%global debug_package %{nil} %global app_name repogoon Name: repogoon Version: 0.13.1 Release: 20260824 Summary: Self-hosted Git repository hosting platform BuildArch: %{_target_cpu} License: MPL-2.0 Source0: %{name}-%{version}.tar.gz BuildRequires: nodejs BuildRequires: systemd-rpm-macros BuildRequires: gcc-c++ BuildRequires: make BuildRequires: python3 Requires: nodejs Requires: python3 Requires: git-core Requires: sudo Requires: sqlite Requires: wget2 Requires: tar Requires: util-linux-core Requires(pre): shadow-utils Requires(post): systemd Requires(preun): systemd Requires(postun): systemd # Provide the user/group that %pre creates (satisfies auto-generated deps from file attrs) Provides: user(repogoon) Provides: group(repogoon) # The stable and preview packages are alternative providers of one application. # Both deliberately use the same service, account, configuration, and data paths. %if "%{name}" == "repogoon-preview" Conflicts: repogoon %global alternate_package repogoon %else Conflicts: repogoon-preview %global alternate_package repogoon-preview %endif # Optional dependencies Recommends: nginx Recommends: certbot Recommends: python3-certbot-nginx Recommends: yq Recommends: postgresql Recommends: mariadb Suggests: postgresql-server Suggests: mariadb-server %description RepoGoon is a self-hosted Git repository hosting platform built with Node.js and Express. Features include: - Multiple database backends (SQLite, PostgreSQL, MySQL, Oracle, Convex) - YAML-based configuration - LDAP and OIDC authentication support - Dynamic rate limiting - Built-in web interface - CLI management tool (rgoon-ctl) %prep %setup -q %build # Prevent prebuild-install from downloading prebuilt binaries # This forces compilation from source during npm ci export npm_config_build_from_source=true export PREBUILD_ARCH="%{_target_cpu}" # Use the pinned npm version for reproducible package builds without mutating # the system npm installation on the build host. npm install --prefix .rpm-npm npm@12.0.1 export PATH="$PWD/.rpm-npm/node_modules/.bin:$PATH" npm --version # Install dependencies with ignore-scripts to prevent prebuild downloads npm ci --ignore-scripts # Delete ANY prebuilt binaries that might exist in the package # This ensures we don't accidentally ship generic prebuilds with old glibc deps find node_modules -type d -name "prebuilds" -exec rm -rf {} + 2>/dev/null || true # Only delete node-gyp build outputs (Release/Debug), not package directories like workbox-build/build find node_modules -type d -name "Release" -path "*/build/*" -exec rm -rf {} + 2>/dev/null || true find node_modules -type d -name "Debug" -path "*/build/*" -exec rm -rf {} + 2>/dev/null || true # Rebuild all native modules. npm 12 no longer accepts --build-from-source; # npm_config_build_from_source is still consumed by prebuild-install so its # package install scripts fall back to node-gyp compilation. npm rebuild # better-sqlite3 13.x ships host prebuilds and its implicit node-gyp rebuild # intentionally becomes a no-op whenever it detects one. Since the RPM build # removes those generic prebuilds, force the package's source-build script and # fail the build if the runtime addon was not produced. npm --prefix node_modules/better-sqlite3 run build-release # Build the frontend and server npm run build:all # Remove dev dependencies for production npm prune --omit=dev # Apply non-breaking audit remediations for production dependencies only. # Keep this after build/prune so dev tooling (e.g. vite) remains available during compile. # Ignore non-zero exit so builds don't fail when advisories have no safe fix. npm audit fix --omit=dev --no-fund --no-audit || true # Validate the final production dependency tree, after npm has finished making # changes, so an RPM with a missing or unloadable SQLite addon cannot be emitted. test -f node_modules/better-sqlite3/build/Release/better_sqlite3.node node -e 'const Database = require("better-sqlite3"); const db = new Database(":memory:"); db.close()' %install # Create directories install -d %{buildroot}%{_datadir}/%{app_name} install -d %{buildroot}%{_sysconfdir}/%{app_name} install -d %{buildroot}%{_localstatedir}/lib/%{app_name} install -d %{buildroot}%{_localstatedir}/lib/%{app_name}/repos install -d %{buildroot}%{_localstatedir}/lib/%{app_name}/avatars install -d %{buildroot}%{_localstatedir}/lib/%{app_name}/backup install -d %{buildroot}%{_localstatedir}/log/%{app_name} install -d %{buildroot}%{_bindir} install -d %{buildroot}%{_unitdir} install -d %{buildroot}%{_sysconfdir}/nginx/conf.d # Copy application files cp -r server %{buildroot}%{_datadir}/%{app_name}/ cp -r dist %{buildroot}%{_datadir}/%{app_name}/ cp -r node_modules %{buildroot}%{_datadir}/%{app_name}/ cp package.json %{buildroot}%{_datadir}/%{app_name}/ cp -r convex %{buildroot}%{_datadir}/%{app_name}/ cp -r config %{buildroot}%{_datadir}/%{app_name}/ # Copy public directory but exclude avatars (handled by symlink) # We copy to a temporary location first or just copy and clean up cp -r public %{buildroot}%{_datadir}/%{app_name}/ rm -rf %{buildroot}%{_datadir}/%{app_name}/public/avatars # Never ship local environment files in RPM payload find %{buildroot}%{_datadir}/%{app_name} -type f -name ".env" -delete # Do not ship duplicate native-module build artifacts from obj.target/. find %{buildroot}%{_datadir}/%{app_name}/node_modules -type d -path "*/build/Release/obj.target" -exec rm -rf {} + 2>/dev/null || true # esbuild's install script copies the platform binary into esbuild/bin/esbuild, # which duplicates the packaged @esbuild//bin/esbuild payload and # triggers duplicate build-id warnings. Keep the platform package binary and # replace the copied file with a relative symlink. if [ -f %{buildroot}%{_datadir}/%{app_name}/node_modules/esbuild/bin/esbuild ] && \ [ -f %{buildroot}%{_datadir}/%{app_name}/node_modules/@esbuild/linux-x64/bin/esbuild ] && \ cmp -s \ %{buildroot}%{_datadir}/%{app_name}/node_modules/esbuild/bin/esbuild \ %{buildroot}%{_datadir}/%{app_name}/node_modules/@esbuild/linux-x64/bin/esbuild; then rm -f %{buildroot}%{_datadir}/%{app_name}/node_modules/esbuild/bin/esbuild ln -s ../../@esbuild/linux-x64/bin/esbuild \ %{buildroot}%{_datadir}/%{app_name}/node_modules/esbuild/bin/esbuild fi # Keep known runtime helper binaries executable in the packaged payload. find %{buildroot}%{_datadir}/%{app_name}/node_modules/.bin -maxdepth 1 -type f -exec chmod 0750 {} + 2>/dev/null || true find %{buildroot}%{_datadir}/%{app_name}/node_modules -type f -path "*/@esbuild/*/bin/esbuild" -exec chmod 0750 {} + 2>/dev/null || true find %{buildroot}%{_datadir}/%{app_name}/node_modules/convex/bin -maxdepth 1 -type f -exec chmod 0750 {} + 2>/dev/null || true # Match the permissions that %post enforces on targets reached through # node_modules/.bin symlinks so a normal install does not create RPM drift. for bin_entry in %{buildroot}%{_datadir}/%{app_name}/node_modules/.bin/*; do [ -L "$bin_entry" ] || continue target=$(readlink -f "$bin_entry" 2>/dev/null || true) case "$target" in %{buildroot}%{_datadir}/%{app_name}/node_modules/*) [ -f "$target" ] && chmod 0750 "$target" ;; esac done # Install nginx template install -d %{buildroot}%{_datadir}/%{app_name}/nginx install -m 0644 nginx/repogoon.conf.template %{buildroot}%{_datadir}/%{app_name}/nginx/ # Install configuration file (as default template) install -m 0640 config.yml %{buildroot}%{_sysconfdir}/%{app_name}/config.yml.default # Use the FHS data directory for packaged SQLite deployments. sed -i 's#\./server/db/repogoon\.db#/var/lib/%{app_name}/repogoon.db#' \ %{buildroot}%{_sysconfdir}/%{app_name}/config.yml.default # Only create config.yml if it doesn't exist (handled in %post) # Install CLI tool install -m 0755 rgoon-ctl %{buildroot}%{_bindir}/rgoon-ctl install -m 0755 rgoon-web-installer %{buildroot}%{_bindir}/rgoon-web-installer install -d %{buildroot}%{_datadir}/%{app_name}/installer install -m 0644 installer/index.html %{buildroot}%{_datadir}/%{app_name}/installer/index.html install -d %{buildroot}%{_libexecdir} install -m 0755 packaging/repogoon-update-channel %{buildroot}%{_libexecdir}/repogoon-update-channel install -m 0755 packaging/repogoon-update-channel-worker %{buildroot}%{_libexecdir}/repogoon-update-channel-worker install -m 0755 packaging/repogoon-launcher %{buildroot}%{_libexecdir}/repogoon-launcher install -d %{buildroot}%{_sysconfdir}/sudoers.d install -m 0440 packaging/repogoon-update-channel.sudoers %{buildroot}%{_sysconfdir}/sudoers.d/repogoon-update-channel # Install man page install -d %{buildroot}%{_mandir}/man1 install -m 0644 man/rgoon-ctl.1 %{buildroot}%{_mandir}/man1/rgoon-ctl.1 # Install generated command metadata and shell completion from one manifest. install -m 0644 share/rgoon-ctl-command-manifest.json \ %{buildroot}%{_datadir}/%{app_name}/rgoon-ctl-command-manifest.json install -d %{buildroot}%{_datadir}/bash-completion/completions install -m 0644 completions/rgoon-ctl.bash \ %{buildroot}%{_datadir}/bash-completion/completions/rgoon-ctl install -d %{buildroot}%{_datadir}/zsh/site-functions install -m 0644 completions/_rgoon-ctl \ %{buildroot}%{_datadir}/zsh/site-functions/_rgoon-ctl install -d %{buildroot}%{_datadir}/fish/vendor_completions.d install -m 0644 completions/rgoon-ctl.fish \ %{buildroot}%{_datadir}/fish/vendor_completions.d/rgoon-ctl.fish # Create symlinks for data directories ln -sfn ../../../var/lib/%{app_name}/repos %{buildroot}%{_datadir}/%{app_name}/repos install -d %{buildroot}%{_datadir}/%{app_name}/public ln -sfn ../../../../var/lib/%{app_name}/avatars %{buildroot}%{_datadir}/%{app_name}/public/avatars # Install systemd service file install -d %{buildroot}/usr/lib/systemd/system install -m 0644 repogoon.service %{buildroot}/usr/lib/systemd/system/repogoon.service install -m 0644 repogoon-update-channel@.service %{buildroot}/usr/lib/systemd/system/repogoon-update-channel@.service # Create environment file template cat > %{buildroot}%{_sysconfdir}/%{app_name}/environment << 'EOF' # RepoGoon environment variables # Uncomment and modify as needed # NODE_ENV=production # REPOGOON_CONFIG=/etc/repogoon/config.yml EOF %pre # Create repogoon user and group getent group repogoon >/dev/null || groupadd -r repogoon getent passwd repogoon >/dev/null || \ useradd -r -g repogoon -d %{_localstatedir}/lib/%{app_name} \ -s /sbin/nologin -c "RepoGoon service account" repogoon # Create backup before upgrade if [ $1 -ge 2 ]; then BACKUP_DIR=%{_localstatedir}/lib/%{app_name}/backup BACKUP_NAME="$(date +%%Y%%m%%d-%%H%%M%%S)-repogoon_backup" BACKUP_PATH="$BACKUP_DIR/$BACKUP_NAME" # Ensure backup directory exists mkdir -p "$BACKUP_DIR" mkdir -p "$BACKUP_PATH" echo "Creating pre-upgrade backup at $BACKUP_PATH..." # Backup application files if [ -d %{_datadir}/%{app_name} ]; then cp -a %{_datadir}/%{app_name} "$BACKUP_PATH/app" 2>/dev/null || true fi # Backup data (repos, avatars) - exclude the backup dir itself if [ -d %{_localstatedir}/lib/%{app_name} ]; then mkdir -p "$BACKUP_PATH/data" for item in repos avatars branding; do if [ -d "%{_localstatedir}/lib/%{app_name}/$item" ]; then cp -a "%{_localstatedir}/lib/%{app_name}/$item" "$BACKUP_PATH/data/" 2>/dev/null || true fi done fi # Set ownership chown -R repogoon:repogoon "$BACKUP_PATH" 2>/dev/null || true echo "Backup completed: $BACKUP_PATH" fi exit 0 %post %systemd_post repogoon.service # Config file handling CONFIG_FILE=%{_sysconfdir}/%{app_name}/config.yml DEFAULT_CONFIG=%{_sysconfdir}/%{app_name}/config.yml.default detect_reverse_proxy() { # Detect common reverse proxy setups that forward traffic to local upstreams. # Returns 0 when likely behind a proxy, 1 otherwise. if [ -d /etc/nginx ] && grep -RqsE \ '(proxy_set_header[[:space:]]+X-Forwarded-(For|Proto)|proxy_pass[[:space:]]+http://(127\.0\.0\.1|localhost|0\.0\.0\.0))' \ /etc/nginx 2>/dev/null; then return 0 fi if [ -d /etc/httpd ] && grep -RqsE \ '(ProxyPass|RequestHeader[[:space:]]+set[[:space:]]+X-Forwarded-(For|Proto))' \ /etc/httpd 2>/dev/null; then return 0 fi if [ -d /etc/apache2 ] && grep -RqsE \ '(ProxyPass|RequestHeader[[:space:]]+set[[:space:]]+X-Forwarded-(For|Proto))' \ /etc/apache2 2>/dev/null; then return 0 fi return 1 } get_trust_proxy_value() { local file="$1" if command -v yq >/dev/null 2>&1; then yq '.server.trustProxy' "$file" 2>/dev/null | sed 's/^"//' | sed 's/"$//' else grep -E '^[[:space:]]*trustProxy:' "$file" 2>/dev/null | head -1 | awk -F: '{print $2}' | xargs fi } set_trust_proxy_true() { local file="$1" if command -v yq >/dev/null 2>&1; then yq -i '.server.trustProxy = true' "$file" else if grep -qE '^[[:space:]]*trustProxy:' "$file"; then sed -i 's/^\([[:space:]]*trustProxy:[[:space:]]*\).*/\1true/' "$file" else sed -i '/^[[:space:]]*server:[[:space:]]*$/a\ trustProxy: true' "$file" fi fi } ensure_esbuild_executable() { local app_dir="%{_datadir}/%{app_name}" local esbuild_bins if [ ! -d "$app_dir/node_modules" ]; then return 0 fi esbuild_bins=$(find "$app_dir/node_modules" -type f -path "*/@esbuild/*/bin/esbuild" 2>/dev/null || true) if [ -z "$esbuild_bins" ]; then return 0 fi for esbuild_bin in $esbuild_bins; do chown root:repogoon "$esbuild_bin" 2>/dev/null || true chmod 0750 "$esbuild_bin" 2>/dev/null || true done } ensure_node_bin_targets_executable() { local app_dir="%{_datadir}/%{app_name}" local bin_dir="$app_dir/node_modules/.bin" local bin_entry local target if [ ! -d "$bin_dir" ]; then return 0 fi find "$bin_dir" -maxdepth 1 -mindepth 1 \( -type f -o -type l \) 2>/dev/null | while IFS= read -r bin_entry; do if [ -f "$bin_entry" ]; then chown root:repogoon "$bin_entry" 2>/dev/null || true chmod 0750 "$bin_entry" 2>/dev/null || true fi target=$(readlink -f "$bin_entry" 2>/dev/null || true) case "$target" in "$app_dir"/node_modules/*) if [ -f "$target" ]; then chown root:repogoon "$target" 2>/dev/null || true chmod 0750 "$target" 2>/dev/null || true fi ;; esac done } ensure_runtime_storage_permissions() { install -d -o repogoon -g repogoon -m 0750 %{_localstatedir}/lib/%{app_name} install -d -o repogoon -g repogoon -m 0750 %{_localstatedir}/lib/%{app_name}/repos install -d -o repogoon -g repogoon -m 0750 %{_localstatedir}/lib/%{app_name}/avatars install -d -o repogoon -g repogoon -m 0750 %{_localstatedir}/lib/%{app_name}/backup install -d -o repogoon -g repogoon -m 0750 %{_localstatedir}/lib/%{app_name}/branding install -d -o repogoon -g repogoon -m 0750 %{_localstatedir}/lib/%{app_name}/ssh install -d -o repogoon -g repogoon -m 0750 %{_localstatedir}/log/%{app_name} if [ -e %{_localstatedir}/lib/%{app_name}/repogoon.db ]; then chown repogoon:repogoon %{_localstatedir}/lib/%{app_name}/repogoon.db 2>/dev/null || true chmod 0640 %{_localstatedir}/lib/%{app_name}/repogoon.db 2>/dev/null || true fi for sqlite_sidecar in %{_localstatedir}/lib/%{app_name}/repogoon.db-wal %{_localstatedir}/lib/%{app_name}/repogoon.db-shm; do if [ -e "$sqlite_sidecar" ]; then chown repogoon:repogoon "$sqlite_sidecar" 2>/dev/null || true chmod 0640 "$sqlite_sidecar" 2>/dev/null || true fi done } if [ $1 -eq 1 ]; then # First install - copy default config if [ ! -f "$CONFIG_FILE" ]; then cp "$DEFAULT_CONFIG" "$CONFIG_FILE" chown repogoon:repogoon "$CONFIG_FILE" chmod 0640 "$CONFIG_FILE" fi echo "" echo "==========================================" echo " RepoGoon installed successfully!" echo "==========================================" echo "" echo "Next steps:" echo " 1. Configure: sudo rgoon-ctl --setup" echo " 2. Start: sudo systemctl start repogoon" echo " 3. Enable on boot: sudo systemctl enable repogoon" echo "" echo "Configuration: /etc/repogoon/config.yml" echo "Data directory: /var/lib/repogoon" echo "Logs: journalctl -u repogoon" echo "" elif [ $1 -ge 2 ]; then # Upgrade - merge new options into existing config if [ -f "$CONFIG_FILE" ] && [ -f "$DEFAULT_CONFIG" ]; then # Check if yq is available for smart merging if command -v yq &> /dev/null; then # Create backup # cp "$CONFIG_FILE" "$CONFIG_FILE.bak.