Repository navigation
Release RustPost v1.0.0 - #40
Merged
Merged
Conversation
Prepare the initial release candidate by fixing verified release-blocking and release-embarrassing issues without changing routes, schema, visual identity, or privacy semantics. Release packaging and operator experience: - add the documented primary rustpost binary while retaining rustpost-cli - bump the crate and lockfile version to 1.0.0-rc.1 - update first-run, first-admin, startup, backup, and restore command guidance to use rustpost - correct generated settings wording from byte limits to character limits - refresh release verification copy and remove stale Tor reachability claims Security, privacy, and session hardening: - allow existing passwords to authenticate after an operator raises the configured minimum password length - validate profile website URLs as absolute HTTP/HTTPS URLs - suppress unsafe legacy website values instead of rendering executable links Media and posting hardening: - enforce configured per-post image and video attachment limits - reject missing or unsupported attachment records during post creation - calculate multipart body limits from the largest valid configured media mix Tests and validation: - add regression coverage for password-policy login compatibility, unsafe profile URLs, upload body limits, and per-type media limits - pass cargo fmt --all --check - pass strict workspace Clippy with all targets and features - pass cargo test --workspace --all-features with 310 tests - validate fresh install/admin/CAPTCHA/browser flows and backup/restore with and without controlled Tor key material - confirm Playwright artifacts remain ignored
Standardize the project on a single CLI binary named `rustpost-cli` and prepare the 1.0.0 release. Deleted the legacy `rustpost` binary and `[[bin]]` entry, updated Cargo.toml version to 1.0.0, and adjusted docs, help text, startup hints, and admin/terminal messages to reference `rustpost-cli`. Remove the deprecated PrintOnionAddress CLI command and its docs, and add a guard to reject restoring Tor keys unless the restore explicitly opts in (with a unit test). Also update the changelog (release text and DB baseline bump), and tweak the release workflow SHA256 generation command to write checksums from the dist directory.
This release raises the Rust baseline to 1.91 and updates the embedded Arti/Tor stack to 0.45.0, including the required onion-stream API migration. It also refreshes dependency versions to their latest compatible releases, keeps rusqlite aligned with the Arti sqlite dependency set, and updates the release docs and verification notes to reflect the new runtime and artifact conventions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Local validation
cargo fmt --all --check— passedcargo clippy --workspace --all-targets --all-features -- -D warnings -D clippy::all -D clippy::pedantic -D clippy::nursery -D clippy::cargo— passedcargo test --workspace --all-features --quiet— 487 passed after Arti 0.46.0 upgradecargo audit— known transitive Artirsa 0.9.10advisory (RUSTSEC-2023-0071); two allowed maintenance warnings, documented in READMEcargo build --release --locked --bins— passed;rustpost-cli --versionreports 1.0.0