vvvomit/interzone
Watch
1
0
Fork
You've already forked interzone
 0
Code Issues Pull requests Projects Releases 50 Packages Wiki Activity Actions
50 releases 50 tags
  • v0.5.33 ec1f489385

    v0.5.33 Stable

    vvvomit released this 2026-10-29 22:34:53 +03:30 | 44 commits to main since this release

    Safer on disk and on the wire: fixes from a codebase audit

    Thank you, @TheNarratorsFrevor! Everything in this release comes from their audit of interzone (pull request #1): fifteen careful fixes, each with a clear account of what went wrong and why.

    Security

    • Ansible checks the server's SSH host key. Playbooks used to run with host key checking off, so someone in the middle could pose as the server and receive the sudo password and every secret. A new server is trusted the first time; a changed key stops the run.
    • Offline bundles can't write outside the folder they unpack into, even through links made by earlier entries. A bundle also leaves out leftover files holding the admin's password.
    • Passwords stay off command lines (registering a user no longer shows it in ps), and the SSH connection-sharing folder in /tmp is only used when it's yours alone.
    • Answers, presets and the inventory are always written owner-only, and atomically, so a crash or full disk keeps the old file.

    Data loss

    • interzone servers rm with no name deleted the first server's answers. It now prints the usage.
    • A config.json that isn't valid JSON is moved aside instead of being overwritten with new secrets, which would have locked Synapse out of Postgres on the next deploy.
    • Rollback keeps each server's replaced answers apart (they shared one file), and stops if it can't save them.
    • Moving to a new server copies all of /matrix, or says why not. A slow receiver could lose the end of the archive, and a full disk made the copy hang.
    • The base domain must be a hostname: a pasted https:// is dropped, and an imported domain can't write outside the playbook.

    Hangs and crashes

    • A very long line of Ansible output no longer freezes the run.
    • A server without /etc/os-release no longer crashes the mirror check.
    • Background checks no longer crash the app when you change settings while they run.
    • Leaving a screen mid-check no longer leaves it spinning for good, and a new user password shown once is no longer lost.

    Smaller fixes

    • Commands take their options after the arguments too (restore dump.sql --yes).
    • -layout and -theme are checked before -reset moves anything.
    • Passwords with {{ or {%, which Ansible would misread, are caught before the deploy, and passwords starting with - work with MAS.
    • pgup scrolls the deploy log, logs and Fine-tune lists.
    • make builds report a version self-update understands, and make test runs what CI runs.
    • The screenshot scripts find their fonts on any distribution.

    Update with interzone self-update or Manage › Update interzone.

    Downloads