$(date +%%Y%%m%%d%%H%%M%%S)" # Config is already backed up in %pre to /var/lib/repogoon/backup/ # Merge: default config provides new keys, existing config provides values # This adds any new keys from default while preserving user's existing values # Note: We strip comments from the existing config before merge to prevent # yq from duplicating header comments with each upgrade TEMP_CONFIG=$(mktemp) TEMP_EXISTING=$(mktemp) yq '... comments=""' "$CONFIG_FILE" > "$TEMP_EXISTING" 2>/dev/null yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' "$DEFAULT_CONFIG" "$TEMP_EXISTING" > "$TEMP_CONFIG" 2>/dev/null if [ $? -eq 0 ] && [ -s "$TEMP_CONFIG" ]; then cat "$TEMP_CONFIG" > "$CONFIG_FILE" echo "Config updated: new options merged, existing values preserved" else echo "Config merge skipped: check $DEFAULT_CONFIG for new options" fi rm -f "$TEMP_CONFIG" "$TEMP_EXISTING" else # yq not available - notify user to check for new options echo "" echo "NOTE: New configuration options may be available." echo "Compare your config with: $DEFAULT_CONFIG" echo "Or install 'yq' for automatic config merging on future updates." echo "" fi fi # Upgrade safety check: detect reverse proxy deployments and ensure trustProxy is enabled. if [ -f "$CONFIG_FILE" ]; then TRUST_PROXY_VALUE="$(get_trust_proxy_value "$CONFIG_FILE")" case "$TRUST_PROXY_VALUE" in true|True|TRUE|1) TRUST_PROXY_ENABLED=1 ;; *) TRUST_PROXY_ENABLED=0 ;; esac if detect_reverse_proxy; then if [ "$TRUST_PROXY_ENABLED" -eq 0 ]; then if set_trust_proxy_true "$CONFIG_FILE"; then chown repogoon:repogoon "$CONFIG_FILE" 2>/dev/null || true chmod 0640 "$CONFIG_FILE" 2>/dev/null || true echo "Detected reverse proxy configuration; set server.trustProxy=true in $CONFIG_FILE" else echo "WARNING: Reverse proxy detected but failed to set server.trustProxy=true automatically." echo "Please set server.trustProxy=true in $CONFIG_FILE" fi fi fi fi fi # Ensure tsx/esbuild runtime binaries are executable on install and upgrade. ensure_runtime_storage_permissions ensure_esbuild_executable ensure_node_bin_targets_executable %preun if ! rpm -q %{alternate_package} >/dev/null 2>&1; then %systemd_preun repogoon.service fi %postun if ! rpm -q %{alternate_package} >/dev/null 2>&1; then %systemd_postun_with_restart repogoon.service fi # Keep the persistent service account on uninstall. Its numeric ownership can # remain on repositories, backups, configuration, and other administrator data. %files %license LICENSE %doc README.md # Application %defattr(0640,root,repogoon,0750) %dir %{_datadir}/%{app_name} %{_datadir}/%{app_name}/server %{_datadir}/%{app_name}/dist %{_datadir}/%{app_name}/node_modules %{_datadir}/%{app_name}/package.json %{_datadir}/%{app_name}/nginx %{_datadir}/%{app_name}/installer %{_datadir}/%{app_name}/repos %{_datadir}/%{app_name}/public %{_datadir}/%{app_name}/convex %{_datadir}/%{app_name}/config %attr(0644,root,root) %{_datadir}/%{app_name}/rgoon-ctl-command-manifest.json # CLI tool %attr(0755,root,root) %{_bindir}/rgoon-ctl %attr(0755,root,root) %{_bindir}/rgoon-web-installer %attr(0755,root,root) %{_libexecdir}/repogoon-update-channel %attr(0755,root,root) %{_libexecdir}/repogoon-update-channel-worker %attr(0755,root,root) %{_libexecdir}/repogoon-launcher %attr(0644,root,root) %{_mandir}/man1/rgoon-ctl.1* %attr(0644,root,root) %{_datadir}/bash-completion/completions/rgoon-ctl %attr(0644,root,root) %{_datadir}/zsh/site-functions/_rgoon-ctl %attr(0644,root,root) %{_datadir}/fish/vendor_completions.d/rgoon-ctl.fish # Configuration %dir %attr(0750,root,repogoon) %{_sysconfdir}/%{app_name} %config(noreplace) %attr(0640,root,repogoon) %{_sysconfdir}/%{app_name}/config.yml.default %ghost %config(noreplace) %attr(0640,root,repogoon) %{_sysconfdir}/%{app_name}/config.yml %config(noreplace) %attr(0640,root,repogoon) %{_sysconfdir}/%{app_name}/environment %config(noreplace) %attr(0440,root,root) %{_sysconfdir}/sudoers.d/repogoon-update-channel # Systemd /usr/lib/systemd/system/repogoon.service /usr/lib/systemd/system/repogoon-update-channel@.service # Data directories %dir %attr(0750,repogoon,repogoon) %{_localstatedir}/lib/%{app_name} %dir %attr(0750,repogoon,repogoon) %{_localstatedir}/lib/%{app_name}/repos %dir %attr(0750,repogoon,repogoon) %{_localstatedir}/lib/%{app_name}/avatars %dir %attr(0750,repogoon,repogoon) %{_localstatedir}/lib/%{app_name}/backup %dir %attr(0750,repogoon,repogoon) %{_localstatedir}/log/%{app_name} %changelog * Mon Aug 24 2026 BurningPho3nix - 0.13.1-20260824 - Honor the configured HTTP bind address instead of listening on every interface. - Fix namespaced repository-hook and rootless Podman analysis probes. - Preserve managed hook ownership and eliminate expected post-install RPM drift. - Keep Convex deployments from rewriting packaged generated client files. - Refresh both receive hooks and prefer the current configured pipeline-hook secret. * Sun Aug 23 2026 BurningPho3nix - 0.13.0-20260823_rc12 - Restored the framed, aligned, color-aware rgoon-ctl doctor presentation while retaining structured health collection and exit behavior. - Simplified default doctor output by hiding diagnostic IDs and package names and formatting dated preview and stable versions for operators. - Preserved complete raw package, version, and stable check-ID data in JSON output and generalized packaging tests for future stable and preview releases. * Sun Aug 23 2026 BurningPho3nix - 0.13.0-20260823_rc11 - Fixed first-time systemd secret migration to activate database-format metadata from the verified staged generation before service restart. - Restored the target backend's prior activation state during rollback and removed failed generations to prevent stale drop-ins, selectors, and generation collisions. - Added regression coverage for staged metadata reads and complete fresh, cross-backend, and same-backend rollback cleanup. * Sat Aug 22 2026 BurningPho3nix - 0.13.0-20260822_rc10 - Generated rgoon-ctl help, man, Bash, Zsh, Fish, operator documentation, and package manifest from shared typed command metadata for the preview RPM. - Installed public CLI artifacts as mode 0644 root:root and documented preview-only deployment and rollback. - Fixed staged systemd credential verification and reads to decrypt with the embedded logical credential name. - Added the shared operations report, environment, bounded-command, redaction, and rendering framework. - Added structured version, doctor, and component reports for RPM, source, and container installations. - Added causal instance analysis with the complete stable finding catalog, offline-safe collectors, and JSON output. - Added the allowlisted analyze repair engine with confirmation, locking, rollback, and post-verification. - Integrated analyzer evidence with real rgoon-sync status and rgoon-runner YAML state contracts. - Added bounded redacted logs and mode-0600 support bundles for RPM, source, and container installations. - Added backend-aware backup listing, verification, paired