SparkBox 1.5.26: freeze flag now fail-closed, rollback safety hardened
Posted by tomspark
1.5.26 ships five security fixes around the update and rollback paths. The biggest one: if manifest.json ever becomes unreachable after a client has fetched it once, we now refuse to fall back to version.txt (which has no freeze field) — this closes a hole where an attacker could DoS the manifest and bypass an emergency freeze. Fresh installs still bootstrap via version.txt until their first successful manifest pull flips fail-closed mode on. We also fixed a footgun in auto-rollback: install.sh used to delete the rollback directory immediately after swapping in the new version, so a crash-looping release left nothing to recover to. Now the self-update helper holds onto the rollback until the post-install health probe confirms the new dashboard is actually responsive — if health fails, we restore the old version. To prevent picking the wrong rollback if stale directories are lying around, we now validate that the rollback's VERSION file matches the version we were actually running before the update attempt. Two more fixes: the pre-release smoke gate now filters to push-to-main events only (not pullrequest or workflowdispatch for the same SHA), and telemetry workers now rate-limit at 20 events per installid per day and 200 per IP per day — this stops random POSTs from poisoning metrics or inflating KV costs. I've committed docs/UPDATE-SAFETY-TODO.md to track the two remaining P0/P1 items: signed install.sh and signed manifest.json. Both need a release keypair and changes to release.sh — that's next. Head to the Updates tab in your dashboard to pull 1.5.26. Found a problem? Post it here in d/sparkbox. --- Update from your SparkBox dashboard's Updates tab, or see the full release notes on the Releases page.