FaynoSync releases

Improvements

• Decoupled MongoDB migrations from API startup: the server now starts with ./faynoSync only, and migrations run explicitly via ./faynoSync migrate up or ./faynoSync migrate down.

Features

• Added GET /tuf/v1/metadata/targets and GET /tuf/v1/metadata/delegated endpoints to retrieve TUF metadata for targets and delegated roles.
• Added tuf typescript example.

Fixes

• Fixed telemetry period aggregation for range=week and range=month to deduplicate repeated client_id values across days instead of summing daily set sizes.
• Updated telemetry integration coverage to validate that unique_clients, clients_using_latest_version, and clients_outdated remain deduplicated at period level.

Features

• Added POST /tuf/v1/bootstrap/recovery to rebuild bootstrap Redis settings from persisted TUF metadata for already initialized repositories.
• Added asynchronous bootstrap_recovery task flow with lock protection, recovery prechecks, timeout support, and task status reporting.

Security & Access Control

• Added RBAC edit permission checks for TUF task status, artifact publish, and artifact delete endpoints.
• Added owner resolution middleware for team users so TUF artifact operations run under resolved owner context.

Reliability

• Unified bootstrap settings persistence and recovery via a shared Redis save path, including delegated role expirations and ROOT_SIGNING initialization.

API Tooling

• Updated Postman collection with bootstrap recovery API request examples.

Dependencies

• Upgraded go.opentelemetry.io/otel, go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/sdk, go.opentelemetry.io/otel/sdk/metric, and go.opentelemetry.io/otel/trace to v1.43.0.

Security & Signing Improvements

• Extended TUF online signing to support multiple key types (Ed25519, ECDSA, and RSA-PSS) loaded from filesystem private keys.
• Added signer/verifier construction by key type with explicit keyid-to-key-material validation to prevent mismatched key usage.

Maintenance

• Removed legacy bootstrap generation API surface (/tuf/v1/bootstrap/generate and /tuf/v1/bootstrap/locks) and deleted obsolete generate handlers/tests.

Dependencies

• Upgraded github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.3.
• Upgraded github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream to v1.7.8.

Dependencies

• Upgraded github.com/go-jose/go-jose/v4 to v4.1.4.

Dependencies

• Upgraded Go to v1.26.1.
• Upgraded google.golang.org/grpc to v1.79.3.

Maintenance

• Migrated from MinIO to Garage for default local S3 storage.

Features

• Slack notifications now reuse a single mutable message per app version across artifact create, update, and delete flows, with Redis-backed state, configurable TTL, and cleanup when a version is deleted.

Dependencies

• Upgraded go.opentelemetry.io/otel/sdk to v1.40.0.

Improvements

• Token create endpoint: changed response status code for token creation.

Features

• API Tokens: Added API tokens for secure and scoped access to the API.

Testing

• API Tokens integration tests: Added integration tests for creating, listing, and deleting API tokens.

• New Features

  • Added multi-signer support for secure cryptographic operations across roles
  • Introduced per-role key threshold configuration for enhanced key management
  • Enhanced bootstrap process with conflict detection and persistent metadata validation

• Improvements

  • More detailed error messages including per-key failure information
  • Better root metadata versioning with intelligent fallback logic
  • Added context-aware cancellation support and improved compatibility with large datasets

Bug Fixes

• Fixed incorrect key usage in metadata signing: Each TUF role (snapshot, targets, delegated roles) now uses its own dedicated key for signing instead of incorrectly using the timestamp key. This ensures proper TUF specification compliance.

Features

• Online metadata update endpoint: Added POST /tuf/v1/metadata/online endpoint for force updating online metadata roles (snapshot, timestamp, targets, delegated roles) without requiring offline signing workflow.

• Metadata sign deletion endpoint: Added POST /tuf/v1/metadata/sign/delete endpoint for deleting pending metadata signatures from Redis.

Improvements

• Delegated roles expiration: Each delegated role now uses its own expiration configuration from Redis instead of a shared BINS_EXPIRATION setting.

Testing

• TUF unit test coverage: Added unit tests for TUF metadata, metadata root, config, storage, signing, tasks, settings, delegations, artifacts, generate, bootstrap, delete, converter and utils. Storage mock is now global for tests.

Security Fixes

• Fix: go-tuf affected by client DoS via malformed server response
• Fix: go-tuf improperly validates the configured threshold for delegations
• Fix: sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal
• Fix: go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names
• Upgraded github.com/theupdateframework/go-tuf/v2 to version v2.4.1