retention, and transactional restore preflight. - Switched bounded operations network probes to resumable, retrying wget2 transport. - Added canonical configuration diff and validated dry-run/apply editing, and removed Shoo integration. - Added same-channel update checks and backup-first privileged apply with bounded status, health verification, and rollback handoff. - Exposed the stable `RepoGoon` software identity alongside the version from the unauthenticated `/api/version` endpoint. - Removed nonessential generated source documents and their stale preview-RPM and test references after moving durable operator guidance to the wiki. * Fri Aug 14 2026 BurningPho3nix - 0.13.0-20260814_rc9 - Finalized the coordinated encrypted-secret release and rgoon-sync administration bridge. - Set zero service/container core limits and service memory-map filters, and rejected unsafe Node debugging, heap-snapshot, and diagnostic-report flags. - Added metadata-only runtime hardening diagnostics with accurate userspace coredump-handler risk reporting. - Removed plaintext configuration copying from RPM pre-upgrade backups and added isolated upgrade and rollback guidance. - Added a Fedora/systemd crash-canary check that scans coredump, journal, working-directory, and diagnostic artifacts. - Updated release packaging, dependency security fixes, exact-coverage validation, and the manual rollout handoff. - Added the canonical deployment-secret registry, strict backend-neutral secret references, and registry-driven redaction. - Added validated non-secret storage configuration and conditional credential requirements for supported database and authentication modes. - Packaged the secret registry for runtime consumers and expanded security regression coverage. - Added protected-file and systemd encrypted-credential stores with immutable generations and atomic activation. - Added globally ordered host locking, database-time lease fencing, crash-safe transaction journals, deterministic rollback, and metadata-only secret diagnostics. - Added transactional `rgoon-ctl secrets` migration, status, list, stdin-only update, doctor, dry-run, and generation garbage-collection commands with stable exit classes. - Added the strict `enc:v2` application-encryption core with independent 64-byte data keys, purpose-bound HKDF-SHA-512/AES-256-GCM, canonical parsing, format markers, and published test vectors. - Integrated the independent application keyring at startup and enforced purpose-bound `enc:v2` encryption for CI and webhook secrets across SQLite, PostgreSQL, MySQL, Oracle, and Convex. - Added journaled data-key rotation and retirement commands with bounded scans, compare-and-swap rewrites, database-time lease fencing, resumability, format compatibility checks, and zero-reference verification. - Expanded encryption, startup, and database-adapter coverage and stabilized asynchronous pull-request and Git-backend regression tests under the normal parallel test suite. - Added required Secret Storage selection, exact systemd capability diagnostics, redacted existing-secret confirmation, exact-value session/internal migration, and transactional stdin-only provisioning to the CLI and graphical installers. - Added guarded fresh-install bootstrap transactions, aggregate-only authenticated web metadata, stdin-only administrator creation, and browser/argv leak regression coverage. - Added first-party Compose secret mounts and container file-store bootstrap with immutable references, ownership-preserving atomic configuration replacement, fixed runtime ownership, no systemd emulation, and no plaintext configuration fallback. - Added offline X25519 recovery-key enrollment, Ed25519-signed canonical JOSE recovery bundles using ECDH-ES+A256KW and A256GCM, strict expiry/source/generation validation, and stdin-only recovery commands. - Added non-activating recovery verification, atomic clean-host secret rewrapping with replacement signing keys, and end-to-end restoration of application `enc:v2` data without the original host store. - Added public-key-only terminal and graphical recovery setup, separate mode-protected recovery artifacts for backups, restore gating that leaves the service stopped on recovery failure, and recovery ceremony documentation and tests. - Added backend-neutral secret snapshot export/import administration for recipient-specific rgoon-sync replication. - Added stdin-only replication bridge commands, runtime wiring, atomic tombstone handling, and data-key retirement integration. - Stabilized full-parallel frontend migration and repository-settings tests and restored exact 100 percent coverage across all four metrics. - Updated the transitive nanoid dependency to resolve its zero-size custom-generator denial-of-service advisory. * Wed Aug 05 2026 BurningPho3nix - 0.13.0-20260805_rc8 - Added migration preflight inspection, reconciliation reporting, and safe retry support for failed imports. - Added encrypted CI secrets with protected-branch controls and log masking. - Added pipeline artifacts and shared job caches across SQL and Convex backends. * Tue Aug 04 2026 BurningPho3nix - 0.13.0-20260804_rc7 - Added a dedicated RepoGoon favicon and synchronized the browser title and favicon with instance branding. - Improved pipeline status readability with distinct success and failure icon colors. * Mon Aug 03 2026 BurningPho3nix - 0.13.0-20260803_rc6 - Improved pipeline status feedback and made job logs responsive, expandable, and easier to scroll. - Fixed activity-feed fallback keys so they cannot collide with persisted activity IDs. - Expanded coverage for configuration, release reconciliation, SSH policy, and path-verification scripts. - Updated DOMPurify, JOSE, tsx, globals, and TypeScript ESLint dependencies. - Applied consistent Prettier formatting across frontend, server, and Convex sources. * Sun Aug 02 2026 BurningPho3nix - 0.13.0-20260802_rc5 - Fixed preview RPM startup failures by forcing better-sqlite3 to compile from source. - Added final package-build checks that reject missing or unloadable SQLite native addons. * Sat Aug 01 2026 BurningPho3nix - 0.13.0-20260801_rc4 - Added an optional post-creation repository setup flow for README, CI, and bundled license templates. - Expanded frontend browser coverage and improved testability across repository, issue, administration, authentication, and shared UI views. - Improved repository overview navigation and tab transitions, including clone, commit, file, and wiki interactions. - Added configurable runner labels to runner registration commands in the administration interface. - Updated runtime and development dependencies, including the jsdom 30 test environment and security-patched transitive packages. * Sat Jul 25 2026 BurningPho3nix - 0.13.0-20260725_rc3 - Refreshed the RC3 preview package release metadata for the July 25 build. * Sat Jul 25 2026 BurningPho3nix - 0.12.20-20260725 - Released the stable-channel package with hardened service-account and systemd handling during channel switches. * Fri Jul 24 2026 BurningPho3nix - 0.13.0-20260724_rc3 - Fixed stable/preview swaps deleting the shared service account and disabling the replacement service. - Kept both channel packages on the canonical /usr/share, /etc, and /var RepoGoon paths. - Preserved the service account after package removal so persistent data retains a valid owner. * Fri Jul 24 2026 BurningPho3nix - 0.12.19-20260724_1 - Fixed stable/preview swaps deleting the shared service account and disabling the replacement service. - Preserved the service account after package removal so persistent data retains a valid