Skip to content

StartOS

vstart-registry/v1.0.0 Breaking

This release includes 2 breaking changes for platform teams planning a safe upgrade.

Published 4d Dashboards & Home Pages
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

bitcoin bitcoin-node lightning-node p2p personal-server privacy-enhancing-technologies
+1 more
self-hosted

Affected surfaces

auth

Summary

AI summary

Signer/admin authentication now uses the request‑signature scheme and requires start-cli ≥ 1.1.0.

Full changelog

What's Changed

  • Signer/admin authentication moved to the new request-signature scheme. Every authenticated
    request is signed with the client's identity key and carried in the X-Start-Auth-Sig header,
    bound to the registry hostname; on the registry host itself, the local authcookie is presented
    as an Authorization: Bearer token instead of a Cookie. Requires start-cli ≥ 1.1.0.

  • --version reports start-registry's own version (1.0.0), not the StartOS platform
    version.

  • Independent versioning. start-registry now carries its own version (starting at 1.0.0) in its Cargo.toml, decoupled from the StartOS release line; its .deb is versioned from the manifest.

start-registry packages Checksums

SHA-256

064e33198c73b3c1c5288e6e49a3301ced3e6cd6d363b2a91b23514e1cc76290  start-registry-1.0.0-e7ed569_aarch64.deb
0518bb42606162184f2887dd9b2ebf82f871bfed4ac09a5d2f4df5c1a9ad330f  start-registry-1.0.0-e7ed569_riscv64.deb
148a28a804a9ea31a4331ddc83805c120e23dcdff457addadb06a6f867d98167  start-registry-1.0.0-e7ed569_x86_64.deb

BLAKE-3

8e27bd798ecc51d54093ce4a1bf4d1fac6ccb429266a24c96de7e08a4213608f  start-registry-1.0.0-e7ed569_aarch64.deb
311c4dbe6ef631cb25a35a8501d33af7e1302c38e1c0aec8a3b5b51834a64aea  start-registry-1.0.0-e7ed569_riscv64.deb
951aa8ecaa7a9fdc0d308f84fb6f46dd34a3b8fb9c21a86e8477a3fa8ad98639  start-registry-1.0.0-e7ed569_x86_64.deb

Breaking Changes

  • Signer and admin authentication moved to the request‑signature scheme; all authenticated requests must include `X-Start-Auth-Sig` header with client identity key, bound to registry hostname. Local authcookie is now presented as `Authorization: Bearer` token instead of a `Cookie`. Requires `start-cli` ≥ 1.1.0.
  • Minimum version bump for `start-cli`: 1.1.0
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track StartOS

Get notified when new releases ship.

Sign up free

About StartOS

Browser-based, graphical Operating System (OS) that makes running a personal server as easy as running a personal computer.

All releases →

Related context

Earlier breaking changes

  • vstart-sdk/v2.0.4 'setupMain' callback now accepts any DaemonBuildable rather than requiring a Daemons.
  • vstart-sdk/v2.0.4 `Daemons.dynamic` now takes `effects` and returns a `DaemonReconciler` instead of replacing `main`.
  • v0.4.0-beta.9 Previous backups incompatible with v0.4.0; create fresh backup after updating.

Beta — feedback welcome: [email protected]