comments from config.ini. Replacing a key treated any indented line after it as part of the old value, including indented #/; comments. Comments are now kept, while the old value's real continuation lines are still dropped, so a stamp_rules update never leaves a stale rule behind.
  • 🔏 Fix: source installs set config.ini to 0744. The Meson install path gave the file an execute bit, diverging from every package path, from docs/SECURITY.md and from the booted-OS mode check. It is now 0644.
  • ⏱️ Fix: the auth window's user lookup could hang. Its last-resort loginctl call had no timeout, so a stalled logind could block the authentication window. It is now bounded at 5 seconds, like the Settings window's.
  • 🔎 New: SonarQube Cloud. ./scripts/ci-sonar.sh runs the analysis locally in a pinned Docker scanner, and CI scans as a step in the coverage job, with a quality gate on pushes to master and on pull requests from this repository (fork pull requests skip the scan, as they cannot read the SONAR_TOKEN secret). The project went from 356 findings to 0, with 0 bugs and 0 vulnerabilities and A ratings for reliability, security and maintainability. Most of the fixes above came out of that work or its code review. Where a rule misreads this project's idioms (GTK CSS selectors, kernel-mirroring v4l2 names, kwallet-pam's fixed PBKDF2 parameters, the PAM module's mandatory C-ABI casts), it is scoped per rule and per path, with the reason written next to it, and never suppressed in the source.
  • ⚙️ CI: runs once per pull request. push and pull_request both fired for every PR branch and landed in different concurrency groups, so every push ran the whole matrix twice. push now fires for master only. The booted-OS tier runs on same-repository release pull requests (feature/v*), and is guarded so a fork cannot trigger it.

No new config keys, no new or changed translatable strings, and no dependency changes. Desktop, greeter and wallet compatibility is unchanged: GNOME, KDE Plasma, XFCE, Cinnamon, MATE, Budgie and LXQt with GDM, SDDM and LightDM; GNOME Keyring (pam_gnome_keyring) and KWallet (pam_kwallet5).

📥 Installation (from Release assets)

Verify downloads against SHA256SUMS on the Release page before installing. Download this release's assets into an empty/clean directory before running these commands — the wildcards below match by filename pattern, and leftover assets from another version in the same directory can make a package manager see multiple matches (or, for the AppImage command, pass a second matched file as a stray argument).

Format Command
Debian (amd64 + arm64) sudo apt install ./ubuntu-hello_*_$(dpkg --print-architecture).deb ./ubuntu-hello-gtk_*_$(dpkg --print-architecture).deb
Fedora (amd64 + arm64) sudo dnf install ./ubuntu-hello-[0-9]*fc44*.$(uname -m).rpm ./ubuntu-hello-gtk-*fc44*.$(uname -m).rpm
openSUSE (amd64 + arm64) sudo zypper install ./ubuntu-hello-[0-9]*lp160*.$(uname -m).rpm ./ubuntu-hello-gtk-*lp160*.$(uname -m).rpm
AppImage (amd64 + arm64) chmod +x Ubuntu-Hello-*-$(uname -m).AppImage && ./Ubuntu-Hello-*-$(uname -m).AppImage --install
Arch (amd64 only) sudo pacman -U ./ubuntu-hello-[0-9]*.pkg.tar.zst ./ubuntu-hello-gtk-*.pkg.tar.zst
Snap (amd64 only) sudo snap install --dangerous --classic ubuntu-hello_*_amd64.snap && sudo snap run ubuntu-hello.host-install
Flatpak (amd64 only) flatpak install --user ./com.github.ventura8.UbuntuHello-*.flatpak && flatpak run --command=ubuntu-hello-host-install com.github.ventura8.UbuntuHello

PPA remains available:

sudo add-apt-repository ppa:ventura8/ubuntu-hello && sudo apt update && sudo apt install ubuntu-hello

Optional source install: download install.sh from the v1.2.2 tag, review it, then run locally — do not pipe a moving branch URL directly to bash.

Full Changelog: v1.2.1...v1.2.2

Assets 30
Loading