admslader/orbita
1
0
Fork 0
Code Issues Pull requests Projects Releases 11 Packages Wiki Activity Actions
11 releases 11 tags
  • v0.4.0 a12258dd9b

    Release 0.4.0 Stable

    admslader released this 2026-10-13 20:43:13 -04:00 | 51 commits to main since this release

    v0.4.0 — Hardened updates

    Command Center now verifies every self-update before applying it, and the fleet
    view groups machines by site.

    ✨ What's new

    • 📊 Stale machines on the dashboard — the overview rolls up machines that
      haven't checked in for 7 days, and the Seats nav item carries a badge.
    • 🗂️ Fleet grouped by site — the Seats screen lists one collapsible card per
      company, with machines nested under deployment sub-headings when a site spans
      more than one deployment. The collapse state is remembered per control plane.

    🔐 Security

    • 🔏 Verified updates — the self-updater verifies each release artifact's
      detached RSA-2048/SHA-256 signature (<asset>.sig) against an embedded
      public key before applying it, and refuses a release whose signature is missing
      or invalid. Asset URLs must be HTTPS on the Forgejo host, every redirect hop is
      re-validated, and downloads are bounded by a size cap and an idle timeout.
    • 🔑 No token in release builds — --dart-define=CONTROL_PLANE_ADMIN_TOKEN
      is now debug-only; release builds require the token at runtime (stored in the
      OS keychain), so it is never baked into a shipped binary.
    • 🔒 HTTPS required — control-plane URLs must be https:// (loopback
      http:// is allowed for local dev); the admin token travels in a header.
    • 🧱 Hardened Windows updater — the generated batch script rejects paths that
      could inject commands.
    • 🛡️ Private download staging — updates stage in a private per-run temp
      directory instead of the shared system temp.
    • 🌐 Web warning — the browser build warns that the admin token is kept in
      browser storage, not a secure keychain.

    🧱 Under the hood

    • New domain/update/release_crypto.dart (RSA primitives) and
      update_signature.dart (UpdateSignatureVerifier); UpdateService verifies
      the detached <asset>.sig and fails closed.
    • New tool/release.sh + tool/sign_release.dart for build → sign → publish.
    • AppImage tooling (linuxdeploy, GTK plugin) pinned and checksum-verified;
      Android release builds use a real keystore when key.properties is present.
    • dart analyze clean, all tests green, Linux build succeeds.

    📦 Assets

    Attach the matching asset (and its .sig) to install automatically:
    Linux command_center-0.4.0-linux.AppImage, Windows
    command_center-0.4.0-windows.zip.

    Downloads