Archipelago — open-source initial import

2026-08-12 10:55:49 +00:00
commit 851a1bc137
2139 changed files with 467510 additions and 0 deletions
@@ -0,0 +1,34 @@
+{
+  "changelog": [
+    "**The most important fix in this release: the update button could take you backwards onto a version withdrawn for a security hole.** BTCPay Server published 2.4.2 to close a flaw that was being actively exploited — a way past two-factor authentication. Nodes that had already moved to 2.4.2 were then shown an \"Update\" button offering 2.3.9, the very release being withdrawn, and taking it would have rolled the node back onto the vulnerable version. The cause was that the node only asked whether the two version numbers differed, never which was newer, so any stale record anywhere could present a rollback as an upgrade. It now refuses to offer a lower version as an update, so a stale record fails safe instead of becoming a trap. BTCPay itself is on 2.4.2, and every place that still named the old version — including the fallback installer, which would have installed it outright — has been corrected.",
+    "**An app now reports its own version, not a helper's.** Where an app is made of several parts, the node could read the version of the wrong part: BTCPay showed as \"15.17\", which is the version of its database, while offering an update to 2.4.2. That is the number update decisions are made from, so a nonsensical pair was being presented as a legitimate upgrade. When the node cannot identify an app's own container it now says so rather than guessing at a neighbour.",
+    "**Your node issues its own certificate, so apps stop being flagged as insecure.** Each node now has its own certificate authority, with a one-step install from Settings, and app screens are served over the same secure connection as the dashboard rather than dropping back to an unprotected one. Apps answer on both the secure and plain address on the same port, so nothing that worked before stops working.",
+    "**An app that is still starting says \"starting\".** It previously reported \"App not reachable\", which reads as a failure when the app is simply warming up.",
+    "**Updates and app downloads now come from a proper domain name.** They previously used a bare numeric address over an unprotected connection. Downloads are now encrypted in transit, and the old address is kept as an automatic fallback for nodes whose clock or name lookup is off — the signature, not the address, is what makes either source safe.",
+    "Also in this release: the tool app developers run to check their app description no longer rejects every valid file (it needed a program most machines do not have, and reported the missing program as a broken file); and the node's own security audit, which had been reporting all-clear, now actually inspects the files where credentials had been sitting.",
+    "Housekeeping, disclosed rather than buried: this release removes Archipelago's own infrastructure details from the published source — machine names, addresses and internal working notes — ahead of the code being opened to the public. No behaviour changes for your node.",
+    "Known gaps, unchanged from the last release: three voice-assistant ports remain open without authentication. Non-browser clients — phone apps for Vaultwarden, Home Assistant or Jellyfin, and git over the web — meet the login page and need an access token. The 5x real-node lifecycle gate was not run for this release."
+  ],
+  "components": [
+    {
+      "current_version": "1.7.126-alpha",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.7.126-alpha/archipelago",
+      "name": "archipelago",
+      "new_version": "1.7.126-alpha",
+      "sha256": "5c5dd08cfe0db87d33626621ac3b1c4fbc7f8f152db4a61f7abcf798d0ddaa9f",
+      "size_bytes": 55424208
+    },
+    {
+      "current_version": "1.7.126-alpha",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.7.126-alpha/archipelago-frontend-1.7.126-alpha.tar.gz",
+      "name": "archipelago-frontend-1.7.126-alpha.tar.gz",
+      "new_version": "1.7.126-alpha",
+      "sha256": "ccc017dd9557db546a272255492e95f2162f4a002c8ae6cf744986046cb0bc6b",
+      "size_bytes": 210566347
+    }
+  ],
+  "release_date": "2026-08-07",
+  "signature": "21a8256c4366c2423b1ce9f0874bbdff0f0938bc68f0eb571b8729113703fbd5129228712aadd0dbd0f80a133315d1d58b0140b31d0b3bd99aa355bf75d35d0f",
+  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
+  "version": "1.7.126-alpha"
+}
@@ -0,0 +1,33 @@
+{
+  "_comment": [
+    "Registry hosts that binaries ALREADY DEPLOYED to nodes are known to trust.",
+    "",
+    "This is the floor the signed app catalog must stay within. It is NOT the",
+    "same as TRUSTED_REGISTRIES in the working tree: that list describes what a",
+    "binary being built today accepts, while nodes in the field run whatever was",
+    "shipped to them. Publishing a catalog that names a host the fleet's binaries",
+    "do not trust makes every install fail with 'not from a trusted registry'.",
+    "",
+    "To migrate to a new registry host, in this order:",
+    "  1. Add the host to TRUSTED_REGISTRIES and ship a binary OTA.",
+    "  2. Confirm the fleet is running that binary or newer.",
+    "  3. Add the host here, in the same commit as the confirmation.",
+    "  4. Only then regenerate and re-sign the catalog against the new host.",
+    "",
+    "Removing a host is the mirror image: take it out of the catalog first, let",
+    "that catalog reach every node, and only then drop it from here."
+  ],
+  "hosts": [
+    "docker.io",
+    "ghcr.io",
+    "localhost",
+    "146.59.87.168:3000"
+  ],
+  "pending": {
+    "source.archipelago-foundation.org": {
+      "trusted_from_binary": "unreleased",
+      "note": "Added to TRUSTED_REGISTRIES 2026-08-07. Not yet shipped in any OTA, so no deployed node accepts it. Promote to `hosts` only after the fleet is confirmed on a binary that includes it."
+    }
+  },
+  "updated": "2026-08-07"
+}