franz/forseti
Watch
1
0
Fork
You've already forked forseti
 0
Code Issues 2 Pull requests Projects Releases 34 Packages Wiki Activity
34 releases 34 tags
  • v0.2.9 4f9d13394b

    v0.2.9 Stable

    franz released this 2026-09-20 14:19:24 +00:00 | 2 commits to master since this release

    Signed by franz
    GPG key ID: 1B3418BA53820C4C

    Security

    • Org owners could mint recovery codes for co-members and take their accounts
    • Org owners could create OAuth clients that skip the consent screen
    • Team rename, delete and membership weren't bound to the org in the URL
    • Org overview and branding were readable by non-members
    • Handoff trusted any OAuth client, including self-registered ones
    • SAML login handed the browser a 15-minute recovery link
    • Invite and one-shot-reveal tokens were stored in plaintext
    • CIMD client registration had no ceiling
    • X-Real-IP was attacker-controlled on a short forwarded-for chain
    • The NSS resolver aborted sshd and sudo on an interior NUL
    • The Linux client pinned a vulnerable rustls (RUSTSEC-2026-0285)

    Changed

    • Identity and session admin pages are operator-only; ?org= no longer admits owners
    • Org-created OAuth clients are limited to their own org's registered audiences
    • New [oauth.cimd].max_clients and max_clients_per_host
      Builds, checksums and provenance: https://github.com/franzos/forseti/releases/tag/v0.2.9
    Downloads
  • v0.2.8 739efd4e98

    v0.2.8 Stable

    franz released this 2026-09-19 15:52:35 +00:00 | 4 commits to master since this release

    Signed by franz
    GPG key ID: 1B3418BA53820C4C

    Fixed

    • Sign-in left the user on a blank page when an app redirected on past its own callback (Tailscale, and any app like it)

    Changed

    • Consent and logout hand back to Hydra with a page instead of a redirect, so an app's own navigation is no longer the browser's business
    • OAuth apps no longer widen the sign-in page's Content-Security-Policy

    Builds, checksums and provenance: https://github.com/franzos/forseti/releases/tag/v0.2.8

    Downloads
  • v0.2.7 5a47f721a6

    v0.2.7 Stable

    franz released this 2026-09-19 06:07:30 +00:00 | 9 commits to master since this release

    Signed by franz
    GPG key ID: 1B3418BA53820C4C

    Security

    • rustls accepted TLS 1.3 handshake messages at the wrong encryption level (RUSTSEC-2026-0285)

    Builds, checksums and provenance: https://github.com/franzos/forseti/releases/tag/v0.2.7

    Downloads
  • v0.2.6 37397cfee0

    v0.2.6 Stable

    franz released this 2026-09-19 05:34:11 +00:00 | 11 commits to master since this release

    Signed by franz
    GPG key ID: 1B3418BA53820C4C

    Added

    • Tailscale app template for the OAuth2 client picker
    • Operator guide covers Tailscale custom OIDC, including WebFinger

    Builds, checksums and provenance: https://github.com/franzos/forseti/releases/tag/v0.2.6

    Downloads
  • v0.2.5 381aef5158

    v0.2.5 Stable

    franz released this 2026-09-09 09:45:58 +00:00 | 13 commits to master since this release

    Signed by franz
    GPG key ID: 1B3418BA53820C4C

    Changed

    • The username form is always on /settings/profile, no longer behind [profiles].enabled
    • preferred_username ships with the profile scope regardless of that setting
    • Username and public profile save independently

    Builds, checksums and provenance: https://github.com/franzos/forseti/releases/tag/v0.2.5

    Downloads
  • v0.2.4 ebb3fcd58e

    v0.2.4 Stable

    franz released this 2026-09-05 11:41:27 +00:00 | 15 commits to master since this release

    Signed by franz
    GPG key ID: 1B3418BA53820C4C

    Fixed

    • The image's css stage ignored a failed Tailwind download
    • The NSS module pulled the unmaintained paste crate

    Builds, checksums and provenance: https://github.com/franzos/forseti/releases/tag/v0.2.4

    Downloads
  • v0.2.3 9ce5069089

    v0.2.3 Stable

    franz released this 2026-09-05 06:37:03 +00:00 | 17 commits to master since this release

    Signed by franz
    GPG key ID: 1B3418BA53820C4C

    Added

    • [proxy].trusted_hops picks the client from the forwarded-for chain
    • [database].max_connections and acquire_timeout_secs

    Changed

    • Licences signed by the shop's web key are accepted alongside the root key
    • The host client reads its daemon socket path from the binary, not the environment

    Security

    • The host client rejected malformed POSIX names only at the server
    • Outbound fetches followed redirects and could buffer an uncapped body
    • Client-supplied client_uri and logo_uri were rendered unchecked

    Builds, checksums and provenance: https://github.com/franzos/forseti/releases/tag/v0.2.3

    Downloads
  • v0.2.2 7914dca3cb

    v0.2.2 Stable

    franz released this 2026-08-09 22:37:56 +00:00 | 20 commits to master since this release

    Signed by franz
    GPG key ID: 1B3418BA53820C4C

    Fixed

    • A CIMD client never picked up a second resource server's scopes

    Builds, checksums and provenance: https://github.com/franzos/forseti/releases/tag/v0.2.2

    Downloads
  • v0.2.1 5b09f43edf

    v0.2.1 Stable

    franz released this 2026-08-04 22:07:22 +00:00 | 22 commits to master since this release

    Signed by franz
    GPG key ID: 1B3418BA53820C4C

    Fixed

    • Repeat consent duplicated a client's registered audience on every grant

    Builds, checksums and provenance: https://github.com/franzos/forseti/releases/tag/v0.2.1

    Downloads
  • v0.2.0 f3c221e5d3

    v0.2.0 Stable

    franz released this 2026-08-04 16:16:02 +00:00 | 25 commits to master since this release

    Signed by franz
    GPG key ID: 1B3418BA53820C4C

    Added

    • MCP clients connect via CIMD (URL client IDs), no registration step
    • Resource registry with admin UI replaces the audience config allow-list
    • Forseti can front Hydra's issuer: augmented discovery plus a /hydra proxy
    • Consent shows a CIMD client's host as its primary identity

    Changed

    • Client audiences are trusted only from admin-created records

    Removed

    • Dynamic Client Registration (RFC 7591) and initial access tokens

    Fixed

    • Client metadata rows failed to load on Postgres deployments

    Builds, checksums and provenance: https://github.com/franzos/forseti/releases/tag/v0.2.0

    Downloads