Skip to content

CHANGELOG.md

Latest commit

 

History

History
542 lines (357 loc) · 28.2 KB

CHANGELOG.md

File metadata and controls

542 lines (357 loc) · 28.2 KB
Raw

1.31.0 (2026-07-12)

Bug Fixes

  • kube (af5066f)
  • kube: add services lol (523adfe)
  • lint-staged: remove unnecessary braces from go glob pattern (29c1e32)
  • mi: resolve multiple bugs in cmd/mi (b8d7138)
  • within.website: use 
     for go get snippet (1344e4b)
  • xess: drop blockquote left border (b4536b9)

Features

  • add design.within.website demo site for xess (2331f46)
  • kube/alrest: add lurker (57e00fe)
  • kube: import base saga cluster config (d145106)
  • license: add non-ai licenses (8ae3e94)
  • mi/mcp: add event management tools (c0c0ef5)
  • mi: add member name alias support to switch tracker (#863) (d3f7e04)
  • mi: add Zoe as nickname for W'zamqo (585f90f)
  • mimi: remove falin image generation service (a3a3e35)
  • sigv4: add AWS SigV4 request authentication and IAM daemon (#957) (d2f2e00)
  • skills: xe-go-style skill added (c79a11b)
  • web: add alpine.js package (c0d23b4)
  • xess: adopt xe-design-system tokens and add button/card/tag components (1c62860)

BREAKING CHANGES

  • sigv4: iamsts.NewVerifier is replaced by iamsts.New(Config); iamsts.Identity now carries TokenIdentity fields (PrincipalID) instead of an iamv1.User.

Signed-off-by: Xe Iaso me@xeiaso.net

  • test(iamd): cover the signing-key local-verification chain end to end

Signed-off-by: Xe Iaso me@xeiaso.net

  • refactor(iam)!: delete the per-request STS verification flow

Removes STSService/GetCallerIdentity (proto, generated stubs, iamd handler, and sigv4.VerifySignature) now that downstream services verify locally with cached derived signing keys.

The deleted double-slash-path test guarded VerifySignature's synthetic request construction, which is removed with it; the local path reads r.URL from net/http's own parser.

  • sigv4: the STSService Twirp/gRPC/Connect APIs no longer exist; downstream verifiers must upgrade to iamsts.New + SigningKeyService.

Signed-off-by: Xe Iaso me@xeiaso.net

  • docs: remove stale references to the deleted central STS verify flow

Signed-off-by: Xe Iaso me@xeiaso.net

  • docs(sigv4): record the move to derived signing key caching

Signed-off-by: Xe Iaso me@xeiaso.net

  • fix(iamsts): detach signing-key fetch from the caller's request context

The singleflight leader in entry() ran the GetSigningKey RPC on the first caller's request context, so a client disconnecting mid-RPC for an uncached scope canceled the fetch and failed every request collapsed onto it with a 500 — an attacker could trigger this burst deliberately by opening a request and dropping the connection. The fetch now runs on a context detached from the caller via context.WithoutCancel (keeping trace/log values) with its own 10s timeout replacing the dropped deadline.

Signed-off-by: Xe Iaso me@xeiaso.net

  • fix(iamd): reject non-positive -signing-key-cache-ttl at startup

A zero or negative TTL makes every GetSigningKey response effectively use-once, silently degrading downstream verifiers from a cached warm-path lookup to an RPC on every request. Fail startup instead of letting this misconfiguration degrade quietly under load.

Signed-off-by: Xe Iaso me@xeiaso.net

  • docs(sigv4): record signing-key distribution trust model and current iamd role

Update the components table to reflect that iamd now serves the signing-key distribution server rather than a planned STS validation server, mark the superseded forwarded-material security-model section as historical, and record the trust trade-off the final review surfaced: any authenticated IAM principal can currently fetch any principal's derived signing key for the fleet scope, attributed by caller in logs/metrics, with a verifier allowlist noted as a follow-up if trust tiers diverge.

