-
v1.1.0 — Stable Release Stable
naturallaw777 released this
2026-08-11 13:51:37 -05:00 | 5 commits to stable since this releaseSovran_SystemsOS v1.1.0
Sovran_SystemsOS v1.1.0 — Stable Release
Added
- Speed up Hub service status loading
- Update Documentation
- Njalla.nix: fail on ImportError; fix redundant except clause
- Correctly escape DDNS placeholder in Nix string
- Security hardening: fix all 8 blocking findings for PR #419
- Security hardening: fix DDNS injection, Nix injection, reboot auth, support key, sudo rules
- Harden btcpay and nbxplorer config handling
- Add provenance headers and fix flake checks for PR409
- Restore upstream nix-bitcoin fetchNodeModules for mempool and RTL packages
- Refactor Nix build configuration for mempool
- Update npm dependencies and patch handling in default.nix
- Update npmDepsHash for backend and frontend packages
- Mempool: use postPatch to copy lock file for npmDeps fetcher
- Mempool: use preBuild cd instead of postUnpack so npmDeps fetcher finds lock files
- Mempool: fix npmDeps fetcher — postUnpack instead of sourceRoot, postPatch instead of patches
- Mempool: switch backend and frontend to buildNpmPackage with placeholder npmDepsHash
- Update npmDepsHash with correct hash value
- RTL: switch to buildNpmPackage with placeholder npmDepsHash
- Add bitcoind.rpc.users.btcpayserver for NBXplorer
- Restore original flake.nix with nixosModules.Sovran_SystemsOS export
- Add vendored RTL package and fix rtl.nix to use it
- Vendor mempool packages and wire mempool module to vendored pkgs
- Refactor onion service configuration for LND
- Add missing bitcoind-rpc-public-whitelist.nix
- Remove joinmarket-ob-watcher from onion-services defaults
- Tailor: make bitcoin modules truly Sovran-only (lnd-only) and delete stubs.nix
- Vendor: replace nix-bitcoin flake input with minimal vendored modules (nixpkgs-only)
- Remove duplicate 1.0.6 release notes from CHANGELOG
Changed
- Clean mempool module comment typo
- Move vendor/nix-bitcoin to modules/bitcoin, remove overlays
- Nix flake update - drop nix-bitcoin
Fixed
- Correct RTL and Mempool Hub versions
- Fix DDNS URL validation: replace ${IP} temporarily for validator, keep placeholder for storage
- Fix all 8 security hardening blockers for PR #423
- Fix Nix interpolation in DDNS runner
- Fix IP validation in DDNS and document journalctl sudo rule
- Report configured BTCPay Server version
- Fix Matrix SIGPIPE and RTL v0.15.8 config schema regressions
- Add NBXplorer cookie auth and WorkingDirectory for BTCPay service
- Fix BTCPay startup regression: add home dirs to service users
- Address btcpay hardening review feedback
- Register bitcoin-HMAC-btcpayserver as managed secret owned by bitcoind user
- Fix RTL: use fetchNodeModules instead of npm ci in buildPhase
- Fix PostgreSQL ensureUsers: use ensureDBOwnership instead of ensureClauses
- Fix lnd macaroons: replace invalid 'enable' with 'user'
- Fix postgresql ensurePermissions -> ensureClauses for nixpkgs unstable
- Fix btcpayserver.nix to use pkgs.stable overlay
- Fix btcpayserver syntax error and pin to nixpkgs-stable (2.4.2)
- Fix mempool package: remove fetchNodeModules dependency
- Fix typo in onion-addresses service check
- Fix formatting of extraGroups in btcpayserver.nix
- Add missing semicolon after extraGroups in btcpayserver.nix
- Remove services.clightning.enable assignment that fails on f13ff45
- Remove clightning and clightning-rest from stubs to avoid duplicate on f13ff45
- Add stubs for nixpkgs-unstable 2026-08 where services.clightning removed
- Keep ISO artifacts out of the repo and auto-update README on release
Full changelog: CHANGELOG.md
Downloads
-
v1.0.6 — Stable Release Stable
2026-08-07 16:12:04 -05:00 | 101 commits to stable since this releaseSovran_SystemsOS v1.0.6
Sovran_SystemsOS v1.0.6 — Stable Release
Added
- Iso: fix replaceStrings length mismatch in cleanVersion
- Promote virtual machine trial option in README
- Improve installer VM compatibility
- Trim redundant dev-vs-stable Gitea explanations in README
- Add Arean.Ai to AI tools used for development
- Prefix OS version badge with 'v' (v1.0.5)
- Match OS version badge styling to service modal version badges
- Place OS version badge inline right after the Hub title
- Center OS version badge under the Hub title
- Strengthen entropy section: add DYOR emphasis and hardware wallet verification note
- Add 'About Bitcoin wallet entropy' section to README
- README: balance intro between Bitcoin sovereignty and sovereign computing
Changed
- Removed temp patch file
Fixed
- Resolve tag range detection and improve release diagnostics
- Add token scope diagnostics and un-silence gh release errors
