netresearch/ofelia v1.0.2 on GitHub

Highlights

Security: built with Go 1.27.3. The binaries and the ghcr.io image are built with Go 1.27.3 instead of 1.27.1. Go 1.27.3 makes crypto/x509 reject certificate chains that contain the compromised eMudhra intermediate certificates (CVE-2026-111943, golang/go#82345). This covers ofelia's own TLS connections: mail, Slack and webhook notifications, and a Docker daemon reached over TLS. v1.0.1 was built with Go 1.27.1 and accepts those chains. Programs that jobs run inside the image and that do not filter chains themselves, such as curl, rely on the image's CA bundle alone; the image ships ca-certificates 20261020-r0, which no longer contains emSign ECC Root CA - G3 or Sectigo's AAA Certificate Services, the two roots those intermediates chain to. Update to this release.

No configuration key changes meaning, so no config file needs editing.

Fixed

The web UI has a login flow when web authentication is enabled. It showed no login and polled /api/dashboard into a 401 on repeat; it now shows a login dialog (#865) — reported by @Plyrolith in #864, fixed by @CybotTM.
The web UI's authentication resists spoofed client IPs, oversized request bodies and cross-origin writes (#866), by @CybotTM.
A live reload detects a change to every job field, among them user on job-exec (#877) — reported by @Silex in #876, fixed by @CybotTM.
WaitContainer reports the Docker error when it sees the channel closed first (#863), by @CybotTM.

Changed

Go module dependencies are updated, among them docker/cli 29.9.2, moby/moby/client 0.6.2, golang.org/x/crypto 0.58.0 and netresearch/go-cron 0.16.1 (#852, #870, #872, #884), by @CybotTM.
docs/CONFIGURATION.md lists every proxy stage that web-trusted-proxies has to name (#869), by @CybotTM.

Full changelog: v1.0.1...v1.0.2

Container image

ghcr.io/netresearch/ofelia:1.0.2
ghcr.io/netresearch/ofelia:1.0
ghcr.io/netresearch/ofelia:1

Verify your download

Per-asset signatures are bundled. Verify any single file:

cosign verify-blob \
  --bundle ofelia-linux-amd64.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ofelia-linux-amd64

Verify checksums against the signed manifest:

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
sha256sum -c checksums.txt --ignore-missing

Verify build provenance. Releases are built by a reusable
workflow, so the signing identity is that workflow rather than
this repository -- --signer-workflow is required and
verification fails without it:

gh attestation verify <artifact> \
  --repo netresearch/ofelia \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml

Verify container image:

cosign verify ghcr.io/netresearch/ofelia:1.0.2 \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
gh attestation verify oci://ghcr.io/netresearch/ofelia:1.0.2 \
  --repo netresearch/ofelia \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml