DanS
ff5f5ddf23
Introduces CHANGELOG.md (Keep a Changelog style, Unreleased section) covering this batch, with F8's breaking change — remote plaintext RPC now refused by default — called out front and center along with the rpctls=1 / rpcallowplaintext=1 recovery steps. Also records the Security / Fixed / Added entries for F1-F7. Updates the tracking doc's status to reflect the completed release-notes + i18n back-fill and the remaining pre-release items (F1/F2 manual repros, CJK subset-font rebuild). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
59 lines
3.1 KiB
Markdown
59 lines
3.1 KiB
Markdown
# Changelog
|
|
|
|
All notable user-facing changes to ObsidianDragon are documented here. The format loosely
|
|
follows [Keep a Changelog](https://keepachangelog.com/); the project uses Conventional Commits.
|
|
|
|
## [Unreleased]
|
|
|
|
### ⚠️ Breaking changes
|
|
|
|
- **Remote RPC over plain HTTP is now refused by default.** If your wallet is configured to
|
|
reach a **remote** `rpchost`/`rpcconnect` **without TLS**, it will no longer connect — it
|
|
previously sent your `rpcuser`/`rpcpassword` in cleartext (capturable by anyone on the
|
|
network path) after only a dismissible warning. To reconnect, either:
|
|
- add **`rpctls=1`** to `DRAGONX.conf` (preferred, if your daemon supports TLS), or
|
|
- add **`rpcallowplaintext=1`** to `DRAGONX.conf` to explicitly accept the plaintext link.
|
|
|
|
Local and embedded daemons (`127.0.0.0/8`, `localhost`, `::1`) are unaffected.
|
|
|
|
### Security
|
|
|
|
- Refuse remote plaintext RPC credential transmission by default (see Breaking changes above).
|
|
- Tightened localhost detection: a hostname that merely *starts* with `127.` (e.g.
|
|
`127.evil.com`) is no longer mistaken for a loopback address, so it can no longer bypass the
|
|
plaintext-RPC protection.
|
|
- Sapling parameters are now integrity-checked (SHA-256) against pinned canonical digests
|
|
before use, instead of only checking that the files exist. A truncated or corrupt parameter
|
|
file is caught up front rather than surfacing later as a confusing shielded-operation failure.
|
|
(Cached via a `size:mtime` marker so it doesn't re-hash ~48 MB on every launch.)
|
|
|
|
### Fixed
|
|
|
|
- Daemon crashes are no longer occasionally missed: a race between the UI thread and the
|
|
process monitor could consume the daemon's exit status, hiding a crash and defeating the
|
|
automatic-restart cap. The monitor is now the sole reaper.
|
|
- A daemon that fails to launch (missing execute permission, wrong architecture, corrupt
|
|
binary) now reports a precise error immediately instead of briefly showing "running" and
|
|
then a generic "exited unexpectedly (exit code 127)".
|
|
- A quick stop→start no longer triggers a restart storm: the wallet now waits briefly for a
|
|
previous daemon to release the data-directory lock and shows a clear, non-crash message
|
|
instead of exhausting the crash-restart budget.
|
|
- Failures while writing the daemon binaries or Sapling parameters (disk full, permission
|
|
denied) are now surfaced clearly up front instead of failing opaquely when the daemon later
|
|
can't start.
|
|
- Directory-creation failures on startup (read-only home, permission denied) now produce a
|
|
clear "Cannot create <dir>" message instead of a confusing downstream "config missing" /
|
|
"binary not found" error (or, in one path, an uncaught exception).
|
|
|
|
### Added
|
|
|
|
- A "Taking longer than expected" notice now appears if the daemon is reachable but hasn't
|
|
finished initializing after ~45 s (configurable via `ui.toml`), with guidance to restart the
|
|
daemon or open the Console — instead of an indefinite silent spinner. It clears itself
|
|
automatically once the daemon connects.
|
|
|
|
---
|
|
|
|
Engineering detail and the finding-by-finding rationale for this batch live in
|
|
`docs/daemon-startup-hardening.md`.
|