Skip to content

v0.1.2 — Security release

Choose a tag to compare

View all tags
@100parik 100parik released this 25 Apr 10:51
v0.1.2
46159c2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release. Three high-severity findings from the v0.1.1 audit. No public-API breakage; existing v0.1.1 installs should upgrade.

Security

  • Viewer authentication for write endpoints — New LITOPYS_VIEWER_TOKEN env var gates POST/PUT/DELETE /api/node* and quarantine accept/reject with constant-time Bearer comparison. Read endpoints stay open. Loopback without token → read-only mode. Non-loopback without token → refuses mutations. Web UI prompts for token on first 401, stores in localStorage.
  • Constant-time MCP HTTP token comparison — checkBearer previously used !==; replaced with crypto.timingSafeEqual after a length-check.
  • Checksum verification in install.sh — Release workflow now generates SHASUMS256.txt from all compiled binaries. install.sh fetches and verifies SHA-256 before placing the binary on disk. Fails closed on mismatch. LITOPYS_SKIP_VERIFY=1 is available as an explicit override.

Fixed

  • Stale LITOPYS_VERSION=v0.1.0-alpha example in install.sh header updated to v0.1.1.

See CHANGELOG for full details.

Assets 8
Loading