Open Chronology Files

Changes since v0.23.0.

Early release. In SemVer terms, anything may change before 1.0, including file formats, the HTTP API and settings, though changes to .ochx and .och files will come with conversions.

⚠ Before you upgrade

• Docker Compose: add APP_DATABASE_PASSWORD to .env, different from POSTGRES_PASSWORD. Compose now runs the app as an ordinary database role, openchronology_app, and refuses to start without it.
• NixOS: the syslog receiver and journald follower no longer read the server's environmentFile. Give them their API keys with the new services.openchronology.syslog.environmentFile and journald.environmentFile; the module warns while either is unset.
• Packages (Debian, Ubuntu, RPM, Arch, FreeBSD): nothing to do. The upgrade creates the openchronology-logs user and moves the log receivers' settings to it.

Security

This release hardens every edition, following a security review. Advisories will be published once servers have upgraded.

• Server:
• Request bodies: routes anyone can call accept only small requests, and deeply nested JSON is refused before it is parsed.
• Anonymous load: anonymous queries and tag-filtered views are rate-limited and queued.
• Rate limits: an IPv6 client is counted by its /64.
• Proof-of-work answers: they can't be reused.
• Smaller fixes: in the LDAP filter and in embed titles.
• Web pages:
• Security headers: every page gets the content security policy, framing protection, nosniff, no-referrer and HSTS.
• Google Analytics (when an operator enables it) is never sent private timelines' titles or addresses, or sign-in codes.
• Desktop app:
• Opening .och files: a crafted file can no longer crash the app or the server's converter.
• File links: a timeline's links are followed only inside folders you chose, or in a timeline you trust, asked in the app's own dialog. Opening a file uses an allowlist of kinds, and other files are shown in their folder.
• System thumbnailers run only on files you chose.
• Images: a timeline opened from a file hides images from other sites until you choose to show them.
• Permissions: the window can call only the app's own commands.
• Private files: staged files and thumbnails are private to you.
• Desktop sign-in: the approval page shows which computer is asking. A request from another network needs a second confirmation, which the server enforces.
• Offline file and editor: the capacity notice keeps only hashes in browser storage, and survives bad values there.
• Packaging:
• Windows server: it takes ownership of its data folder and trusts nothing it didn't create.
• Docker Compose and Homebrew: the app connects to the database without superuser rights.
• Log receivers: the syslog receiver and journald follower run as their own user, openchronology-logs, and can't read the server's secrets.
• systemd: more sandboxing.
• Release assets: they carry build provenance attestations (gh attestation verify <file> --repo openchronology/timeline-app).
• Pinning: Rust is fixed to one release, and base images are pinned by digest.

Added

• Page caching: public pages seen signed out can be cached by a reverse proxy for a minute, with Vary: Cookie; anything signed in stays private. Administration has an nginx sample and how to measure page speed.
• A comparison of timeline tools in the help, and an FAQ answer pointing to it.
• New help pages: Installing a server and Building and testing, which take over the README's detail.

Changed

• The README is short: what OpenChronology does, and where to go next.
• The hosted offline copy at openchronology.github.io changes only with stable releases.
• The NixOS module hides nginx's version.

Upgrading

Install the new package and run openchronology-migrate as usual. The migration adds two columns to desktop sign-in requests.