owner. * Fri Jul 24 2026 BurningPho3nix - 0.12.19-20260724 - Moved package channel swaps into a dedicated root systemd worker outside the hardened RepoGoon service context. - Added packaging and API regression coverage for stable/preview channel switches. * Thu Jul 23 2026 BurningPho3nix - 0.13.0-20260723_rc2 - Added continuous integration pipelines and runners with repository hooks, pipeline APIs, administrative controls, and database-backed storage. - Added a standalone graphical web installer with one-line launch documentation, certificate validation, Enterprise Linux Certbot setup, and refined S3 handling. - Added update-channel management with installed RPM detection, automatic or manual switching, a privileged helper, and admin-interface feedback. - Moved package channel swaps into a dedicated root systemd worker outside the hardened RepoGoon service context. - Added multi-database backup support, including configurable Oracle Data Pump exports, CLI integration, documentation, and error handling. - Fixed Shoo audience validation and CSP frame sources for browser authentication flows. - Improved repository cleanup and multi-architecture container build and publishing configuration. - Restored and expanded unit coverage for the new installer, CI, backup, authentication, repository, and update-channel functionality. * Tue Jul 21 2026 BurningPho3nix - 0.12.18-20260721 - Added update-channel management with installed RPM detection and automatic or manual channel switching from the admin interface. - Added the privileged update-channel helper, sudo policy, required package dependencies, and hardened service configuration. - Improved package-conflict, missing-RPM, and channel-availability handling and feedback. - Expanded unit coverage for the update-channel routes and server startup behavior. - Updated runtime and development dependencies, including better-sqlite3 13, and resolved all reported npm audit advisories. * Sun Jul 12 2026 BurningPho3nix - 0.12.17-20260712 - Added multi-file repository uploads from the file browser, including branch, path, commit-message, filename, file-count, and file-size handling. - Added atomic multi-file Git commits while retaining the existing single-file write interface. - Updated runtime and development dependencies, build-script allowlists, TypeScript tooling, and package lock data. - Updated YAML loading for the current js-yaml module interface. - Expanded unit coverage across authentication, authorization, middleware, routes, Git utilities, repository services, database migrations, and all supported database drivers. - Hardened and clarified covered edge cases across repository access, clone URLs, release assets, rate limiting, token authentication, OIDC redirects, and database operations. * Fri Jun 05 2026 BurningPho3nix - 0.12.16-20260605 - Fixed Shoo callback handling so consumed PKCE state is not retried after login or 2FA. - Redirected completed Shoo login flows away from /shoo/callback to avoid stale callback errors. * Wed Jun 03 2026 BurningPho3nix - 0.12.15-20260603 - Replaced the Shoo browser callback flow with the supported PKCE client. - Kept Shoo account linking state outside the callback redirect URI so token exchange uses a stable /shoo/callback URL. - Continued hiding Shoo login controls unless Shoo authentication is enabled in instance config. * Wed Jun 03 2026 BurningPho3nix - 0.12.14-20260603 - Fixed Shoo account linking redirects so signed-in local users remain in link mode after the Shoo callback. - Prevented duplicate Shoo callback token submissions during account linking. - Used a build-local npm version during RPM builds so rpmbuild does not require root privileges. * Wed Jun 03 2026 BurningPho3nix - 0.12.13-20260603 - Fixed Shoo account linking callback handling for already authenticated users. * Wed Jun 03 2026 BurningPho3nix - 0.12.12-20260603 - Added Shoo account linking so users can sign in with either Shoo or local credentials. * Wed Jun 03 2026 BurningPho3nix - 0.12.11-20260603 - Fixed Convex instance settings validation for empty legal URL fields. * Tue Jun 02 2026 BurningPho3nix - 0.12.10-20260602 - Fixed direct refreshes of repository file viewer URLs when file names include extensions such as docker-compose.yml. - Preserved static asset 404 behavior while allowing /repo routes to fall back to the React SPA shell. - Added regression coverage for dotted repository file paths in the production SPA fallback. * Mon Jun 01 2026 BurningPho3nix - 0.12.9-20260601 - Added container-aware rgoon-ctl service handling for start, stop, restart, status, and doctor commands. - Improved container builds with sqlite and explicit REPOGOON_CONTAINER detection. - Added optional nginx reverse proxy and self-hosted Convex examples to docker-compose.yml. - Aligned CSRF cookies, HSTS, and CSP upgrade handling with secure session configuration. - Served built SPA assets whenever a packaged dist build is present. - Added container smoke coverage and updated documentation for in-container service status. * Thu May 28 2026 BurningPho3nix - 0.12.8-20260528 - Added jsonBodyLimit configuration for API request body size management. - Updated CI Node.js version from 20 to 24. * Wed May 27 2026 BurningPho3nix - 0.12.7-20260527 - Fixed Git smart HTTP clone/fetch handling by forwarding CGI content metadata and HTTP headers, including gzip-encoded upload-pack requests. - Hardened Git HTTP response streaming with safer CGI header parsing, backpressure handling, and child process cleanup on aborts or backend errors. - Fixed footer fetch cleanup warnings by aborting outstanding requests on unmount. - Prevented duplicate process error handlers during repeated server imports. - Updated rgoon-ctl doctor to avoid sudo for update checks so health checks do not hang in non-interactive environments. * Tue May 26 2026 BurningPho3nix - 0.12.6-20260526 - fixing rgoon-ctl doctor db connection problem * Mon May 25 2026 BurningPho3nix - 0.12.6-20260525 - dependency updates - change in commiter displayed * Thu Apr 16 2026 BurningPho3nix - 0.12.5-20260416 - Fixed personal access token deletion in the web settings UI when token records expose mixed id and _id fields. - Improved cross-backend token identifier handling for SQL and Convex-backed token deletion flows. - Updated frontend, backend, and tooling dependencies including React 19.2.5, react-router-dom 7.14.1, marked 18, and TypeScript 6. - Migrated TypeScript path alias configuration away from deprecated baseUrl handling for TypeScript 6 compatibility. - Reworked markdown preview and code viewer HTML rendering to avoid dangerouslySetInnerHTML and satisfy the updated ESLint React rules. * Tue Apr 07 2026 BurningPho3nix - 0.12.4-20260407 - Added wiki repository creation to the repository route - Refactored token response handling and improved the settings component - Removed FEATURES.md as part of the documentation restructuring * Thu Apr 02 2026 BurningPho3nix - 0.12.3-20260402 - Fixed public user profile repository listings for anonymous visitors so profile pages show the same public repositories as Discover. * Sun Mar 29 2026 BurningPho3nix - 0.12.2-20260329 - Added legal URL instance settings for terms, privacy, and impressum links across the schema, API, admin UI, and footer/legal page flow. - Extended database schema and initialization coverage for the new instance settings fields across supported drivers. - Refactored ESLint and React linting setup, refreshed frontend dependencies, and added web manifest/service worker assets for improved PWA support. - Updated RPM release metadata for version 0.12.2. * Mon Mar 16 2026 BurningPho3nix - 