Download Latest Version
soft-serve_0.9.1_Linux_i386.tar.gz (9.9 MB)
Get an email when there's a new version of Soft Serve
Prevent path traversal attacks
This is a security release to patch an issue where a malicious user could take over other user's repositories. Please upgrade your Soft Serve instances to prevent these attacks from happening.
Changelog
Bug fixes
- 22d00e9db31e1f4d0c32beae1e8733883f4d80d8: fix(ssh): cmd: remove unnecessary call to utils.SanitizeRepo (@aymanbagabas)
- a8d1bf3f9349c138383b65079b7b8ad97fff78f4: fix: prevent path traversal attacks (#631) (@aymanbagabas)
- 9cd64aa779d343a58ce31220efe9c978b019d872: fix: using lipgloss tables instead of tablewriter (#618) (@caarlos0)
Verifying the artifacts
First, download the [`checksums.txt` file](https://github.com/charmbracelet/soft-serve/releases/download/0.8.2/checksums.txt), for example, with `wget`: :::bash wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.8.2/checksums.txt' Then, verify it using [`cosign`](https://github.com/sigstore/cosign): :::bash cosign verify-blob \ --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ --cert 'https://github.com/charmbracelet/soft-serve/releases/download/v0.8.2/checksums.txt.pem' \ --signature 'https://github.com/charmbracelet/soft-serve/releases/download/v0.8.2/checksums.txt.sig' \ ./checksums.txt If the output is `Verified OK`, you can safely use it to verify the checksums of other artifacts you downloaded from the release using `sha256sum`: :::bash sha256sum --ignore-missing -c checksums.txt Done! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.