df34bad3c · cryptotaxi247/kubo · siGit Code & Deploy

@@ -1,5 +1,92 @@

1 # go-ipfs changelog

2

3 +## v0.13.1 2022-07-06

4 +

5 +This release includes security fixes for various DOS vectors when importing untrusted user input with `ipfs dag import`

6 +and the [`v0/dag/import`](https://docs.ipfs.io/reference/http/api/#api-v0-dag-import) endpoint.

7 +

8 +View the linked [security advisory](https://github.com/ipfs/go-ipfs/security/advisories/GHSA-f2gr-7299-487h) for more information.

9 +

10 +### Changelog

11 +

12 +- github.com/ipfs/go-ipfs:

13 + - chore: update car

14 +- github.com/ipld/go-car (v0.3.2 -> v0.4.0) & (v2.1.1 -> v2.4.0):

15 + - Bump version in prep for releasing go-car `v0`

16 + - Revert changes to `insertionindex`

17 + - Revert changes to `index.Index` while keeping most of security fixes

18 + - Return error when section length is invalid `varint`

19 + - Drop repeated package name from `CarStats`

20 + - Benchmark `Reader.Inspect` with and without hash validation

21 + - Use consistent CID mismatch error in `Inspect` and `BlockReader.Next`

22 + - Use streaming APIs to verify the hash of blocks in CAR `Inspect`

23 + - test: add fuzzing for reader#Inspect

24 + - feat: add block hash validation to Inspect()

25 + - feat: add Reader#Inspect() function to check basic validity of a CAR and return stats

26 + - Remove support for `ForEach` enumeration from car-index-sorted

27 + - Use a fix code as the multihash code for `CarIndexSorted`

28 + - Fix testutil assertion logic and update index generation tests

29 + - fix: tighter constraint of singleWidthIndex width, add index recommentation docs

30 + - fix: explicitly disable serialization of insertionindex

31 + - feat: MaxAllowed{Header,Section}Size option

32 + - feat: MaxAllowedSectionSize default to 32M

33 + - fix: use CidFromReader() which has overread and OOM protection

34 + - fix: staticcheck catches

35 + - fix: revert to internalio.NewOffsetReadSeeker in Reader#IndexReader

36 + - fix index comparisons

37 + - feat: Refactor indexes to put storage considerations on consumers

38 + - test: v2 add fuzzing of the index

39 + - fix: v2 don't divide by zero in width indexes

40 + - fix: v2 don't allocate indexes too big

41 + - test: v2 add fuzzing to Reader

42 + - fix: v2 don't accept overflowing offsets while reading v2 headers

43 + - test: v2 add fuzzing to BlockReader

44 + - fix: v2 don't OOM if the header size is too big

45 + - test: add fuzzing of NewCarReader

46 + - fix: do bound check while checking for CIDv0

47 + - fix: don't OOM if the header size is too big

48 + - Add API to regenerate index from CARv1 or CARv2

49 + - PrototypeChooser support (#305) ([ipld/go-car#305](https://github.com/ipld/go-car/pull/305))

50 + - bump to newer blockstore err not found (#301) ([ipld/go-car#301](https://github.com/ipld/go-car/pull/301))

51 + - Car command supports for `largebytes` nodes (#296) ([ipld/go-car#296](https://github.com/ipld/go-car/pull/296))

52 + - fix(test): rootless fixture should have no roots, not null roots

53 + - Allow extracton of a raw unixfs file (#284) ([ipld/go-car#284](https://github.com/ipld/go-car/pull/284))

54 + - cmd/car: use a better install command in the README

55 + - feat: --version selector for `car create` & update deps

56 + - feat: add option to create blockstore that writes a plain CARv1 (#288) ([ipld/go-car#288](https://github.com/ipld/go-car/pull/288))

57 + - add `car detach-index list` to list detached index contents (#287) ([ipld/go-car#287](https://github.com/ipld/go-car/pull/287))

58 + - add `car root` command (#283) ([ipld/go-car#283](https://github.com/ipld/go-car/pull/283))

59 + - make specification of root cid in get-dag command optional (#281) ([ipld/go-car#281](https://github.com/ipld/go-car/pull/281))

60 + - Update `version.json` after manual tag push

61 + - Update v2 to context datastores (#275) ([ipld/go-car#275](https://github.com/ipld/go-car/pull/275))

62 + - update context datastore ([ipld/go-car#273](https://github.com/ipld/go-car/pull/273))

63 + - Traversal-based car creation (#269) ([ipld/go-car#269](https://github.com/ipld/go-car/pull/269))

64 + - Seek to start before index generation in `ReadOnly` blockstore

65 + - support extraction of unixfs content stored in car files (#263) ([ipld/go-car#263](https://github.com/ipld/go-car/pull/263))

66 + - Add a barebones readme to the car CLI (#262) ([ipld/go-car#262](https://github.com/ipld/go-car/pull/262))

67 + - sync: update CI config files (#261) ([ipld/go-car#261](https://github.com/ipld/go-car/pull/261))

