From 7c45fecff3f64e0a68ba645c1cf0472eb2fc00c7 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 13 Jun 2026 19:16:16 +0200 Subject: [PATCH] docs(changelog): v0.59.0 audit fixes (CTRL-001, CTRL-T2-1, H10, M2) Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index cbf58f0..654e489 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,34 @@ ## Changelog +### v0.59.0 — security/crash-safety fixes from the 2026-06-13 audit (2026-06-13) + +Fixes the validated findings from the deep-sweep audit + BUGHUNT reconciliation +(records under `felhom.eu/documentation/audits/`). All shipped with permanent +regression tests. + +- **CTRL-001 (path traversal on `.fab` import) — High.** `appexport.UnmarshalManifest` + did zero validation; the attacker-controlled `manifest.AppName` / `HDDSubdirs` / + `VolumeNames` reached `filepath.Join`+`MkdirAll`/`extractTar` (restore.go:339/606/678), + so `../..` in any escaped the stacks / HDD destination dir (arbitrary write as the + controller). New `appexport.ValidateSegment` + `validateManifestPaths`; + `UnmarshalManifest` now fails the parse on a traversal segment, with defence-in-depth + guards at the HDD-subdir and volume-name join loops. `ConfigFiles` intentionally not + validated (holds dotfiles, never used in a restore join). +- **CTRL-T2-1 (ghost-deployed stack on crash) — High.** `DeployStack` wrote `app.yaml` + `deployed:true` to disk *before* the async `docker compose up -d`; a crash during the + image-pull window left a ghost-deployed stack with no containers that the app then + refused to redeploy. The env is now persisted `deployed:false` (transitional) and + flipped to `deployed:true` by `runComposeDeploy` only after `up -d` succeeds. The + in-memory flag still goes true during the pull (no stale "Telepítés" button). +- **H10 (plaintext secret on encrypt failure) — fail-closed.** `SaveAppConfig` logged a + WARN then fell through to persist the secret in plaintext on a `crypto.Encrypt` error. + Now returns an error instead — never writes plaintext. +- **M2 (misleading lock).** `backup.Manager.SetStackProvider` was mutex-guarded while all + reads were unlocked; it is init-only (one call before any goroutine), so the lock was + removed and the contract documented. No behaviour change. +- **AGENT-001 (wrong-disk wipe race)** is fixed on the agent branch `fix/agent-001-wipe-durable-reresolve` + (PENDING REVIEW — not deployed; stored out-of-band per the supervised-merge rule). + ### v0.58.0 — infra-protection prevention layer for the OS/Docker-data split (2026-06-13) Phase 2 of the storage-split slice (Phase 1 = felhom-agent golden + provision). The OS rootfs and