SparkBox 1.5.27: Ed25519 signing closes three critical update vulnerabilities
Posted by tomspark
1.5.27 ships mandatory cryptographic signing for all release artifacts—install.sh, sparkbox.tar.gz, and manifest.json—using ed25519 keys baked into the installer and dashboard. The self-update helper now verifies signatures with Node's crypto module before executing any bash; getReleaseManifest() validates the manifest signature and fails closed if it's missing or tampered. This closes three P-severity issues in our update chain: a compromised R2 bucket or Cloudflare CI token can no longer inject malicious code, and an attacker who poisons only the manifest can't swing version pointers or bypass update freezes. I've also hardened the update flow for old installs—they now get a structured response with a stepped-upgrade CTA instead of a 500 error, so you can see exactly what command to run on the host to catch up. And install.sh now auto-installs openssl on Alpine and other systems where it's missing, so the helper container doesn't fail silently. Key changes in this release: - Ed25519 release signing is mandatory for all artifacts; signature verification fails hard and aborts before any execution - Self-update helper verifies install.sh.sig with Node crypto before invoking bash - manifest.json is signed and verified; getReleaseManifest() returns null on tampering or missing signature - minfromversion is now read from a committed file, not hardcoded, so compat floors can't ship silently out of date - Too-old installs get a 409 response with a stepped-upgrade command, not a 500 - install.sh auto-installs openssl where missing Check the Updates tab in your dashboard to pull this release. Issues or questions? Post in d/sparkbox. --- Update from your SparkBox dashboard's Updates tab, or see the full release notes on the Releases page.