68 + - fix!: use -version=n instead of -v1 for index command

69 + - feat: fix get-dag and add version=1 option

70 + - creation of car from file / directory (#246) ([ipld/go-car#246](https://github.com/ipld/go-car/pull/246))

71 + - forEach iterates over index in stable order (#258) ([ipld/go-car#258](https://github.com/ipld/go-car/pull/258))

72 +- github.com/multiformats/go-multicodec (v0.4.1 -> v0.5.0):

73 + - Bump version to 0.5.0

74 + - Bump version to 0.4.2

75 + - deps: update stringer version in go generate command

76 + - docs(readme): improved usage examples (#66) ([multiformats/go-multicodec#66](https://github.com/multiformats/go-multicodec/pull/66))

77 +

78 +### ❤ Contributors

79 +

81 +|-------------|---------|---------|---------------|

82 +| Masih H. Derkani | 27 | +1494/-1446 | 100 |

83 +| Rod Vagg | 31 | +2021/-606 | 105 |

84 +| Will | 19 | +1898/-151 | 69 |

85 +| Jorropo | 27 | +1638/-248 | 76 |

86 +| Aayush Rajasekaran | 1 | +130/-100 | 10 |

87 +| whyrusleeping | 1 | +24/-22 | 4 |

88 +| Marcin Rataj | 1 | +27/-1 | 1 |

89 +

90 ## v0.13.0 2022-05-04

91

92 We're happy to announce go-ipfs 0.13.0, packed full of changes and improvements!

@@ -140,7 +227,7 @@ There are two ways for requesting CID specific response format:

227

228 ```console

229 $ curl -H 'Accept: application/vnd.ipld.raw' "http://127.0.0.1:8080/ipfs/QmZULkCELmmk5XNfCgTnCyFgAVxBRBXyDHGGMVoLFLiXEN" --output block.bin

143 -$ cat block.bin | ipfs block put

230 +$ cat block.bin | ipfs block put

231 $ ipfs cat QmZULkCELmmk5XNfCgTnCyFgAVxBRBXyDHGGMVoLFLiXEN

232 hello

233 ```

@@ -2123,7 +2210,7 @@ As usual, this release includes important fixes, some of which may be critical f

2210 - `ipfs dag put`

2211 - defaults changed to reduce ambiguity and surprises: input is now assumed to be [`dag-json`](https://ipld.io/specs/codecs/dag-json/spec/), and data is serialized to [`dag-cbor`](https://ipld.io/specs/codecs/dag-cbor/spec/) at rest.

2212 - `--format` and `--input-enc` were removed and replaced with `--store-codec` and `--input-codec`

2126 - - codec names now match the ones defined in the [multicodec table](https://github.com/multiformats/multicodec/blob/master/table.csv)

2213 + - codec names now match the ones defined in the [multicodec table](https://github.com/multiformats/multicodec/blob/master/table.csv)

2214 - dag-pb (e.g. unixfs) field names changed - impacts userland code that works with `dag-pb` objects stored via `dag put`

2215

2216 Keep reading to learn more details.

@@ -3507,7 +3594,7 @@ Examples include:

3594 ```

3595 ipfs pin remote service add myservice https://myservice.tld:1234/api/path myaccess key

3596

3510 -ipfs pin remote add /ipfs/bafymydata --service=myservice --name=myfile

3597 +ipfs pin remote add /ipfs/bafymydata --service=myservice --name=myfile

3598 ipfs pin remote ls --service=myservice --name=myfile

3599 ipfs pin remote ls --service=myservice --cid=bafymydata

3600 ipfs pin remote rm --serivce=myservice --name=myfile

@@ -3530,7 +3617,7 @@ Previously DNSLink names would have trouble loading over subdomain gateways with

3617

3618 `/ipns/en.wikipedia-on-ipfs.org` →

3619 `ipns://en.wikipedia-on-ipfs.org` →

3533 -`https://dweb.link/ipns/en.wikipedia-on-ipfs.org`

3620 +`https://dweb.link/ipns/en.wikipedia-on-ipfs.org`

3621 `https://en-wikipedia--on--ipfs-org.ipns.dweb.link` :point_left: _a single DNS label, no TLS error_

3622

3623 #### QUIC update

@@ -5258,7 +5345,7 @@ default. This:

5345

5346 * Ensures that every dapp gets its own browser origin.

5347 * Makes it easier to write websites that "just work" with IPFS because absolute paths will now work (though you should still use relative links because they're better).

5261 -

5348 +

5349 Paths addressing the gateway by IP address (`http://127.0.0.1:5001/ipfs/CID`) will not be altered as IP addresses can't have subdomains.

5350

5351 Note: cURL doesn't follow redirects by default. To avoid breaking cURL and other clients that don't support redirects, go-ipfs will return the requested file along with the redirect. Browsers will follow the redirect and abort the download while cURL will ignore the redirect and finish the download.

@@ -5287,7 +5374,7 @@ This feature will be enabled by default in 0.6.0.