0.12.1-20260316 - Refactored instance settings normalization in database and SQLite driver. - Enhanced branding integration across application. - Updated version to 0.12.1 in package.json, package-lock.json, and RPM spec file. - Enhanced Content Security Policy in securityHeaders middleware. * Fri Mar 13 2026 BurningPho3nix - 0.12.0-20260313 - Added end-to-end Git-over-SSH support with embedded SSH transport. - Added SSH key management plus SSH runtime/admin controls and diagnostics. - Added transactional `rgoon-ctl ssh-apply` host-policy cutover support. - Expanded `rgoon-ctl` config coverage across advanced auth, storage, SSH, network, and Convex settings. - Added structured `rgoon-ctl set --json` and `show --json` support via the shared YAML config helper. - Added setup smoke tests for auto-generated config defaults and fixed `session.secure` persistence during setup. - Updated coverage documentation and packaging metadata for the current 0.12.0 release state. * Wed Mar 11 2026 BurningPho3nix - 0.11.13-20260311 - Allowed Shoo authentication assets and network flows in the default Content Security Policy when Shoo auth is enabled. - Added RPM changelog coverage for the Shoo CSP fix so packaged deployments reflect the login compatibility update. * Wed Mar 11 2026 BurningPho3nix - 0.11.12-20260311 - Added optional Shoo authentication support end-to-end: config defaults, provider discovery, JWT verification, login callback UI, auto-provisioned users, disabled-account blocking, and force-2FA handling. - Simplified auth 2FA status checks and added dedicated rate limiting for the Shoo login flow. - Hardened Git and migration routes by expanding path traversal detection on Smart HTTP requests and improving DNS/SSRF validation during repository migrations. - Improved wiki edits/deletes to preserve the acting username in Git push context and fixed related wiki route handling. - Refactored database/admin CLI scripts to export testable entrypoints, return exit codes instead of exiting inline, and improve migration and wipe-db error handling. - Updated RPM metadata for 0.11.12 and commented out explicit `nodejs-npm` build/runtime dependencies. - Greatly expanded automated test coverage and coverage tooling across auth, migrations, server startup, Git/wiki routes, releases, repositories, database drivers, and CLI scripts. * Fri Feb 27 2026 BurningPho3nix - 0.11.11-20260227 - Fixed release tag creation by setting explicit Git tagger author/committer identity in service config. - Made release archive generation fail-open and returned structured warnings instead of failing release operations. - Exposed releases even when Git tags are missing and marked them with a tag_missing state in API/UI. - Added `rgoon-ctl reconcile-releases` with dry-run and optional apply/repair flags for release/tag drift. - Kept RPM packaging hardening: local `.env` exclusion from payload and release archive packaging safeguards. * Thu Feb 19 2026 BurningPho3nix - 0.11.10-20260219 - Bumped version to 0.11.10. - Switched release tag handling to use Git tags as the source of truth. - Synced release create/update/publish/delete flows with Git tag lifecycle operations. - Auto-generate source archives (.tar.gz and .zip) for published releases and attach them as release assets. * Thu Feb 12 2026 BurningPho3nix - 0.11.9-20260212 - Forced clean build by excluding dist and node_modules from source tarball. - Verified debug logging presence in git utility. * Thu Feb 12 2026 BurningPho3nix - 0.11.8-20260212 - Added debug logging to git listRepoContents to investigate path duplication issue. * Thu Feb 12 2026 BurningPho3nix - 0.11.7-20260212 - Fixed file browser path duplication issue in web interface. - Updated git ls-tree output parsing to correctly handle full relative paths. * Thu Feb 12 2026 BurningPho3nix - 0.11.6-20260212 - Fixed "dubious ownership" errors in git operations by enforcing safe.directory=* for all git commands. - Ensures compatibility when service user (repogoon) accesses repositories with strict ownership checks. * Thu Feb 12 2026 BurningPho3nix - 0.11.5-20260212 - Fixed ENOENT errors for public directory access in production. - Updated path resolution to correctly identify public directory location in RPM installs. * Thu Feb 12 2026 BurningPho3nix - 0.11.4-20260212 - Fixed MODULE_NOT_FOUND errors in production by using absolute path resolution. - Added paths.ts utility for robust dev/prod directory detection. - Fixed hook installation path resolution in production environments. * Thu Feb 12 2026 BurningPho3nix - 0.11.3-20260212 - Fixed RPM build to compile both frontend and server artifacts via `npm run build:all`. - Ensures `dist/server/index.js` is included for `systemd` startup with `node dist/server/index.js`. * Thu Feb 12 2026 BurningPho3nix - 0.11.2-20260212 - Added middleware test coverage for disabled-account checks across session and token authentication paths. - Improved middleware integration test reliability for async auth/scope flow execution. - Updated project dependencies to newer patch releases, including AWS SDK S3 client, TypeScript toolchain, and runtime libraries. * Tue Feb 10 2026 BurningPho3nix - 0.11.1-20260210 - Fixed production startup failure where tsx could not execute @esbuild/*/bin/esbuild (EACCES). - Added explicit executable file permissions for node_modules/@esbuild/*/bin/esbuild in RPM payload. - Added install/upgrade %post remediation to enforce root:repogoon ownership and 0750 mode on esbuild binaries. - Fixed Convex CLI execution failures where node_modules/.bin/convex symlink target lacked execute permissions. - Added explicit executable file permissions for node_modules/convex/bin/* in RPM payload. - Added install/upgrade %post remediation for node_modules/.bin entries and resolved in-package targets. - Added config-first internal hook secret resolution with environment fallback for compatibility. - Added setup-time generation of server.internalSecret and a dedicated rgoon-ctl command to generate it when missing. * Tue Feb 10 2026 BurningPho3nix - 0.11.0-20260210 - Completed TypeScript rewrite/migration across server, frontend, routes, middleware, and database drivers. - Security hardening summary since TypeScript rewrite phase started: - Fixed multiple path traversal and arbitrary file access/write vectors in repository content, snippets, and release asset handling. - Replaced weak token/identifier randomness with cryptographic RNG in core token generation paths. - Strengthened SSRF defenses: - enforced URL validation for migration/webhook targets (protocol/host/private-IP/embedded-credential checks), - disabled redirect following on outbound webhook and migration API fetches. - Hardened authentication/session boundaries: - added session ID regeneration on login-equivalent flows (local, OIDC, 2FA completion, email verification), - enforced disabled-account checks in auth middleware, admin middleware, and token-authenticated API access paths, - enforced disabled-account checks in forced-2FA enrollment and 2FA login-completion flows, - aligned OIDC flow with force-2FA/disabled-account policy checks. - Closed route-level auth consistency gaps: - replaced custom avatar-route auth with shared `requireAuth` middleware so central account-status checks always apply, - fixed admin self-delete guard ID comparison to avoid type-mismatch bypass edge cases. - Mitigated OIDC access risks: - sanitized returnTo redirects to prevent open redirect abuse, - added pending OIDC state cap and cleanup safeguards. - Expanded auth abuse protection: - added rate limits for 2FA setup/verify-required, resend-verification, and