Skip to content

StartOS

vstart-cli/v1.1.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 4d Dashboards & Home Pages
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

bitcoin bitcoin-node lightning-node p2p personal-server privacy-enhancing-technologies
+1 more
self-hosted

Affected surfaces

auth

Summary

AI summary

Authentication switched from session cookies to per‑device signing keys, requiring StartOS ≥ 0.4.0-beta.10 and removing cookie handling.

Full changelog

What's Changed

Changed

  • Authentication moved from session cookies to per-device signing keys. auth login now
    enrolls the CLI's identity key with the server instead of opening a cookie session, and every
    request is signed with that key (X-Start-Auth-Sig; unpadded base64url DER key and signature).
    The signature is bound to the host identity from the configured URL — on Linux, where a .local
    host is pinned to its resolved address to work around musl's lack of mDNS, the signature still
    commits to the .local name, not the pinned IP. Requires a server with key-based auth
    (StartOS ≥ 0.4.0-beta.10, StartTunnel ≥ 1.2.0). Cookies are gone from the client entirely:
    when run on the server itself, the CLI presents the server's local authcookie as an
    Authorization: Bearer header (only ever to a loopback address) instead of a Cookie, and
    the --cookie-path flag and .cookies.json cache are removed.
  • Key files renamed: developer.key.pem → id.key.pem and .startos/build-key →
    .startos/build.key.pem.     The first is the CLI's identity for login and registry auth, not a
    developer-only feature, and the build key gains a conventional extension. Existing files are
    renamed automatically the first time the CLI loads them; --developer-key-path and the
    developer-key-path config field remain accepted as aliases of --id-key-path /
    id-key-path.

start-cli Checksums

SHA-256

5feebd3f9b24a130e54496040b09e78b93307a5eee0052d56cab29a12ec4c571  start-cli_aarch64-linux
668acc728e173b6d36bddc26936d546d049a0fc26c5dc2cd6c5ef98f71a33ec1  start-cli_aarch64-macos
6c45ef2370bf62ce5bf49d9dce8aed2ae41c2791a0038fc5129737b2d72ff3cc  start-cli_riscv64-linux
70eff67b6e9a936acd8aaaf787b783819252ecedaa5c74d462e3b15ed4dd843a  start-cli_x86_64-linux
ca976b3254efc7583afc86a8f8ecf13b9fedaa7007ec801e0141e8e2208b2b39  start-cli_x86_64-macos

BLAKE-3

4eaf490cf26cd4665b4f04f80188458986635bc1e9e0a6d865895db2a1edee44  start-cli_aarch64-linux
438b6a14a4fab00c6a1b8e3c3719d91edc367d8c58b7bce74999c28994e8f941  start-cli_aarch64-macos
a0fa88404f817c5b3dd49dea49df973adbf7c10f1b13eef5f42eb9e5d62ccede  start-cli_riscv64-linux
9dcb6ec52db71fdc2ac6769656344b679231d1af781130ec0dcea7cbb06b003f  start-cli_x86_64-linux
bf64bf5f0e1e4a3b3953df866af5004a58794f6116ab5d310f679d9624360bd8  start-cli_x86_64-macos

start-cli packages Checksums

SHA-256

4d485487ce320b0321af82fd75519d231ad20ef63500540a3a5df5408db4fbbe  start-cli-1.1.0-e7ed569_aarch64.deb
91e7f9bb6a4783809ffb2bcca217cca1fb14dd16554a881d7466bf9ab8e87623  start-cli-1.1.0-e7ed569_riscv64.deb
174e625ffcd71f8adbaa15ef3bc84e3f213702fb4f807d642d8654cdd553d13e  start-cli-1.1.0-e7ed569_x86_64.deb

BLAKE-3

b9dc4542ca89adc4d765e57fcd47f4a68d374c93cfe18a59bef11c3eb66fc618  start-cli-1.1.0-e7ed569_aarch64.deb
9ecd8df5296671034a887dd40ce484764ad1e5b183e32f350ad0c985a4f90cc1  start-cli-1.1.0-e7ed569_riscv64.deb
d9fbb4bc8baac3872900a550812cb04515ceda1415476fb5514a5c8cb9871ea1  start-cli-1.1.0-e7ed569_x86_64.deb

Breaking Changes

  • Removed session‑cookie handling; `auth login` now enrolls a per‑device signing key and sends requests signed with X-Start-Auth-Sig. Requires StartOS ≥ 0.4.0-beta.10 and removes the --cookie-path flag and .cookies.json cache.
  • Renamed key files: developer.key.pem → id.key.pem and .startos/build-key → .startos/build.key.pem; aliases --developer-key-path / developer-key-path remain for backward compatibility.

Security Fixes

  • Authentication moved to per‑device signing keys, eliminating session‑cookie based attacks.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track StartOS

Get notified when new releases ship.

Sign up free

About StartOS

Browser-based, graphical Operating System (OS) that makes running a personal server as easy as running a personal computer.

All releases →

Related context

Earlier breaking changes

  • vstart-sdk/v2.0.4 'setupMain' callback now accepts any DaemonBuildable rather than requiring a Daemons.
  • vstart-sdk/v2.0.4 `Daemons.dynamic` now takes `effects` and returns a `DaemonReconciler` instead of replacing `main`.
  • v0.4.0-beta.9 Previous backups incompatible with v0.4.0; create fresh backup after updating.

Beta — feedback welcome: [email protected]