- Release Builds: the build/test matrix ran ~1,400 third-party build
scripts and tests with a contents:write token persisted in .git/config.
It now runs with contents:read and persist-credentials: false; a
separate publish job (no project or dependency code) downloads the
artefacts, writes SHA256SUMS and attaches both to the release. The
release now waits for every platform instead of publishing partially.
- CI/Fuzz checkouts don't persist credentials; cargo-audit is pinned
(0.22.2), fails on yanked crates, and also audits fuzz/Cargo.lock;
fuzz runs set -timeout=10 so slow-input bugs (like the IRC OSC one)
are reported instead of hiding under libFuzzer's 20-minute default.
- updates/index.php: array-valued query parameters no longer raise
TypeErrors/warnings; nosniff header.
- Audio: the RDPSND channel with IronRDP's cpal playback backend (PCM;
Opus left out to avoid another native library). On by default for new
RDP profiles. Building now needs the ALSA headers on Linux
(libasound2-dev), added to CI, release and fuzz jobs and the build docs.
- Shared folder (Linux/macOS): one local folder appears on the remote
desktop as a drive. IronRDP's native backend joins server paths onto
the share unchecked, so it is wrapped in ConfinedDrive: create, list
and rename paths with '..' components, NUL bytes, or that resolve
through a symlink outside the share are refused (ACCESS_DENIED);
tests cover the escapes.
Verified against xrdp (with FUSE): the remote read the shared file, and
writes, mkdir and rename landed in the local folder. Not verified:
audio playback (the test container has no sound module), and xrdp lists
the drive as 'ignored' and can't list its directories (an IronRDP/xrdp
naming and listing mismatch, fixed upstream for the name).
rust/fuzz (cargo-fuzz, nightly, its own workspace with the same IronRDP
patches) has targets for the Telnet IAC parser, the IRC parser + state
machine + mIRC formatter, VNC framebuffer updates and decoders,
~/.ssh/config parsing and the update manifest. They reach the private
parsers through hidden entry points behind nexus-core's 'fuzzing'
feature. A nightly workflow runs each for two minutes and uploads any
crashing input. A first 45 s run of each locally found nothing.
- ci.yml declares permissions: contents: read instead of the default
token scope.
- Every action is pinned to the commit its current tag points at
(checkout v4.4.0, upload-artifact v4.6.2, action-gh-release v2.6.2),
so a moved tag can't change what runs with release write access.
- A cargo audit job runs on every push; the single ignored advisory
(RUSTSEC-2023-0071, rsa via russh, no fix available) is recorded with
its rationale in rust/.cargo/audit.toml (SEC-20261012-019, -012).
Release signing and macOS notarisation are not part of this change.
Renames the product across the codebase: Go module path, config/data
paths, keychain service name, export file extension, build tooling,
docs, and UI text. Sidebar brand mark now reads ">_ AlchementaryLink"
with "Alchementary" in the connection-group gold accent colour, and
the window title is "Alchementary Link".
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019T8bJS8BCtY5GeSG2HBj1n
Andy Dixon
