plakar v1.1.8 [SECURITY]

SECURITY RELEASE. This version rebuilds plakar with Go 1.26.10 to pick up the fix for CVE-2026-111943 in Go's crypto/x509 package. We strongly recommend upgrading as soon as possible.

About your data

Your kloset data is not exposed by this issue.

TLS is only the transport between plakar and the storage backend.

Everything plakar writes to a kloset repository is encrypted and authenticated on your machine before it leaves, with a key derived locally from your passphrase.

The passphrase itself, and the key, never go over the network. Someone able to intercept the TLS connection sees encrypted, integrity-protected blobs and cannot read or silently alter your backups.

Plugins fetched from plakar.io are signify-signed and verified independently of TLS.

Security

• Go published an urgent security fix on 2026-10-19 (CVE-2026-111943, golang/go#82345): crypto/x509 now refuses certificate chains that go through a small set of intermediate certificates from one Certificate Authority, following security concerns about how that CA operates. plakar binaries built with an earlier Go still trust those intermediates.
• plakar verifies TLS certificates every time it talks to a remote over HTTPS: object storage such as S3 and compatible services, HTTP stores, the plakar.io authentication service, and every integration that uses TLS. With this release, a server presenting a chain through one of the blocked intermediates is rejected instead of silently trusted.
• What an intercepted connection could affect: repositories opened with PLAKAR_INSECURE_PLAINTEXT, which have no encryption layer of their own; availability, since an attacker on the path could drop or stall traffic; and the credentials of whatever sits behind TLS, such as the plakar.io login session. This is why upgrading is still recommended.
• The fix lives entirely in the Go toolchain. No plakar code changed and there is no workaround other than upgrading.
• If a remote that used to work starts failing certificate verification after upgrading, that is the fix doing its job: the server's chain goes through a blocked intermediate. Contact the service provider; do not disable TLS verification.

Building from source

• The minimum Go version is now 1.26.10 (go 1.26.10 in go.mod). An older toolchain refuses to build, or fetches 1.26.10 on its own when GOTOOLCHAIN=auto is set. The Dockerfile builder stage moved to golang:1.26-alpine for the same reason.

Other

• No functional changes compared to v1.1.7.

Friendly reminder: if you're updating from plakar 1.1.4 or older, PLAKAR_INSECURE_PLAINTEXT is required to open non-encrypted kloset repositories.

If coming from pre-1.1.x, do not forget to run plakar repair as you may have been affected by old bugs that need a kloset repaired.

Changelog

• 4ded890 bump floor dependency to go1.26.10
• fc530f7 bump version to v1.1.8