Signed-off-by: Xe Iaso me@xeiaso.net

  • build(iamd): add docker bake target and Dockerfile

Two-stage build matching the repo's existing service images (golang:1.25 build with cache mounts, debian:bookworm runtime). The SQLite database lives on a /data volume so state survives container replacement; built for amd64 and arm64 since the ncruces SQLite driver is CGO-free. Added to the default bake group.

Assisted-by: Fable 5 via Claude Code Signed-off-by: Xe Iaso me@xeiaso.net

  • docs(iamsts): add twirp integration guide

Shows how to wire the caching verifier into a Twirp API mux: signed transport for the key fetches, one shared verifier per process, per-route middleware wrapping, reading the caller identity, and the operational behaviors (error mapping, outage semantics, revocation latency, midnight rollover).

Assisted-by: Fable 5 via Claude Code Signed-off-by: Xe Iaso me@xeiaso.net

  • chore: commit stuff

Signed-off-by: Xe Iaso me@xeiaso.net

  • refactor(sigv4): extract shared signing internals into awssig

Signed-off-by: Xe Iaso me@xeiaso.net

  • feat(sigv4a): add ecdsa p-256 key derivation with aws test vectors

Signed-off-by: Xe Iaso me@xeiaso.net

  • feat(sigv4a): add x-amz-region-set matching

Signed-off-by: Xe Iaso me@xeiaso.net

  • fix(awssig): match aws canonicalization for quoted spaces and raw utf-8 paths

collapseSpaces preserved runs of spaces inside double-quoted header values, but neither aws-sdk-go-v2's v4 signer nor the aws-c-auth v4a test vectors special-case quotes; both collapse whitespace runs unconditionally.

CanonicalURI re-percent-encoded r.URL.EscapedPath(), which reproduces AWS's double-encoding correctly when the wire path is already percent-encoded ASCII, but fabricates a fresh single-encoded path for raw, unescaped UTF-8 wire bytes -- encoding that a second time double-encodes it. Canonicalize the literal wire path (r.RequestURI) instead, falling back to EscapedPath() for client-constructed requests that never went through the wire.

Caught by the sigv4a vector suite (get-header-value-trim, get-utf8); sigv4's SDK round-trip tests and iamd's integration tests pass unchanged, confirming classic SigV4 compatibility holds.

Signed-off-by: Xe Iaso me@xeiaso.net

  • feat(sigv4a): add request verifier middleware

Signed-off-by: Xe Iaso me@xeiaso.net

  • fix(sigv4a): treat nil public key from lookup as unknown key

A PublicKeyLookuper returning (nil, nil) left pub == nil, err == nil, reaching ecdsa.VerifyASN1(nil, ...), which panics because it dereferences pub.Curve unconditionally -- a DoS of this auth middleware once a real KeyLookup is wired in. Treat a nil key as ErrUnknownKey instead.

Adds coverage for the KeyLookup branch (previously untested) and for a malformed-hex Signature= value.

Signed-off-by: Xe Iaso me@xeiaso.net

  • feat(sigv4a): add request signer and sigv4aclient transport

Signed-off-by: Xe Iaso me@xeiaso.net

  • feat(iamd): serve sigv4a public verification keys via GetPublicKey

Signed-off-by: Xe Iaso me@xeiaso.net

  • chore: exempt sigv4a test vectors from prettier

npm run format was reformatting the aws-c-auth vector fixtures, which must stay byte-identical to upstream.

Signed-off-by: Xe Iaso me@xeiaso.net

  • feat(sigv4a): add iamsts public-key caching verifier

Signed-off-by: Xe Iaso me@xeiaso.net

  • test(sigv4a/iamsts): make TTL-sweep test table-driven

Restructure the fresh (non-ported) TTL-expiry sweep test into a table of ordered steps per the repo's go-table-driven-tests conventions, since it wasn't inherited from the classic package.

