admslader/tapestry
1
0
Fork 0
Code Issues Pull requests Projects Releases 21 Packages Wiki Activity Actions
21 releases 21 tags
  • v1.5.1 784990bfa0

    Release 1.5.1 Stable

    admslader released this 2026-10-13 21:10:53 -04:00 | 60 commits to main since this release

    v1.5.1 - Security Hardening

    What's New in v1.5.1

    This release hardens the app's security across the database, the updater, and
    sign-in. There are no new features — the goal is a safer app with the same
    everyday experience.

    🔒 Security

    • Updates are now verified with a signed signature before they install, so a
      tampered or spoofed release can't run
    • Signed-out visitors can no longer read the schedule, tasks, or comments
    • Comments are always attributed to the signed-in user — no more posting as
      someone else
    • The user directory and activity history are now visible to supervisors only
    • Your sign-in session is stored in the system keychain instead of a plain file
    • Switching between servers now signs you out first, so you can't be silently
      logged into another site
    • The master-server URL must be https

    🐛 Fixes

    • Update downloads are now bounded (a timeout and a size limit)
    • The Windows updater no longer builds a shell command from a download's
      filename

    🛠️ Technical Improvements

    • Hardened the license control plane: constant-time token checks, rate-limited
      public endpoints, and per-site keys stored in Supabase Vault
    • Android release builds use a real signing key and no longer allow backups
    • The web build ships a Content-Security-Policy
    • Build-time downloads are checksum-verified
    • Added a release helper (tool/release.sh) that signs and publishes artifacts
    Downloads