Upgrade to upstream v1.13.3 (credential rotation, SFTP hardening, CPU burst) - #10
Merged
Conversation
…lock is good enough
pterodactyl/pterodactyl-cdn publishes https://cdn.pterodactyl.io/releases/latest.json, which every panel install polls to decide whether a node is running an outdated wings. It cannot read the new version from the API itself, because the release created above is still a draft and /releases/latest excludes drafts, so the tag is passed in the dispatch payload. Prerelease tags are skipped: version_compare on the panel side would tell every stable install to "upgrade" to a release candidate. GITHUB_TOKEN cannot be used here as it has no access to another repository, hence CDN_DISPATCH_TOKEN.
thanks 0x7d8
The v1.13.3 changelog section doubles as the release notes — the release gate refuses to publish without it. FORK_CHANGES.md: baseline rebased onto v1.13.3 (6987d5e); §4 records the master-key-rotation cluster, the SFTP setstat hardening and the CPU burst/period/shares work as upstream code, so the next upgrade does not mistake them for fork changes. The dropped CDN-manifest notification is noted on the release-pipeline row.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the fork up to upstream pterodactyl/wings v1.13.3 (
6987d5e).Upstream v1.13.3
Eight commits, three clusters:
Master-key rotation (
07ce5fe,392e52c,3e6c2c9): a master key reset through the Panel now propagates to the running daemon — previously Wings kept authenticating with the boot-time token until restarted.postUpdateConfigurationre-resolves the derived token and rotates the (now mutex-guarded) Panel API client credentials via the newClient.SetCredentials(). Hardened alongside: Panel-sent token values may not usefile:///$VARindirection (which would leak files/env vars back out through the token), must matchWINGS_TOKEN_ID/WINGS_TOKENenvironment overrides when set, and an update carrying an empty token is refused.SFTP hardening (
da1a216):setstatrequests carrying the extended-attribute flag are rejected before parsing —pkg/sftpallocates the client-provided attribute count before validating packet length, so a small packet could request an effectively unbounded allocation.CPU allocation (
2cc8a10,6987d5e): newenvironment/docker/cgroup_burst.go(cgroup v1+v2, applied on start/install/in-situ updates) plus three config fields —docker.cpu_period,docker.cpu_burst.percent,docker.cpu_shares(default 0 = engine default; Wings historically hardcoded 1024).Plus the logrotate wrapper fix (#336) and
Expand()no longer silently swallowingfile://read errors.Merge
Two conflicts, both expected:
.github/workflows/release.yaml— resolved keep ours (our automatic pipeline). Upstream's addition there (c57c519) only notifies pterodactyl's own CDN-manifest repo; deliberately dropped and noted in FORK_CHANGES.md.server/install.go— module-renamed import block plus the newenvironment/dockerimport.Two leaked
pterodactyl/wingsimports in the newly added files (cgroup_burst.go,router_system_test.go) were renamed toRene-Roscher; the repo greps clean. The five fork-touched files (config.go,remote/http.go,router_system.go,sftp/handler.go,environment/settings.go) differ from upstream only by the module rename plus ourpublisher: srvwiring in the SFTP handler — activity streaming preserved, upstream hardening in.Docs
CHANGELOG.mdgained the## v1.13.3section — required by the release gate, and it becomes the release notes verbatim.FORK_CHANGES.md: baseline rebased ontov1.13.3, §4 records all three upstream clusters (and their test suites) as upstream code so the next upgrade does not mistake them for fork changes.Verification
Run in a
golang:1.24container (no Go on the dev host):go build ./...— clean.go test ./... -count=1— all packages pass.TestSetCredentials,TestPostUpdateConfigurationRotatesCredentials,TestCpuBurstMicroseconds,TestResolveCgroupCpuFile(v1/v2/rootless),TestHandlerRejectsMalformedSetstatAttributes,TestSetstatMode.go vet ./...— exactly the four pre-existing findings, nothing new.