Start9Labs/start-technologies start-registry/v1.2.0

start-registry v1.2.0

on GitHub

start-registry 1.2.0 serves package icons from a cacheable content-addressed store, labels signatures with their actual scheme, and picks up security fixes in its dependencies.

Highlights

• Package icons are served from /icons/ and stored once by content hash, however many package versions and dependents use them. StartOS 0.4.0.3 and later fetch them on demand; earlier versions still receive icons inline.
• Signatures carry their actual scheme. Ed25519ph signatures get their own algorithm label, and id-Ed25519 now marks only pure Ed25519 signatures made with keys held in gpg-agent. Existing signatures are relabeled on upgrade, and older StartOS and start-cli versions keep working.
• Dependencies are updated with security fixes, including TLS certificate verification and handshake handling, HTTP/2 flow control, and XML parsing.
• Remote requests using unconfigured loopback signing addresses are rejected.

Full changelog for v1.2.0 — every change in this release.

Important

• A reverse proxy in front of the registry must forward /icons/.
• A registry serving StartWRT must set startwrt: true in its config (or pass --startwrt) so routers keep receiving the signature labels they understand.

start-registry packages Checksums

SHA-256

34b408beb3e37b3eaf1afecaa90141dfb361a5d3db7b9f6bad90875712af75f1  start-registry_1.2.0_amd64.deb
52c675ce30ec3fe2f242e5207b7a77f13388f886e4b226341ad70751eeca4ebd  start-registry_1.2.0_arm64.deb
b7b81ee494a3b25702599c962961bdd37c5bfab8744a6f4bbf8bc66396ea9fb7  start-registry_1.2.0_riscv64.deb

BLAKE-3

b2d300fef5a8696637435488d7f21b347693e3d9bf01e56908ef4d01e545a887  start-registry_1.2.0_amd64.deb
32fe27f65ead141fc7c181d735724f880824f2dc1406ff94d04a3c3c8260ffd9  start-registry_1.2.0_arm64.deb
8a92cdee4b8faafd42fd8e070e426020c35a5c8444727a5bc7ab64564f86c432  start-registry_1.2.0_riscv64.deb