Signed-off-by: Xe Iaso me@xeiaso.net

  • feat(iamd)!: authenticate callers with sigv4a
  • sigv4: iamd's middleware now accepts only AWS4-ECDSA-P256-SHA256 signatures; clients must sign with sigv4aclient (or sigv4a.Signer) instead of sigv4client.

Signed-off-by: Xe Iaso me@xeiaso.net

  • docs(sigv4a): record public-key trust model and add iamsts guide

Signed-off-by: Xe Iaso me@xeiaso.net

  • fix(twirpslog): restore caller attribution for sigv4a-authenticated services

iamd's UserMiddleware now stores the verified caller via sigv4a.WithUser, a different context key than the classic sigv4.WithUser the interceptor checked. Twirp logs and the per-user billing counter silently lost attribution for every sigv4a-verified call. Check the sigv4a sources first, falling back to the classic sigv4/sigv4a.iamsts pair kept for the retained classic chain.

Signed-off-by: Xe Iaso me@xeiaso.net

  • docs(sigv4a): note twirpslog attribution works for sigv4a callers

Signed-off-by: Xe Iaso me@xeiaso.net

  • fix(sigv4aclient): set GetBody so redirects and retries can rewind the body

Signed-off-by: Xe Iaso me@xeiaso.net

  • fix(iamd): read the caller from the sigv4a context in KeyService

The SigV4A cutover left KeyService reading the caller from the classic sigv4 context key that UserMiddleware no longer populates, so every KeyService RPC failed closed with an unauthenticated caller.

Signed-off-by: Xe Iaso me@xeiaso.net

  • feat(iamd): accept both sigv4 and sigv4a signatures

Dispatch on the Authorization header's algorithm token so classic SigV4 and SigV4A callers both authenticate through the same DAO-backed credentials; classic traffic stays observable via iamd_auth_requests_total while it drains.

Signed-off-by: Xe Iaso me@xeiaso.net

  • refactor(middleware): unify caller identity context in authctx

Two real bugs (a KeyService handler failing closed on the wrong family's key, and a twirpslog attribution regression) came from sigv4 and sigv4a each keeping their own unexported context keys for the same caller identity; this introduces web/middleware/authctx as the single canonical storage that all four packages delegate to, with no exported API changes.

Signed-off-by: Xe Iaso me@xeiaso.net

  • feat(sigv4any): add dual-algorithm dispatch middleware

Lift the Authorization-header dispatch pattern (classic SigV4 vs SigV4A) into a reusable middleware so any service can accept either algorithm without hand-rolling the switch, while keeping metric wiring pluggable via an Observe hook instead of a hard prometheus dependency.

Signed-off-by: Xe Iaso me@xeiaso.net

  • refactor(iamd): use sigv4any for dual-algorithm auth

Replace iamd's hand-rolled Authorization-header dispatch with the new sigv4any.Verifier, keeping the iamd_auth_requests_total counter wired through Observe. cmd/iamd/integration_test.go is the equivalence proof and passes unchanged.

Signed-off-by: Xe Iaso me@xeiaso.net

  • fix(iam): wrap errors from DisableKey and ListKeys

The disable command returned the raw DisableKey error and had a duplicated dead err check left over from a copy-paste; the list command never checked the ListKeys error at all. Wrap both so failures surface a descriptive message.

Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso me@xeiaso.net

  • fix(iam): wrap error from ListUsers

The user list command ignored the ListUsers error and proceeded to render an empty result. Check and wrap it so failures surface a descriptive message, matching the keys command.

Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso me@xeiaso.net

  • chore(saga): add iamd and route53 dyndns manifests plus sigv4a plan

Deploy iamd to the saga cluster with sigv4a signing-key cache config, add a route53 dynamic DNS deployment, and check in the sigv4a migration plan doc.

Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso me@xeiaso.net

  • fix(saga): remove invalid value on AWS_SECRET_ACCESS_KEY env var

The env var set both valueFrom.secretKeyRef and a literal value, which Kubernetes rejects. Drop the leftover placeholder value so the manifest applies.

Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso me@xeiaso.net

  • chore: nuke sins

Signed-off-by: Xe Iaso me@xeiaso.net

1.30.0 (2026-02-16)

Bug Fixes

  • falin: resolve npm ci dependency conflict (#835) (683bff8)
  • mi: use blog post summary in Bluesky embed description (#848) (7491810)
  • nguh: return error for unsupported tokens (d1a50e7)
  • skills/xe-writing-style: update details about successive paragraph starting letter rule (5808b2b)
  • skills/xe-writing-style: wumbofy this with Opus (cea6609)
  • useragent: use filepath.Base for os.Args[0] in GenUserAgent (#830) (3ef21d9)
  • web: replace deprecated io/ioutil with io (#829) (fee5e4f)

Features

  • cmd/x: add ai-add-provider and ai-list-models subcommands (#850) (bba7f41)
  • python: accept io/fs.FS as root filesystem parameter (#813) (87b97e8)
  • reviewbot: add Python interpreter with repo filesystem (#814) (b40ff1c)
  • sakurajima: add HTTP request timeouts to prevent hanging connections (#837) (d50a792)
  • sakurajima: add request size limits to prevent DoS attacks (#838) (f207855)
  • sakurajima: add request size limits to prevent DoS attacks (#839) (80dd84a)
  • sakurajima: production readiness fixes and enhancements (#834) (4368e6f)
  • sapientwindex: add state to prevent double-posts (#825) (6ba9223)
  • skills: add experimental Xe writing style skill (baed3bd)
  • skills: add Go table-driven tests skill (#817) (a2e35ea)
  • store: add filesystem backends (DirectFile, JSONMutexDB, CAS) (#824) (4f694cf)
  • totpgen: add TOTP code generator command (#833) (d0a556d)

BREAKING CHANGES

  • python: llm/codeinterpreter/python.Run() now takes fs.FS as first parameter

Assisted-by: GLM 4.6 via Claude Code Reviewbot-request: yes

Signed-off-by: Xe Iaso me@xeiaso.net

1.29.0 (2026-01-13)

Features

1.28.0 (2026-01-10)

Bug Fixes

  • reviewbot: add desired output format to the system prompt (7cb3f98)

Features

  • add reviewbot prototype (1ea29dd)
  • reviewbot: add auto-trigger via commit footer (91726b2)
  • reviewbot: if no tool call, default to leaving a PR comment (#809) (c530dd7)
  • skills: add templ-htmx skill using local htmx package (ad16a19)

1.27.0 (2026-01-08)

Bug Fixes

  • package.json: use Signed-off-by instead of Signed-Off-By (c2406e3)
  • yeetfile: build sysexts (c9b3ab7)

Features

  • add 7-day cooldown to dependabot updates (#791) (1a5d9d3)
  • add attention attenuator package (6ca9c01)
  • add claude-code-cfg package (73798a3)
  • kube/alrest: add mcp-auth sidecar (e56238b)
  • mi: add birthday field to Member model (#784) (69bff8e)
  • require Signed-off-by in commit messages (#785) (7e1c910)

1.26.1 (2025-11-11)

Bug Fixes

  • mcp: fix list-system-members output schema (2a24290)

1.26.0 (2025-11-09)

Features

1.25.0 (2025-10-30)

