Skip to content

FaynoSync

v1.5.16 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 1mo Deployment Automation
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 4 known CVEs

Topics

api auto-update cross-platform desktop-app electron electron-updater
+8 more
go mongodb s3 self-hosted software-updates tauri tuf update-server

Affected surfaces

auth rbac deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

ReleasePort Layer 1 v1.5.16 fixes critical TUF security flaws including unverified metadata, snapshot race conditions, and root‑rotation errors.

Why it matters: Addresses three high‑severity (≥80) TUF vulnerabilities that could permit unauthorized updates or bypass verification; operators should upgrade immediately to mitigate risk.

Summary

AI summary

Fixed multiple TUF security flaws that allowed unverified metadata, race conditions in snapshot updates, and root rotation errors.

Changes in this release

Security Critical

Fixes snapshot lock key inconsistency that allowed concurrent publish and update to silently discard each other's changes.

Fixes snapshot lock key inconsistency that allowed concurrent publish and update to silently discard each other's changes.

Source: llm_adapter@2026-06-04

Confidence: high

 —
Security High

Fixes trusted metadata loaded from S3 without expiration check; expired metadata is now rejected before use.

Fixes trusted metadata loaded from S3 without expiration check; expired metadata is now rejected before use.

Source: llm_adapter@2026-06-04

Confidence: high

 —
Security High

Fixes silent verification skip in `PostMetadataSign` targets path; S3/unmarshal failures now surface as errors.

Fixes silent verification skip in `PostMetadataSign` targets path; S3/unmarshal failures now surface as errors.

Source: llm_adapter@2026-06-04

Confidence: low

 —
Security High

Makes S3/unmarshal failures in `PostMetadataSign` surface as errors instead of being silently skipped.

Makes S3/unmarshal failures in `PostMetadataSign` surface as errors instead of being silently skipped.

Source: granite4.1:30b@2026-06-04-audit

Confidence: low

 —
Security High

Improves root rotation staging to correctly distinguish version vs signature errors.

Improves root rotation staging to correctly distinguish version vs signature errors.

Source: granite4.1:30b@2026-06-04-audit

Confidence: low

 —
Security High

Propagates Redis write errors in `PostMetadataSign` staging paths instead of ignoring them.

Propagates Redis write errors in `PostMetadataSign` staging paths instead of ignoring them.

Source: granite4.1:30b@2026-06-04-audit

Confidence: low

 —
Security High

Loads trusted root metadata via the library's verified `FromFile` path rather than raw unmarshal.

Loads trusted root metadata via the library's verified `FromFile` path rather than raw unmarshal.

Source: granite4.1:30b@2026-06-04-audit

Confidence: low

 —
Feature Medium

Validates `appName` to reject characters that could cause Redis key collisions or S3 path injection.

Validates `appName` to reject characters that could cause Redis key collisions or S3 path injection.

Source: granite4.1:30b@2026-06-04-audit

Confidence: low

 —
Performance Low

Replaces blocking `KEYS` with incremental `SCAN` in `GetMetadataSign` to avoid Redis lockups on large keyspaces.

Replaces blocking `KEYS` with incremental `SCAN` in `GetMetadataSign` to avoid Redis lockups on large keyspaces.

Source: granite4.1:30b@2026-06-04-audit

Confidence: low

 —
Deprecation Low

Removes dead code: `GetBootstrapLocks`, `bootstrap()`, and `bootstrapFinalize()`.

Removes dead code: `GetBootstrapLocks`, `bootstrap()`, and `bootstrapFinalize()`.

Source: granite4.1:30b@2026-06-04-audit

Confidence: low

 —
Bugfix Medium

Fixes snapshot `MetaFile` entries omitting hashes; snapshot now includes `sha256` hash and length for all referenced metadata files.

Fixes snapshot `MetaFile` entries omitting hashes; snapshot now includes `sha256` hash and length for all referenced metadata files.

Source: llm_adapter@2026-06-04

Confidence: high

 —
Bugfix Medium

Fixes missing root signature verification in the `thresholdReached` targets signing path.

Fixes missing root signature verification in the `thresholdReached` targets signing path.

Source: llm_adapter@2026-06-04

Confidence: high

 —
Bugfix Medium

Fixes `RemoveArtifacts` loading root by hardcoded version 1 instead of the latest version.

Fixes `RemoveArtifacts` loading root by hardcoded version 1 instead of the latest version.

Source: llm_adapter@2026-06-04

Confidence: high

 —
Bugfix Medium

Fixes MongoDB artifact status updated before TUF operation succeeds; status now written only after a successful commit.

Fixes MongoDB artifact status updated before TUF operation succeeds; status now written only after a successful commit.

