admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4681 - done in sockeye: F40 fixed; repeatable fetch and fingerprint noted as a later case

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 12:55:10 -07:00
parent 445f9b0d0a
commit 7b40caec8b
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
devdocs/modernization/NET10-PORT.md
View File

@@ -194,7 +194,7 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
| 4725 | Sessions: password change ends sessions, exact-path token exemption, default SuperUser refused when licensed | F7, F8, F9 |
| 4726 | Login throttling/lockout | F6 |
| 4727 | Low severity hardening | F10, F11, F12, F22, F23, F25, F29, F35, F36, F38; the AyaNova half of F39 (DB ID not shown anonymously) |
| 4681 | Sockeye: licence/trial request hardening (tagged sockeye, rockfish) | F40; the Sockeye half of F39 (repeatable licence fetch) |
| 4681 | Sockeye: licence/trial request hardening (tagged sockeye, rockfish) | F40. **Done** (sockeye `cd3ebed`: rate limits, email check, cryptographic codes; rvf unchanged) |
**From the port and earlier triage**
@@ -230,6 +230,8 @@ Sockeye cases (exported 2026-10-24): 4710 (also in the table above) and 4681. 46
Moved out of 8.3.0 by John (2026-10-24): 4665 (health route checks the database) goes to the release after.
Later case to create (John, 2026-10-24): **repeatable licence fetch and server fingerprint**. AyaNova skips installing a fetched key identical to the installed one and adds to its rvf request a flag (it accepts repeat replies) plus a fingerprint: version, build (perpetual or subscription), platform, installation type (standalone, Windows LAN/IIS, Linux server, Linux desktop); Sockeye returns already-fetched keys only to flagged requests (older servers keep the one-shot reply) and stores the last fingerprint per DB ID, so John can see which versions and installation types are in use (e.g. whether standalone can be deprecated). Takes the Sockeye half of F39. Mention in the manual that the server sends this information.
Later, not 8.3.0: F42 (move the licence signing key out of Sockeye source) and F32 (rotate the
FastMail password after the old Sockeye server is retired), John's cases.

4
devdocs/modernization/SECURITY-REVIEW.md
View File

@@ -229,7 +229,7 @@ take the next free number; a fixed or accepted finding keeps its ID and changes
| F35 | Low | confirmed | No security headers from the server itself (self-hosted), no CSP anywhere, CORS any origin, public Swagger UI, download keys in URLs |
| F38 | Low | confirmed (code) | Linux hardening: no systemd sandboxing, service user can replace program files, desktop runs as root, unused Docker files with a fixed database password |
| F39 | Low | confirmed (code) | Licence fetch is one-shot by DB ID, and the DB ID is shown anonymously while unlicensed: someone else can take a new key first |
| F40 | Low | confirmed (code) | Trial request routes: no rate limit, non-cryptographic verification codes, a fixed bot-check value |
| F40 | Low | **fixed in case 4681** (Sockeye) | Trial request routes: no rate limit, non-cryptographic verification codes, a fixed bot-check value |
| F22 | Low | confirmed | Minor report and job route gaps: template export by any download key, job status, logs and cancel by GUID without an owner check, browser without sandbox |
**Release decisions.** John, 2026-10-23: **F13 to F17 are urgent and are fixed in 8.3.0**, as
@@ -852,7 +852,7 @@ John's cases for the findings (created 2026-10-24; full list in `NET10-PORT.md`,
cases"): 4710 (F5, F41), 4711 (F1), 4712 (F13 to F17), 4715 (F21), 4716 (F18), 4717 (F26),
4718 (F19, F24), 4719 (F20), 4720 (F27), 4721 (F33), 4722 (F34), 4723 (F3, F4), 4724 (F30, F31),
4725 (F7, F8, F9), 4726 (F6), 4579 (F2), 4713 (F28), 4727 (F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, and
the AyaNova half of F39), Sockeye 4681 (F40 and the Sockeye half of F39). Not in 8.3.0: F32, F42 (John's later cases); F37 accepted. When a
the AyaNova half of F39), Sockeye 4681 (F40). The Sockeye half of F39 (repeatable licence fetch) moved to a later case: AyaNova reinstalls and logs any key it fetches without comparing it with the installed one (trial servers with data would log an E1020 error on every fetch), and deployed older servers cannot be changed, so it needs an AyaNova-side change plus a request flag that Sockeye honours. Not in 8.3.0: F32, F42 (John's later cases); F37 accepted. When a
case is done, its findings' status becomes *fixed in case NNNN*.
## Customer contact route allowlist (draft, for the F13 to F17 fix)