- Harden error handling and sanitize exception details across security endpoints (CWE-209)
- Sanitize exception handling in verify-integrity and security-reset (CWE-209)
- Sanitize api_security_reset errors to prevent exception information exposure (CWE-209)
- Use canonical prefix containment check for CodeQL path-injection
- Pass sanitized abs_path to os.chown to resolve CodeQL path injection at 4338
- Add CodeQL-recognized path sanitization for domain_name
- Remove domain substring check for CodeQL incomplete-url
- Use sentinel for njalla header check (CodeQL incomplete-url-substring)
- Prevent reflected XSS in lnurl-qr print endpoint
- Hash root password instead of storing in clear text (CWE-312)
- Separate web auth hash from system password file
- Fix Matrix Hub admin API credentials
- Fix CWE-78: replace subprocess call with Synapse Admin API in create-user endpoint
Documentation
- Add SECURITY.md detailing security policy and best practices
- Versioned CDN downloads + add CDN upload script
- Correct active development workflow
- Make repo references mirror-neutral for Gitea readers
- Clarify GitHub is the dev mirror of the Gitea stable repo
Full changelog: CHANGELOG.md
Downloads
-
v1.0.5 — Stable Release Stable
2026-08-04 09:32:55 -05:00 | 159 commits to stable since this releaseSovran_SystemsOS v1.0.5
Sovran_SystemsOS v1.0.5 — Stable Release
Added
- LND Update to v0.21.1-beta
- Nixpkgs Update
- Nixpkgs Update
- Update LND REST Zeus Connect instructions and design to match NWC exactly
- UI: Align LND REST and NWC Zeus connection instructions styling
- Make Zeus LND REST instructions coherent with NWC Zeus connect guide
- Clarify Zeus NWC wallet setup
- Make Manual Backup match the system role (Desktop Only scope)
- Reload Caddy immediately when a domain (or ACME email) is saved
- Unify Njal.la + router port-forwarding guidance across onboarding and feature enable modals
- Enhance Lightning Wallet Connect modal with professional benefits grid and refined messaging
Fixed
- Resolve 'vdev' version badge and align it under the Hub title
- Align release script with Gitea staging-dev and stable branch workflow
- Auto-detect git remotes and clean up temp files in release-stable.sh
Documentation
- Write real v1.0.4 changelog and auto-generate release notes in release script
Full changelog: CHANGELOG.md
Downloads
-
2026-07-29 10:18:59 -05:00 | 185 commits to stable since this releaseSovran_SystemsOS v1.0.4
Highlights
⚡ Lightning Wallet Connections (NWC) — Hub-managed Nostr Wallet Connect powered by Alby Hub + LND. Create, view, and delete wallet connections from the Sovran Hub, with printable LNURL QR codes, a channel liquidity guide for new LND nodes, and hardened security throughout.
🏷️ Version visibility everywhere — OS version badge in the Hub, version numbers on every service tile and modal, deployed PHP app versions in service titles, all backed by a build-time
VERSIONreference file.💾 Manual Backup rebuilt — the tar-based backup was replaced with a reliable ext4 + rsync workflow with mount checks, atomic completion markers, and extensive behavioral tests.
🚀 Automated releases & versioned ISOs — new
scripts/release-stable.shhandles tagging, changelog, and dual GitHub/Gitea releases; ISO images are now named from theVERSIONfile.Added
- Lightning Wallet Connections (NWC) with tabbed modal UI, LNURL QR export, liquidity guide, and unique-hostname validation
- Version badges across the Hub (tiles, modals, PHP apps) via build-time
VERSIONfile - Automated stable release workflow and versioned ISO naming
CONTRIBUTING.mdand expanded documentation (router/ISP port-forwarding requirements, LiveKit and Alby Hub acknowledgements)
Changed
- Manual Backup: tar+DB+LND archives → ext4 + rsync workflow with safety checks and tests
- Port-forwarding UX simplified; Njal.la DDNS runs automatically on feature enable
- README restructured for clarity, links, and accuracy
- Updated nixpkgs and Bitcoin clients
- Removed unused
.github,.tests,nix/, anddocs/aidirectories
Fixed
- NWC cert-path wiring (nix-bitcoin LND cert path) and LND/Alby Hub port collision
- Alby Hub executable resolution; v1.23.0 patches regenerated against exact upstream source
- Manual Backup exit-code failures and rsync destination-directory errors
sovran-hosts-updateruntime dependencies,lib.mkIfmisuse in NWC module, duplicate systemd LND strings- Gitea tag-clobber errors on
git fetch
Security
- Hardened NWC: restricted
ReadOnlyPaths, fixed Authorization-header bug, removed stack-trace exposure (CodeQL), tightened credential access and amount validation
Full changelog: CHANGELOG.md
Downloads