getnora-io/nora v0.7.3

on GitHub

What's new

Bug Fixes

• Docker auth flow — /v2/ endpoint now correctly returns 401 Unauthorized with WWW-Authenticate header when auth is enabled. Previously, Docker clients received 200 OK without authentication, causing docker login to appear successful while docker pull/docker push failed with "unauthorized". Fixes #219
• Raw registry curation bypass — raw was the only registry without check_download(), completely bypassing curation enforce mode. All 13 registries are now curated consistently
• Timing side-channel on bypass token — replaced string comparison with constant-time comparison (subtle crate) to prevent timing attacks
• Maven glob matching — com.evil.** pattern now correctly matches com.evil:lib (colon separator for Maven groupId:artifactId)
• Mobile dashboard — responsive layout with 3-column stats grid, compact padding, and word-wrap on small screens

Features

• Raw directory browser — nested navigation with breadcrumbs, folder/file icons, directories-first sorting. Browse raw artifacts at any depth
• Docker Hub images — NORA is now published to Docker Hub as getnora/nora alongside GHCR
• Docker-Distribution-API-Version header — /v2/ response now includes registry/2.0 header per Docker Registry V2 spec
• Startup time metric — startup_duration_ms exposed on dashboard (cold start tracking)

Stats

• 857 tests (was 851 in v0.7.2)
• Docker image: ghcr.io/getnora-io/nora:0.7.3 / getnora/nora:0.7.3
• Helm chart: update appVersion to 0.7.3 in your values

Install

docker pull getnora/nora:0.7.3

Or download the binary:

curl -LO https://github.com/getnora-io/nora/releases/download/v0.7.3/nora-linux-amd64
chmod +x nora-linux-amd64
sudo mv nora-linux-amd64 /usr/local/bin/nora