Source: llm_adapter@2026-06-04

Confidence: high

 —
Bugfix Medium

Fixes `GetConfig` returning only the first custom role expiration due to a loop variable bug.

Fixes `GetConfig` returning only the first custom role expiration due to a loop variable bug.

Source: llm_adapter@2026-06-04

Confidence: low

 —
Bugfix Medium

Fixes temporary directories created in `cwd` instead of system temp.

Fixes temporary directories created in `cwd` instead of system temp.

Source: llm_adapter@2026-06-04

Confidence: low

 —
Bugfix Medium

Fixes task records stored in Redis with no TTL; now expires appropriately.

Fixes task records stored in Redis with no TTL; now expires appropriately.

Source: llm_adapter@2026-06-04

Confidence: low

 —
Bugfix Medium

Fixes `GetConfig` loop and `PutConfig` to respect online/offline mode for targets expiration handling.

Fixes `GetConfig` loop and `PutConfig` to respect online/offline mode for targets expiration handling.

Source: granite4.1:30b@2026-06-04-audit

Confidence: low

 —
Bugfix Low

Creates temporary directories in system temp rather than the current working directory.

Creates temporary directories in system temp rather than the current working directory.

Source: granite4.1:30b@2026-06-04-audit

Confidence: low

 —
Bugfix Low

Assigns TTL to task records stored in Redis, preventing indefinite retention.

Assigns TTL to task records stored in Redis, preventing indefinite retention.

Source: granite4.1:30b@2026-06-04-audit

Confidence: low

 —
Refactor Low

Removes unused `ctx context.Context` parameter from delegation helper functions.

Removes unused `ctx context.Context` parameter from delegation helper functions.

Source: granite4.1:30b@2026-06-04-audit

Confidence: low

 —
Full changelog

Security (TUF)

  • Fixed snapshot lock key inconsistency that allowed concurrent artifact publish and force-online update to race and silently discard each other's snapshot changes.
  • Fixed silent verification skip in PostMetadataSign targets path: S3/unmarshal failures now surface as errors instead of being swallowed, preventing unverified metadata from advancing.
  • Fixed trusted metadata loaded from S3 without expiration check; expired metadata is now rejected before use.
  • Fixed root rotation staging that used fragile error string matching to detect wrong-version vs bad-signature failures.
  • Fixed PostMetadataSign Redis writes silently ignored on staging paths; errors are now propagated.
  • Fixed loadTrustedRootMetadataFromS3 using raw json.Unmarshal instead of the library's FromFile; root is now loaded through the verified library path.

Fixes (TUF)

  • Fixed snapshot MetaFile entries omitting hashes; snapshot now includes sha256 hash and length for all referenced metadata files.
  • Fixed missing root signature verification in the thresholdReached targets signing path.
  • Fixed GetConfig returning only the first custom role expiration due to a loop variable bug.
  • Fixed RemoveArtifacts loading root by hardcoded version 1 instead of the latest version.
  • Fixed duplicate signing logic in removeArtifactsFromDelegatedRole.
  • Fixed MongoDB artifact status updated before TUF operation succeeds; status is now written only after a successful TUF commit.
  • Fixed temporary directories created in cwd instead of system temp.
  • Fixed HelperGetPathForTarget panicking on os.Getwd() failure; returns error instead.
  • Fixed task records stored in Redis with no TTL.
  • Fixed CalculateExpirationDays silently returning 365 on parse failure; returns error instead.
  • Removed unused ctx context.Context parameter from delegation helpers.

Improvements (TUF)

  • Added appName validation to reject characters that could cause Redis key collisions or S3 path injection.
  • Replaced KEYS with SCAN in GetMetadataSign to avoid blocking Redis on large keyspaces.
  • Fixed GetConfig loop and PutConfig to respect online/offline mode for targets expiration.
  • Removed dead code: GetBootstrapLocks, bootstrap(), bootstrapFinalize().

Security Fixes

  • Fixed snapshot lock key inconsistency that allowed concurrent artifact publish and force-online update to race and silently discard each other's changes
  • Fixed silent verification skip in PostMetadataSign targets path – S3/unmarshal failures now surface as errors
  • Fixed trusted metadata loaded from S3 without expiration check – expired metadata is now rejected before use
  • Fixed root rotation staging that used fragile error string matching to detect wrong-version vs bad-signature failures
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track FaynoSync

Get notified when new releases ship.

Sign up free

About FaynoSync

Self-hosted Dynamic Update Server with statistics, supporting multiple updaters. Flexible features for seamless app updates and insights.

All releases →

Related context

Beta — feedback welcome: [email protected]