OIDC login endpoints, - restricted API access until mandatory 2FA setup is completed. - Hardened deployment/network trust assumptions: - made trust proxy configurable (`server.trustProxy`) and enforced stricter production validation, - added strict CORS allowlist behavior with explicit credential safety checks, - added startup logging of effective API access policy. - RPM upgrade hardening: - detect common reverse-proxy deployments during package update and auto-enable `server.trustProxy` when appropriate. * Mon Feb 09 2026 BurningPho3nix - 0.10.6-20260209 - Fixed permission issues with node_modules/.bin/* - Fixed permission issues with rgoon-ctl * Mon Feb 09 2026 BurningPho3nix - 0.10.5-20260209 - Moved documentation (Roadmap, Contributing, Security Policy) to Wiki - Updated rgoon-ctl to set default API host to 127.0.0.1 for security - Added log file path verification to rgoon-ctl setup - Updated logging configuration defaults * Mon Feb 09 2026 BurningPho3nix - 0.10.4-20260209 - Fixed broken/incorrect wiki links in README.md - Fixed snippet clone URL generation to respect domain and SSL settings - Fixed release upload directory creation to be more robust (added error handling and existence check) - Ensured release upload directory exists on server start * Mon Feb 09 2026 BurningPho3nix - 0.10.3-20260209 - Fixed snippet creation failure in Convex driver by adding missing functions - Fixed regex validation error in repository settings (escaped hyphen) - Audited all database drivers for snippet function consistency * Mon Feb 09 2026 BurningPho3nix - 0.10.2-20260209 - Fixed 2FA session timeout issues (clock skew and missing method crash) - Added common password check to validation logic * Fri Feb 06 2026 BurningPho3nix - 0.10.1-20260206 - Fixed 410 Authentication errors during 2FA - Fixed 500 Registration error * Fri Feb 06 2026 BurningPho3nix - 0.10.0-20260206 - Added Releases feature for publishing versioned releases with assets - Added Snippets feature for sharing public code snippets - Updated in-repo documentation and wiki pages - Added a man page for rgoon-ctl * Tue Feb 03 2026 BurningPho3nix - 0.9.2-20260203 - Added TypeScript definition files for better type support (tsconfig.json) - Added express-session type definitions for enhanced session management - Refactored database driver selection for improved readability and maintainability - Updated validation middleware documentation for clarity - Removed unused password validation function from auth.js - Simplified error handling in Login component for better user experience * Tue Feb 03 2026 BurningPho3nix - 0.9.1-20260203 - Updated to version 0.9.1 - Fixed TypeError in request logger serializers (guard against undefined req/res objects) - Added null checks before accessing headers in logger serializers - Fixed logger serializer to use originalUrl if available * Mon Feb 02 2026 BurningPho3nix - 0.9.0-20260202 - Updated to version 0.9.0 * Fri Jan 30 2026 BurningPho3nix - 0.8.7-20260130 - Fixed wiki "require is not defined" error (added execFileSync to ES module imports) - Fixed CSRF middleware blocking internal API calls (pre-receive hook validation) * Thu Jan 29 2026 BurningPho3nix - 0.8.6-20260129 - SECURITY: Fixed command injection in Git operations (now uses execFile with parameterized args) - SECURITY: Fixed LDAP injection vulnerability (added RFC 4515 filter escaping) - SECURITY: Fixed missing authorization on comment deletion (added permission checks) - SECURITY: Fixed SSRF in repository migration (added URL validation and private IP blocking) - SECURITY: Strengthened password policy (10+ chars with complexity requirements) - SECURITY: Fixed LFS routes lacking authorization (added auth middleware and access checks) - SECURITY: Fixed missing authorization on issue close/reopen endpoints - SECURITY: Fixed path traversal via encoded characters (multi-decode and canonical path validation) - SECURITY: Fixed user ID disclosure in 2FA flow (now uses temporary pending tokens) - SECURITY: Added CSRF protection using Double Submit Cookie pattern - SECURITY: Added webhook secret encryption at rest (AES-256-GCM) - SECURITY: Added user-based rate limiting for authenticated requests - SECURITY: Added session secret validation (fails startup in production if weak) - SECURITY: Removed token scopes from error responses (prevents scope enumeration) - SECURITY: Added security headers (CSP, X-Frame-Options, HSTS, X-Content-Type-Options, etc.) - SECURITY: Sanitized verbose error messages in production environment - SECURITY: Fixed email enumeration (consistent response messages) - Added cookie-parser dependency for CSRF token handling - Added encryption utility module for sensitive data at rest - Removed unused shellEscape and execGitSync functions from git utilities * Thu Jan 22 2026 BurningPho3nix - 0.8.5-20260122 - Updated footer source link URL to repogoon.org for consistency - Improved Convex getAllUsers performance with concurrent user normalization (Promise.all) * Thu Jan 22 2026 BurningPho3nix - 0.8.4-20260122 - Added admin account disable/enable feature with dedicated `disabled` column - Added initial Let's Encrypt certificate creation to rgoon-ctl setup wizard - Fixed TypeError on /users page (added optional chaining for undefined fields) - Fixed similar potential crashes in Discovery and StarredRepos pages - Added `disabled` column migration for all database backends (SQLite, MySQL, PostgreSQL, Oracle, Convex) * Wed Jan 21 2026 BurningPho3nix - 0.8.3-20260121 - Added wiki routes to server index for public access without authentication - Streamlined documentation by consolidating DEPLOY.md into README.md - Added links to Wiki for detailed guides - Fixed wiki internal links navigating to wrong page (now uses React Router navigation) * Wed Jan 21 2026 BurningPho3nix - 0.8.2-20260121 - Added wiki clone URL display with copy-to-clipboard feature - Added auto-creation of wiki repository on first push - Fixed git initialization to use configured default branch (--initial-branch option) - Improved wiki routing and authorization checks * Wed Jan 21 2026 BurningPho3nix - 0.8.1-20260121 - Fixed Convex driver normalization for pull request functions (_id to id conversion) - Fixed missing await in triggerWebhooks causing "webhooks is not iterable" error - Fixed parseInt calls on Convex string IDs causing "Pull request not found" errors - Fixed avatar URL expansion for PR authors and comment authors in Convex driver - Fixed null/undefined handling for optional Convex parameters * Wed Jan 21 2026 BurningPho3nix - 0.8.0-20260121 - Added Issue and PR Templates: auto-loads from .repogoon/ or .github/ directories - Added Merge Strategies: support for squash and rebase merge options with UI dropdown - Added PR Diff Viewer: syntax-highlighted diff display with unified/split view toggle - Added Git-backed Wiki: per-repository wiki with markdown editor and search - Added Code Search: full-text and regex search using git grep with match highlighting - Added GitHub Migration: import repositories, issues, PRs, and labels from GitHub - Added default_merge_strategy column to all database drivers - Added Wiki navigation tab to repository pages - Added Search button to repository header * Tue Jan 20 2026 BurningPho3nix - 0.7.7-20260120 - Added global error handlers for uncaught exceptions and unhandled promise rejections - Refactored repository ID retrieval to consistently use _id or id across all routes - Made writeFile function asynchronous for improved performance and error handling - Enhanced repository access checks with consistent group ID usage - Fixed group owners not having