-
chore(release): v0.5.8 (#310)
frostbyte_neo 发布于
2026-05-24 12:38:45 +00:00 - chore(release): v0.5.8
Version bump + docs sync for the 0.5.8 release.
- pyproject.toml + __init__.py: 0.5.7 -> 0.5.8
- debian/changelog: 0.5.8 stanza (contributor-credited)
- CHANGELOG.md + docs/CHANGELOG.ko.md: Unreleased -> [0.5.8] with
Highlights + the #269 urlacl fix, #288 podman-compose, #287
recover-oem, #126 dynamic+generous timeouts, #255 wizard
completion, #227 fat AppImage, #301 RPM license entries - README.md + docs/README.ko.md: status line -> v0.5.8 feature
summary, .deb/.rpm filename examples bumped - docs/USAGE.md + .ko: new winpodx pod recover-oem / setup-host /
setup --customize full-provision commands
Contributors credited: @ismikes (#269), @leandromqrs (#227),
@xiyeming (#126), @ankranidiotis (#287), @magicdiablo (#288).- chore(release): address v0.5.8 security + license review findings
Security/legal/release-cleanliness review before tagging. Fixes:
License (MUST-FIX before release):
- AppImage now bundles every third-party component's license + NOTICE
text. appimage-publish.yml copies Fedora /usr/share/licenses/
(FreeRDP/Podman/podman-compose/conmon/crun/netavark/slirp4netns/passt)- a podman-compose GPL-2.0 source-offer note into AppDir/usr/share/
doc/winpodx/third-party/, and winpodx LICENSE + THIRD_PARTY_LICENSES.md - the python-build-standalone license into usr/share/doc/winpodx/ --
satisfying Apache 4(d) / LGPL 4 / GPL-2.0 1+3 / PSF redistribution
obligations. (Previously zero third-party texts shipped + README
falsely claimed they were present.)
- a podman-compose GPL-2.0 source-offer note into AppDir/usr/share/
- THIRD_PARTY_LICENSES.md: add rcedit + reverse-open-shim sections;
add a 'fat AppImage redistributes these' section so the
'not vendored' runtime-deps wording isn't contradicted by the
artifact. debian/copyright: add the shim .exe. - GPL-2.0 podman-compose confirmed mere-aggregation (subprocess, not
linked) -- winpodx stays MIT; documented the boundary + source offer.
Security:
- H1: recover-oem HTTP server now tars + serves a dedicated
/tmp/winpodx-recover dir (one file) instead of all of /storage,
so it never exposes data.img; the agent_token in the tarball is
already held by the guest. - M1: pkexec apply script binds the username to a shell var once
(shlex-quoted) and references "$wpu" everywhere, removing the
raw-interpolation quoting class entirely (defense-in-depth). - M2: verify the python-build-standalone tarball against its upstream
.sha256 sidecar before extracting into the AppImage (supply-chain).
Cleanliness:
- .gitignore: ignore *.AppImage + squashfs-root/ (local AppImage builds).
Tests: setup_wizard pkexec assertions updated for the $wpu form (6 pass).
Reviews returned no Critical security findings; version consistency +
lint + build + secrets all clean.- docs(appimage): correct README to describe the fat CI artifact (MF-1b)
Second-pass legal review caught that packaging/appimage/README.md
still described the OLD lean AppImage -- 'Not bundled: FreeRDP /
Podman / podman-compose' + 'fat AppImage is a follow-up tracked
separately' -- which directly contradicts the fat artifact the CI
workflow actually ships (and the corrected THIRD_PARTY_LICENSES.md).
The first pass fixed the THIRD_PARTY half but not this README.Rewritten to: (1) distinguish the two build paths (CI = fat, ships;
build.sh = lean dev convenience), (2) list what the fat CI AppImage
actually bundles vs what stays host-resolved, (3) Licensing section
now states winpodx stays MIT (podman-compose GPL = subprocess mere-
aggregation), lists the bundled third-party license texts + the
usr/share/doc/winpodx/third-party/ path + GPL source offer, matching
what appimage-publish.yml produces.- ci(appimage): fail closed if a required third-party license dir is missing
Final-pass legal review flagged that the license-copy loop used
2>/dev/null || true, so if a future Fedora image stopped shipping
/usr/share/licenses// the AppImage would silently ship missing a
required NOTICE / GPL text -- a breach of that component's license
(never an MIT issue for winpodx, but a compliance regression).Split into REQUIRED (podman-compose GPL-2.0 + freerdp/podman Apache-2.0
NOTICE) which now abort the build if absent, and OPTIONAL (libs that
share a parent package's license dir on Fedora) which stay best-effort.
winpodx itself remains plain MIT -- this only hardens the obligation
to ship the bundled components' texts.下载附件