chore: release v1.0.6

CHANGELOG.md

@@ -7,6 +7,51 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [1.0.6] - 2026-08-07
+
+### Added
+- Iso: fix replaceStrings length mismatch in cleanVersion
+- Promote virtual machine trial option in README
+- Improve installer VM compatibility
+- Trim redundant dev-vs-stable Gitea explanations in README
+- Add Arean.Ai to AI tools used for development
+- Prefix OS version badge with 'v' (v1.0.5)
+- Match OS version badge styling to service modal version badges
+- Place OS version badge inline right after the Hub title
+- Center OS version badge under the Hub title
+- Strengthen entropy section: add DYOR emphasis and hardware wallet verification note
+- Add 'About Bitcoin wallet entropy' section to README
+- README: balance intro between Bitcoin sovereignty and sovereign computing
+
+### Changed
+- Removed temp patch file
+
+### Fixed
+- Resolve tag range detection and improve release diagnostics
+- Add token scope diagnostics and un-silence gh release errors
+- Harden error handling and sanitize exception details across security endpoints (CWE-209)
+- Sanitize exception handling in verify-integrity and security-reset (CWE-209)
+- Sanitize api_security_reset errors to prevent exception information exposure (CWE-209)
+- Use canonical prefix containment check for CodeQL path-injection
+- Pass sanitized abs_path to os.chown to resolve CodeQL path injection at 4338
+- Add CodeQL-recognized path sanitization for domain_name
+- Remove domain substring check for CodeQL incomplete-url
+- Use sentinel for njalla header check (CodeQL incomplete-url-substring)
+- Prevent reflected XSS in lnurl-qr print endpoint
+- Hash root password instead of storing in clear text (CWE-312)
+- Separate web auth hash from system password file
+- Fix Matrix Hub admin API credentials
+- Fix CWE-78: replace subprocess call with Synapse Admin API in create-user endpoint
+
+### Documentation
+- Add SECURITY.md detailing security policy and best practices
+- Versioned CDN downloads + add CDN upload script
+- Correct active development workflow
+- Make repo references mirror-neutral for Gitea readers
+- Clarify GitHub is the dev mirror of the Gitea stable repo
+[1.0.6]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.0.6
+
+
 ## [1.0.6] - 2026-08-07
 
 ### Added

README.md

@@ -21,9 +21,9 @@ Lightning infrastructure, private cloud, and communications platform when you
 are ready.
 
 [Visit the Website](https://sovransystems.com) ·
-[Download the ISO](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.5.iso) ·
+[Download the ISO](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.6.iso) ·
 [Try it safely in a VM](#try-it-first-in-a-virtual-machine) ·
-[Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.5.iso.sha256) ·
+[Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.6.iso.sha256) ·
 [Build from Source](#build-from-source)
 
 <img src="assets/desktop-screenshot.png" alt="Sovran_SystemsOS private Bitcoin desktop" width="800" />
@@ -342,8 +342,8 @@ with an imaging application such as [Balena Etcher](https://etcher.balena.io).
 
 ### 1. Download the ISO and checksum
 
-- [Download Sovran_SystemsOS-1.0.5.iso](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.5.iso)
-- [Download Sovran_SystemsOS-1.0.5.iso.sha256](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.5.iso.sha256)
+- [Download Sovran_SystemsOS-1.0.6.iso](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.6.iso)
+- [Download Sovran_SystemsOS-1.0.6.iso.sha256](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.6.iso.sha256)
 
 The download may take some time. Do not rename or modify the ISO before
 verifying it, and keep both files in the same folder.
@@ -361,16 +361,16 @@ checksum exactly.
 Open a terminal in the download folder and run:
 
 ```bash
-sha256sum --check Sovran_SystemsOS-1.0.5.iso.sha256
+sha256sum --check Sovran_SystemsOS-1.0.6.iso.sha256
 ```
 
 A successful comparison reports:
 
 ```text
-Sovran_SystemsOS-1.0.5.iso: OK
+Sovran_SystemsOS-1.0.6.iso: OK
 ```
 
-You can also run `sha256sum Sovran_SystemsOS-1.0.5.iso` and compare the output
+You can also run `sha256sum Sovran_SystemsOS-1.0.6.iso` and compare the output
 against the checksum file manually.
 
 </details>
@@ -381,11 +381,11 @@ against the checksum file manually.
 Open Terminal in the download folder and run:
 
 ```bash
-shasum -a 256 Sovran_SystemsOS-1.0.5.iso
+shasum -a 256 Sovran_SystemsOS-1.0.6.iso
 ```
 
 Compare the value shown in Terminal with the value inside
-`Sovran_SystemsOS-1.0.5.iso.sha256`.
+`Sovran_SystemsOS-1.0.6.iso.sha256`.
 
 </details>
 
@@ -395,7 +395,7 @@ Compare the value shown in Terminal with the value inside
 Open PowerShell in the download folder and run:
 
 ```powershell
-Get-FileHash .\Sovran_SystemsOS-1.0.5.iso -Algorithm SHA256
+Get-FileHash .\Sovran_SystemsOS-1.0.6.iso -Algorithm SHA256
 ```
 
 Compare the value under `Hash` with the published checksum.
@@ -410,7 +410,7 @@ match exactly.
 