write access to their repositories - Added canEdit flag to file content API response for permission-based UI controls - Refactored token authentication middleware to use promise chaining - Added logging for authentication errors and improved session management - Fixed group route members data serialization for JSON responses * Mon Jan 19 2026 BurningPho3nix - 0.7.6-20260119 - Refactored repository retrieval to support group and user ownership - Enhanced repository creation logic to prevent naming conflicts with group repositories - Added automatic backup functionality during RPM upgrades (pre-upgrade safety) - Fixed config file header duplication on RPM upgrades (yq merge was preserving comments from both files) * Sun Jan 18 2026 BurningPho3nix - 0.7.5-20260118 - Added force_2fa enforcement: users without 2FA are now required to set it up during login - Added PAT requirement for Git access when users have 2FA enabled (password auth blocked) - Fixed token creation in Convex driver (expiresAt type conversion from string/null to number/undefined) * Sun Jan 18 2026 BurningPho3nix - 0.7.4-20260118 - Fixed install-hooks command exiting early due to bash arithmetic with set -e * Sat Jan 17 2026 BurningPho3nix - 0.7.3-20260117 - Fixed protected branch enforcement not working with Convex backend - Fixed excluded_users field type mismatch (now stores usernames instead of user IDs) - Fixed isBranchProtected returning unnormalized Convex documents - Fixed pre-receive hook not resolving relative GIT_DIR paths - Fixed branch protection matching to prioritize specific patterns over wildcards - Added automatic hook installation on service start/restart - Added debug logging to internal push validation API * Sat Jan 17 2026 BurningPho3nix - 0.7.1-20260117 - Added install-hooks command in rgoon-ctl for Git hook management across all repositories - Added internal API routes for hook validation and installation - Enhanced branch protection enforcement with automatic hook installation - Updated dependencies: AWS SDK to 3.971.0, better-sqlite3 to 12.6.2, mysql2 to 3.16.1 - Enhanced error handling in repository and group management - Fixed Convex driver bugfixes - Added ESLint for improved code quality * Fri Jan 16 2026 BurningPho3nix - 0.7.0-20260116 - Added excluded users feature for branch protection rules - Users in exclusion list can bypass branch protection (push directly without PR) - Added user autocomplete with search API integration - Added scrollable modal with styled scrollbar - Updated all database drivers (SQLite, MySQL, PostgreSQL, Oracle, Convex) * Thu Jan 15 2026 BurningPho3nix - 0.6.7-20260115 - Fixed COPR installation failure: added Provides for user(repogoon) and group(repogoon) - Fixed branch protection API: corrected frontend endpoint URLs and backend namespace handling * Thu Jan 15 2026 BurningPho3nix - 0.6.6-20260115 - fixed minor annoyances and bugs - Auto-deploy Convex functions on server start/restart when database type is convex - Added _run_convex_deploy helper to rgoon-ctl for automatic schema synchronization * Wed Jan 14 2026 BurningPho3nix - 0.6.5-20260114 - Fixed ENOENT startup crash for branding directory on RPM installs - Branding assets (logo uploads) now stored in /var/lib/repogoon/branding * Wed Jan 14 2026 BurningPho3nix - 0.6.4-20260114 - Fixed starred repos showing wrong owner name for group repositories - Fixed starred repos not displaying group avatar correctly - Added storage URL conversion for Convex avatar fields * Tue Jan 13 2026 BurningPho3nix - 0.6.3-20260113 - Fixed group avatar consistency - Fixed user avatar in group members list - Resolved 500 error on git clone * Tue Jan 13 2026 BurningPho3nix - 0.6.2-20260113 - Fixed migrate-db to properly convert SQLite datetime strings to Convex timestamps - Added Convex import mutations for proper ID mapping during migration - Foreign key references now correctly resolve to Convex document IDs * Tue Jan 13 2026 BurningPho3nix - 0.6.1.20260113-1 - Added migrate-db command to rgoon-ctl for database migration between backends - Supports migration between sqlite, postgresql, mysql, oracle, and convex - Example: rgoon-ctl migrate-db --from sqlite --to convex * Mon Jan 12 2026 BurningPho3nix - 0.6.20260112-9 - Fixed 2fa_enforce issue * Mon Jan 12 2026 BurningPho3nix - 0.6.20260112-8 - Added Starred Repositories page (/starred) - Fixed star status not displaying correctly on repo pages * Mon Jan 12 2026 BurningPho3nix - 0.6.20260112-7 - Fixed white flash on page refresh (inline theme initialization) - Fixed MIME type error for static assets in production - Added footer links (source code, MPL-2.0 license) * Mon Jan 12 2026 BurningPho3nix - 0.6.20260112-6 - Added links to the footer * Mon Jan 12 2026 BurningPho3nix - 0.6.20260112-5 - Added proper markdown rendering for legal pages, READMEs, issues, and pull requests - Fixed Git Smart HTTP 403 Forbidden error during push (added authentication & authorization) - Fixed incorrect repository storage path during migration to groups * Mon Jan 12 2026 BurningPho3nix - 0.6.20260112-4 - Added Group Avatar upload and management support - Refined Group and User avatar display across the platform (Discovery, Groups, Repo Details) - Unified owner identity retrieval across all database drivers - Added star counts to public repository discovery results - Added Git Smart HTTP support (clone/push over HTTP) - Fixed private repository browsing (authenticated tree and blob routes) - Fixed web UI file creation and editing JSON parse errors - Added repository visibility toggle in settings * Mon Jan 12 2026 BurningPho3nix - 0.6.20260112-3 - Fixed Pull Requests not loading for Group repositories - Fixed Repository Settings visibility for public Group repositories - Fixed Repository Transfer not working for all database types * Mon Jan 12 2026 BurningPho3nix - 0.6.20260112-2 - Added Group Migration support (backend & frontend) - Fixed Clone URL generation to respect configured domain - Improved Migration UI with standardized dropdowns * Mon Jan 12 2026 BurningPho3nix - 0.6.20260112-1 - Added GitLab repository migration feature (issues, MRs, wiki, history) - Updated Clone UI (Protocol renaming, removed Local Path) - Added migration support for all database drivers (SQLite, MySQL, PG, Oracle, Convex) * Mon Jan 12 2026 BurningPho3nix - 0.5.20260112-1 - Added email verification for new user registration - Added SMTP configuration support - Fixed Admin User Management status display - Standardized database drivers for user status * Mon Jan 12 2026 BurningPho3nix - 0.4.20260112-1 - Corrected license to MPL-2.0 - Updated documentation for admin credentials - UI rework * Sun Jan 11 2026 BurningPho3nix - 0.3.20260111-6 - Fixed GLIBC_2.17 dependency issue by forcing rebuild of all native modules - Aggressively cleaned prebuilt binaries from node_modules * Sun Jan 11 2026 BurningPho3nix - 0.3.20260111-1 - Added Convex serverless backend support - Completed Oracle database driver implementation - Added smart config merging on updates (preserves user settings) - Fixed nginx template for modern nginx (http2 on directive) - Fixed yaml_set to handle types correctly - Fixed nginx config path detection for CentOS/RHEL - Added current password verification for password changes * Sat Jan 10 2026 BurningPho3nix - 0.3.20260109-1 - Added YAML configuration system - Added multi-database support (SQLite, PostgreSQL, MySQL, Oracle, Convex) - Added rgoon-ctl CLI management tool - Added LDAP and OIDC authentication support - Added Let's Encrypt auto-renewal support - Added dynamic rate limiting from database - Added RPM packaging with systemd service