38 Releases 255 Tags

RSS Feed

• v32.4.1 dca783959a

  Compare

  Onebox v32.4.1 Stable

  jkunz released this 2026-09-22 14:08:30 +00:00 | 0 commits to main since this release

  2026-09-22 - 32.4.1

  Fixes

  • Refuse a backup row that predates the backup archive by name. Restore now states pre-snapshot-backup-row with the backup id before it opens the archive instead of resolving a .tar.enc file path, and deletion of such a row removes the row alone and leaves the file it named on disk. Onebox before 1.24.0 wrote those rows, 32 restores no archive written before it, and their reader is gone together with the tar extractor, the file decryptor, the legacy backups directory and its runtime path. The encrypted tar download export is unchanged. The credential migration the removed reader shared is not legacy — every backup whose service had no stored service secrets reaches it — so it and its two refusals now name the condition they detect instead of a legacy backup.
  • Refuse a backup snapshot whose format this release does not read by name. Restore states unrestorable-snapshot-format with the snapshot id before it creates a temporary directory or restores a single item, and it refuses an untagged snapshot — the file-item format Onebox wrote between 1.24.0 and 6.11.0 — exactly as it refuses a foreign format tag. The untagged reader is gone together with the format discriminator that threaded through restore, platform-resource import and S3 bucket import, so a platform resource that fails to import now fails the restore instead of being downgraded to a warning and no half-restored service is reported as restored. Snapshot creation, the logical-item format and the encrypted tar download export are unchanged.
  • Refuse a backup download by name instead of answering that the backup is missing. The export states backup-not-found, pre-snapshot-backup-row, unrestorable-snapshot-format — it refuses exactly what restore refuses — or backup-password-unset, and the download route answers 404 only for a backup Onebox does not hold, 409 for a refusal about the stored state and 500 for a server-side failure. An install without a backup password no longer receives the service's secret-setting ciphertext and plaintext environment values as an unencrypted tar; the served name .tar.enc is now a fact. The export opens the archive like every other consumer, keeps its restored items, its tar and its encrypted file inside one mkdtemp directory that one finally removes on every path, and streams the deterministic tar through the cipher into that file and the file into the response body instead of holding either in memory. Restore's temporary directory is created and removed the same way. Snapshot verification now proves the snapshot format on every path rather than only when it opens a bundle, and readme.md documents the download's byte layout with the recipe that opens it.
  • Refuse every backup operation by name while the backup archive is not open, and stage a backup creation in a directory Onebox owns. Initialization no longer turns an archive failure into a null archive and a warning: creation, restore, deletion, download export, snapshot verification and the scheduler's run and its prune all state backup-archive-unavailable with the cause the archive failed for, the download route answers 503 for it, a scheduled run is skipped once under that name instead of failing service by service, and a deletion that cannot remove snapshot data leaves the backup row that points at it. An install whose archive does not open keeps serving everything that is not a backup, exactly as before. Backup creation stages its exported contents in an unpredictable mkdtemp directory with mode 0700 that one finally removes after the snapshot is recorded and after every failure, instead of the predictable /tmp/onebox-backup-<service>-<timestamp> whose name also dated the backup row; the row's createdAt is read from the clock. The download body no longer enqueues a chunk that arrives after its reader cancelled, and a failure between a prepared export and its response removes the export directory instead of leaving it behind. A failed open is logged once per state of the archive rather than once per operation, and the archive handle is private: every caller reaches it through the one accessor that opens it or refuses by name.

  Maintenance

  • Remove the startup sweep that deleted the pre-CoreTraffic onebox-smartproxy and onebox-caddy services and the unused backup checksum helper, and type the CoreTraffic service lookup against the Docker service shape instead of any. Correct the comments that described live code as legacy: the dcrouter route target settings, the domain-keyed SSL certificate accessors, the platform-services startup step, and the HTTPS listener adapter.
  • Require the raw secret-setting accessors on the secret settings store and drop the never-taken legacy accessor fallback together with its three casts. The store contract now states one way to reach a secret row, and the test doubles implement it.
  • Pin pnpm 12.4.2 as the release package manager.

  Downloads

  • onebox-linux-arm64
    975 MiB

    2026-09-22 14:25:41 +00:00
  • onebox-linux-x64
    983 MiB

    2026-09-22 14:18:43 +00:00
  • serve.zone-onebox-32.4.1.tgz
    12 MiB

    2026-09-22 14:08:54 +00:00
  • SHA256SUMS.txt
    257 B

    2026-09-22 14:25:42 +00:00
  • THIRD_PARTY_NOTICES.md
    43 KiB

    2026-09-22 14:25:41 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)