5374

5375 ##### IPNS with base32 PIDs

5376

5290 -IPNS names can now be expressed as special multibase CIDs. E.g.,

5377 +IPNS names can now be expressed as special multibase CIDs. E.g.,

5378

5379 > /ipns/bafzbeibxfjp4gaxc4cdn57257cyvc7jfa4rlp4e5min6geg44m57g6nx7e

5380

@@ -5385,7 +5472,7 @@ IPFS now allows rapid reading and writing of blocks in [`.car` format](https://g

5472 ~$ ipfs dag export QmQPeNsJPyVWPFDVHb77w8G42Fvo15z4bG2X8D2GhfbSXc \

5473 | xz > welcome_to_ipfs.car.xz

5474

5388 - 0s 6.73 KiB / ? [-------=-------------------------------------] 5.16 MiB/s 0s

5475 + 0s 6.73 KiB / ? [-------=-------------------------------------] 5.16 MiB/s 0s

5476

5477 ```

5478 Then on another `ipfs` instance, not even connected to the network:

@@ -5413,7 +5500,7 @@ To enable structured logging, set the `IPFS_LOGGING_FMT` environment variable to

5500

5501 Note: while we've switched to using Zap as the logging backend, most of go-ipfs still logs strings.

5502

5416 -##### Systemd Support

5503 +##### Systemd Support

5504

5505 For Linux users, this release includes support for two systemd features: socket activation and startup/shutdown notifications. This makes it possible to:

5506

@@ -5470,7 +5557,7 @@ type Plugin interface {

5557 }

5558 ```

5559

5473 -to

5560 +to

5561

5562 ```go

5563 type Environment struct {

@@ -6480,7 +6567,7 @@ This release includes fixes for the following regressions:

6567 networking module, causing it to announce the wrong addresses and sometimes

6568 complain about not being able to determine the IP address

6569 ([ipfs/go-ipfs#6415](https://github.com/ipfs/go-ipfs/pull/6415)).

6483 -

6570 +

6571 It also includes fixes for:

6572

6573 1. Pins not being persisted after `ipfs block add --pin`

@@ -6765,13 +6852,13 @@ rce is stdin.

6852 -p, --progress bool - Stream progress data.

6853 -t, --trickle bool - Use trickle-dag format for da

6854 g generation.

6768 - -n, --only-hash bool - Only chunk and hash - do not

6855 + -n, --only-hash bool - Only chunk and hash - do not

6856 write to disk.

6857 -w, --wrap-with-directory bool - Wrap files with a directory o

6858 bject.

6859 -s, --chunker string - Chunking algorithm, size-[byt

6860 es] or rabin-[min]-[avg]-[max]. Default: size-262144.

6774 - --pin bool - Pin this object when adding.

6861 + --pin bool - Pin this object when adding.

6862 Default: true.

6863 --raw-leaves bool - Use raw blocks for leaf nodes

6864 . (experimental).

@@ -7269,7 +7356,7 @@ performance issues that we've now fixed in this release. Specifically:

7356 * We've fixed quite a number of performance issues that only show up when

7357 rapidly forming new connections. This will actually help _all_ nodes but will

7358 especially help relays.

7272 -

7359 +

7360 If you've enabled relay _hop_ (`Swarm.EnableRelayHop`) in go-ipfs 0.4.19 and it

7361 hasn't burned down your machine yet, this release should improve things

7362 significantly. However, relays are still under heavy load so running an open

@@ -8336,7 +8423,7 @@ bafybeicg2rebjoofv4kbyovkw7af3rpiitvnl6i7ckcywaq6xjcxnc2mby

8423

8424 The refactored `ipfs p2p` command allows forwarding TCP streams through two IPFS

8425 nodes from one host to another. It's `ssh -L` but for IPFS. You can find

8339 -documentation

8426 +documentation

8427 [here](https://github.com/ipfs/go-ipfs/blob/master/docs/experimental-features.md#ipfs-p2p).

8428 It's still experimental but we don't expect too many breaking changes at this

8429 point (it will very likely be stabilized in the next release). Quick summary of

@@ -9974,7 +10061,7 @@ few other improvements to other parts of the codebase. Notably:

10061 - 81% coverage on blockstore ([ipfs/go-ipfs#3074](https://github.com/ipfs/go-ipfs/pull/3074))

10062 - 80% coverage of unixfs/mod ([ipfs/go-ipfs#3096](https://github.com/ipfs/go-ipfs/pull/3096))

10063 - 82% coverage on blocks ([ipfs/go-ipfs#3086](https://github.com/ipfs/go-ipfs/pull/3086))

9977 - - 87% coverage on unixfs ([ipfs/go-ipfs#3492](https://github.com/ipfs/go-ipfs/pull/3492))

10064 + - 87% coverage on unixfs ([ipfs/go-ipfs#3492](https://github.com/ipfs/go-ipfs/pull/3492))

10065 - Improve coverage on routing/offline ([ipfs/go-ipfs#3516](https://github.com/ipfs/go-ipfs/pull/3516))

10066 - Add test for flags package ([ipfs/go-ipfs#3449](https://github.com/ipfs/go-ipfs/pull/3449))

10067 - improve test coverage on merkledag package ([ipfs/go-ipfs#3113](https://github.com/ipfs/go-ipfs/pull/3113))

docs: v0.13.1 (#9093)