 1. Download and install [Balena Etcher](https://etcher.balena.io), then
    connect the USB drive.
-2. Choose **Flash from file** and select `Sovran_SystemsOS-1.0.5.iso`.
+2. Choose **Flash from file** and select `Sovran_SystemsOS-1.0.6.iso`.
 3. Choose **Select target**, select the USB drive, and review your selection
    carefully.
 4. Choose **Flash** and wait for the writing and verification process to
@@ -879,7 +879,7 @@ primary location for collaboration. Please read our
 ## Privacy. Sovereignty. Bitcoin.
 
 [Visit Sovran Systems](https://sovransystems.com) ·
-[Download Sovran_SystemsOS](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.5.iso) ·
+[Download Sovran_SystemsOS](https://downloads.sovransystems.com/Sovran_SystemsOS-1.0.6.iso) ·
 [View the License](LICENSE)
 
 </div>

scripts/release-stable.sh

@@ -63,7 +63,12 @@ echo
 # Helper: Get latest tag
 # ─────────────────────────────────────────────────────────────────────────────
 get_latest_tag() {
-    git tag --list 'v*' --sort=-version:refname | head -1 || echo ""
+    local exclude="${1:-}"
+    if [[ -n "$exclude" ]]; then
+        git tag --list 'v*' --sort=-version:refname | grep -v -x -E "v?${exclude#v}|${exclude}" | head -1 || echo ""
+    else
+        git tag --list 'v*' --sort=-version:refname | head -1 || echo ""
+    fi
 }
 
 # ─────────────────────────────────────────────────────────────────────────────
@@ -88,7 +93,7 @@ suggest_next_version() {
 # Step 0: Fetch everything
 # ─────────────────────────────────────────────────────────────────────────────
 echo -e "${BLUE}Step 0: Fetching latest from all remotes...${NC}"
-git fetch --all --tags --prune --force || git fetch --all --tags --prune --force 2>/dev/null || true
+git fetch --all --tags 2>/dev/null || true
 
 LATEST_TAG=$(get_latest_tag)
 NEXT_VERSION=$(suggest_next_version "$LATEST_TAG")
@@ -188,9 +193,10 @@ generate_release_notes() {
     printf '%s' "$notes"
 }
 
-# Build the notes from commits since the previous tag
-if [[ -n "$LATEST_TAG" ]] && git rev-parse -q --verify "$LATEST_TAG" >/dev/null; then
-    COMMIT_RANGE="${LATEST_TAG}..HEAD"
+# Build the notes from commits since the previous tag (exclude the target tag if already present)
+PREV_TAG=$(get_latest_tag "$TAG")
+if [[ -n "$PREV_TAG" ]] && git rev-parse -q --verify "$PREV_TAG" >/dev/null; then
+    COMMIT_RANGE="${PREV_TAG}..HEAD"
 else
     COMMIT_RANGE="HEAD"
 fi
@@ -256,7 +262,7 @@ fi
 # ─────────────────────────────────────────────────────────────────────────────
 echo
 echo -e "${BLUE}Step 2: Creating annotated tag ${TAG}...${NC}"
-git tag -a "${TAG}" -m "${RELEASE_MESSAGE}
+git tag -f -a "${TAG}" -m "${RELEASE_MESSAGE}
 
 - Stable release of Sovran_SystemsOS
 - See CHANGELOG.md for full details" || true
@@ -356,17 +362,18 @@ echo
 echo -e "${BLUE}Step 4: Creating GitHub Release...${NC}"
 
 if command -v gh &>/dev/null; then
+    title_suffix="${RELEASE_MESSAGE#Sovran_SystemsOS v* — }"
+    title_suffix="${title_suffix#Sovran_SystemsOS * — }"
     if gh release create "${TAG}" \
         --repo naturallaw777/Sovran_SystemsOS \
-        --title "${TAG} — ${RELEASE_MESSAGE#Sovran_SystemsOS v* — }" \
-        --notes-file "${NOTES_FILE}" \
-        --target main 2>/dev/null; then
+        --title "${TAG} — ${title_suffix}" \
+        --notes-file "${NOTES_FILE}"; then
         echo -e "  ${GREEN}✓${NC} GitHub release created successfully"
     else
-        echo -e "  ${YELLOW}⚠${NC} GitHub release may already exist or failed"
+        echo -e "  ${YELLOW}⚠${NC} GitHub release creation failed (check 'gh auth status' or create via web GUI)"
     fi
 else
-    echo -e "  ${YELLOW}⚠${NC} gh CLI not found — skipping GitHub release"
+    echo -e "  ${YELLOW}⚠${NC} gh CLI not found — skipping GitHub release (create via GitHub web GUI)"
 fi
 
 # ─────────────────────────────────────────────────────────────────────────────
@@ -409,6 +416,9 @@ if [[ -n "${GITEA_TOKEN:-}" ]]; then
 
     if echo "$RESPONSE" | grep -q '"id"'; then
         echo -e "  ${GREEN}✓${NC} Gitea release created successfully"
+    elif echo "$RESPONSE" | grep -q "write:repository"; then
+        echo -e "  ${YELLOW}⚠${NC} Gitea token scope issue: your token requires the 'write:repository' scope (currently has write:package)."
+        echo "     To fix: In Gitea, navigate to Settings → Applications → Manage Access Tokens and generate a token with 'write:repository'."
     else
         echo -e "  ${YELLOW}⚠${NC} Gitea release creation failed or already exists"
         echo "     Response: $RESPONSE"