Files

DanS ff5f5ddf23 docs: add CHANGELOG with daemon-startup hardening release notes

Introduces CHANGELOG.md (Keep a Changelog style, Unreleased section) covering this
batch, with F8's breaking change — remote plaintext RPC now refused by default —
called out front and center along with the rpctls=1 / rpcallowplaintext=1 recovery
steps. Also records the Security / Fixed / Added entries for F1-F7. Updates the
tracking doc's status to reflect the completed release-notes + i18n back-fill and the
remaining pre-release items (F1/F2 manual repros, CJK subset-font rebuild).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-08-02 12:06:02 -05:00

3.1 KiB

Raw Blame History

Changelog

All notable user-facing changes to ObsidianDragon are documented here. The format loosely follows Keep a Changelog; the project uses Conventional Commits.

[Unreleased]

⚠️ Breaking changes

Remote RPC over plain HTTP is now refused by default. If your wallet is configured to reach a remote rpchost/rpcconnect without TLS, it will no longer connect — it previously sent your rpcuser/rpcpassword in cleartext (capturable by anyone on the network path) after only a dismissible warning. To reconnect, either:
- add rpctls=1 to DRAGONX.conf (preferred, if your daemon supports TLS), or
- add rpcallowplaintext=1 to DRAGONX.conf to explicitly accept the plaintext link.
Local and embedded daemons (127.0.0.0/8, localhost, ::1) are unaffected.

Security

Refuse remote plaintext RPC credential transmission by default (see Breaking changes above).
Tightened localhost detection: a hostname that merely starts with 127. (e.g. 127.evil.com) is no longer mistaken for a loopback address, so it can no longer bypass the plaintext-RPC protection.
Sapling parameters are now integrity-checked (SHA-256) against pinned canonical digests before use, instead of only checking that the files exist. A truncated or corrupt parameter file is caught up front rather than surfacing later as a confusing shielded-operation failure. (Cached via a size:mtime marker so it doesn't re-hash ~48 MB on every launch.)

Fixed

Daemon crashes are no longer occasionally missed: a race between the UI thread and the process monitor could consume the daemon's exit status, hiding a crash and defeating the automatic-restart cap. The monitor is now the sole reaper.
A daemon that fails to launch (missing execute permission, wrong architecture, corrupt binary) now reports a precise error immediately instead of briefly showing "running" and then a generic "exited unexpectedly (exit code 127)".
A quick stop→start no longer triggers a restart storm: the wallet now waits briefly for a previous daemon to release the data-directory lock and shows a clear, non-crash message instead of exhausting the crash-restart budget.
Failures while writing the daemon binaries or Sapling parameters (disk full, permission denied) are now surfaced clearly up front instead of failing opaquely when the daemon later can't start.
Directory-creation failures on startup (read-only home, permission denied) now produce a clear "Cannot create " message instead of a confusing downstream "config missing" / "binary not found" error (or, in one path, an uncaught exception).

Added

A "Taking longer than expected" notice now appears if the daemon is reachable but hasn't finished initializing after ~45 s (configurable via ui.toml), with guidance to restart the daemon or open the Console — instead of an indefinite silent spinner. It clears itself automatically once the daemon connects.

Engineering detail and the finding-by-finding rationale for this batch live in docs/daemon-startup-hardening.md.

3.1 KiB Raw Blame History