Bug Fixes

Features

  • add httpdebug Docker target and Dockerfile (b428337)
  • add shiroko k8s (0172f70)
  • add W'zamqo as valid member name and update suggestions (d0fff60)
  • cmd/httpdebug: enhance security and functionality (0c0f8ea)
  • cmd/mi: add MCP server for completely bad ideas (673dbbd)
  • cmd/sakurajima (86de439)
  • cmd/sakurajima: add autocert config settings (0017dc0)
  • cmd/x: fix switch command (616d8b4)
  • cmd/x: port list-switches command over (edd2e48)
  • cmd: add x-browser-validation test program (8c0154e)
  • sakurajima: add the rigging for log filtering logic (0274cf3)
  • sakurajima: implement access logs / logrotate logic (8b68476)
  • sakurajima: log filters (b4a5f77)
  • stickers: use branded presigned URLs (5223d77)

1.24.0 (2025-07-15)

Features

  • cmd/httpdebug: add HTTP method and URI to output (158fb5b)
  • cmd/relayd: ja4t / ja4h fingerprinting (e810bdb)
  • fish-config: build a deb too I guess (063d5c0)
  • fish-config: dotenv.fish (7c8b929)
  • pb/relayd: add fingerprints object (2fc470c)

1.23.0 (2025-06-28)

Bug Fixes

  • fish-config: make fish prompt compatible with vs code (484b614)
  • fish-prompt: clean up theme (d00dabd)
  • mi: enable reflection (b264671)

Features

  • pkgs/fish-config: add autols, autopair, fisher, and nvm (2a8ccb5)

1.22.0 (2025-06-11)

Bug Fixes

  • cmd/relayd: set the right Host header (6db9999)
  • mi: make old routes work to avoid breaking tools (b51ae17)
  • yeetfile: only build uploud where purego is supported (8c12cfa)

Features

  • ingressd: grpc health checking (0870e5d)

1.21.0 (2025-05-31)

Bug Fixes

  • pvfm/bot: cache seen messages for up to 10 minutes (76268a9)
  • recording: don't delete temporary files (472754d)

Features

  • aura: build with docker buildx bake (126a3cf)
  • x: grpchc can do TLS now (cc4be82)

1.20.0 (2025-05-30)

Features

  • yeetfile: build riscv64 binaries (aa0c069)

1.19.0 (2025-05-29)

Bug Fixes

  • cmd/relayd: use X-Http-Protocol for HTTP protocol version (e73bf5f)
  • yeetfile: new docker image (5172ad9)

Features

  • cmd/license: move licenses to go templates (c01ca48)
  • fish-config: kubernetes info in prompt (66924c2)
  • pkgs: add fish config as a package (93fd623)
  • x: grpc health checking (a78e6cf)
  • yeetfile: ppc64le binaries (2fbd92f)

1.18.0 (2025-05-05)

Bug Fixes

  • gitea: fix deployment (b418d50)
  • relayd: increase correlation potential (e047ce3)
  • relayd: make max bundle size 512 (915e301)
  • relayd: move request ID creation to a variable (d030f4f)

Features

  • relayd: change log persistence method (b3bb404)
  • web: add iptoasn client (c53fd2a)

1.17.0 (2025-04-27)

Features

  • httpdebug: quiet mode and function as a systemd service (1d9fa34)
  • relayd: autocert support for automatic TLS cert minting (c9136cc)
  • xess: add fancy 404 page (10e176a)

1.16.0 (2025-04-27)

Bug Fixes

  • gitea: use >- instead of > (972cc99)

Features

  • relayd: store and query TLS fingerprints (ef94cbc)

1.15.0 (2025-04-27)

Features

  • ci: allow automatically cutting a new release via messages (b12801a)

1.14.1 (2025-04-27)

1.14.0 (2025-04-27)

Bug Fixes

  • relayd: disable TCP fingerprinting on Linux for now (6aa26b7)
  • relayd: rename HTTP headers for fingerprints (b64f843)

Features

  • anubis: replace with tombstone (929e2de)
  • cmd/aws-secgen for generating fake AWS secrets (7b8662a)
  • relayd: add standard reverse proxy headers (33ebd25)
  • relayd: ja4t fingerprinting (8ecbe6f)