| Comment: | fix(leaf): grant unauthenticated peers capabilities explicitly; go-libfossil v0.11.0 (#201)
go-libfossil v0.11.0 gives a new repository's `nobody` user fossil's default capabilities, clone and pull (`gjorz`), instead of push and Setup (GHSA-44p2-whvx-9gwq). Leaves that accept pushes from peers syncing without credentials, over HTTP, NATS or iroh, now have to grant that explicitly. - agent.Config.NobodyCaps, applied by agent.New, sets the leaf repo's nobody capabilities. Empty keeps what the repo stores. - The leaf binary takes it as -nobody-caps / LEAF_NOBODY_CAPS. For example, `gio` lets unauthenticated peers push to this leaf. - The leaf-to-leaf iroh tests grant `gio`, since their peers push without credentials. The bump also brings v0.11.0's other security fixes: the login nonce is checked against the request body, reqconfig is scoped, payload sizes and table-sync rows are validated, and HTTP replies are capped. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
|---|---|
| Timelines: | family | ancestors | descendants | both | trunk | main |
| Files: | files | file ages | folders |
| SHA3-256: |
dbb0c043213959aea559ebf4365bbe9c |
| User & Date: | [email protected] on 2026-10-11 01:48:18.000 |
| Other Links: | branch diff | manifest | tags |
|
2026-10-11
| ||
| 13:52 |
build(deps): bump github.com/danmestas/go-libfossil to v0.11.1 (#203)
v0.11.1 fixes GHSA-mvx3-6793-8x4r (the sync server sent content to requesters without read permission) and GHSA-3f8x-8fr5-mr98 (the HTTP client followed redirects from HTTPS to HTTP). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> leaf check-in: 0a4c779ae2 user: [email protected] tags: trunk, main | |
| 01:50 |
build(deps): bump the cargo group across 1 directory with 2 updates
Bumps the cargo group with 2 updates in the /iroh-sidecar directory: [hickory-resolver](https://github.com/hickory-dns/hickory-dns) and [rustls](https://github.com/rustls/rustls). Updates `hickory-resolver` from 0.26.1 to 0.26.3 - [Release notes](https://github.com/hickory-dns/hickory-dns/releases) - [Changelog](https://github.com/hickory-dns/hickory-dns/blob/main/CHANGELOG.md) - [Commits](https://github.com/hickory-dns/hickory-dns/compare/v0.26.1...v0.26.3) Updates `rustls` from 0.23.43 to 0.23.45 - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](https://github.com/rustls/rustls/compare/v/0.23.43...v/0.23.45) --- updated-dependencies: - dependency-name: hickory-resolver dependency-version: 0.26.3 dependency-type: indirect dependency-group: cargo - dependency-name: rustls dependency-version: 0.23.45 dependency-type: indirect dependency-group: cargo ... Signed-off-by: dependabot[bot] <[email protected]> leaf check-in: 0f53f1d32b user: [email protected] tags: trunk, dependabot/cargo/iroh-sidecar/cargo-60501f734e | |
| 01:48 |
fix(leaf): grant unauthenticated peers capabilities explicitly; go-libfossil v0.11.0 (#201)
go-libfossil v0.11.0 gives a new repository's `nobody` user fossil's default capabilities, clone and pull (`gjorz`), instead of push and Setup (GHSA-44p2-whvx-9gwq). Leaves that accept pushes from peers syncing without credentials, over HTTP, NATS or iroh, now have to grant that explicitly. - agent.Config.NobodyCaps, applied by agent.New, sets the leaf repo's nobody capabilities. Empty keeps what the repo stores. - The leaf binary takes it as -nobody-caps / LEAF_NOBODY_CAPS. For example, `gio` lets unauthenticated peers push to this leaf. - The leaf-to-leaf iroh tests grant `gio`, since their peers push without credentials. The bump also brings v0.11.0's other security fixes: the login nonce is checked against the request body, reqconfig is scoped, payload sizes and table-sync rows are validated, and HTTP replies are capped. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: dbb0c04321 user: [email protected] tags: trunk, main | |
|
2026-10-03
| ||
| 19:00 |
build(deps): bump github.com/danmestas/go-libfossil to v0.10.0 (#200)
Bumps go-libfossil from v0.9.0 to v0.10.0 in the root, bridge and leaf modules. The release fixes three data-loss bugs in the checkout API (Revert deleting never-committed files, Rename overwriting an existing file, Extract overwriting local edits on checkouts made by the fossil binary) and aligns checkout behavior with fossil. EdgeSync calls none of the affected functions except Extract via CreateCheckout, whose tests pass unchanged. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> check-in: 087d06ceea user: [email protected] tags: trunk, main | |