From a4c720cc8e6e02b5f0667a258437c8355bddebec Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 24 Jul 2026 23:55:30 +0000 Subject: [PATCH] chore(deps): pin AllMyStuff v0.2.48 and MyOwnMesh v0.3.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Moves the customer client onto the hardened stack. Both pins go together because the fix spans both halves: * MyOwnMesh v0.3.2 — the auth handshake now binds the DTLS certificate fingerprint into the signed ed25519 payload, so a MITM on the (unauthenticated) signaling path can't sit between a technician and a customer while both sides still authenticate cleanly. Inbound frames are also gated on peer admission, so nothing is dispatched before authentication + approval. The signed handshake payload changed, so a v0.3.2 node and a pre-v0.3.2 daemon don't agree — the daemon sidecar can't lag the node here. * AllMyStuff v0.2.48 — the node engine the client runs in CEC client mode, riding that daemon: media-capture offers are now authorized (a technician's ScreenView consent grant is required before this machine will source screen/camera/mic), and unsolicited `OwnershipControl::Claimed` is rejected unless this device sent the matching Claim. Pin sites, only some of which are .rev files: * .allmystuff-rev / .myownmesh-rev — the allmystuff-serve and myownmesh sidecar releases build.rs stages and the installer bundles. * gui/src-tauri/Cargo.toml — the three linked source crates (allmystuff-node, -cec-protocol, -cec-consent) carry their own git tags outside .rev; bumped in lockstep so the compiled-in code matches the sidecars. No CEC-side code change is needed: the node-control contract the client drives is unchanged in this cut. v0.3.2 is published; v0.2.48 is cut separately from the matching AllMyStuff branch, and until that tag exists the Tauri build's git deps won't resolve (this repo's check CI builds only the frontend + the service crate, so it is unaffected). gui/src-tauri/Cargo.lock stays as-is per repo convention — it refreshes on the next real release build. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_019xdiiiYN3ThDwnuHfqQnEy --- .allmystuff-rev | 2 +- .myownmesh-rev | 2 +- gui/src-tauri/Cargo.toml | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.allmystuff-rev b/.allmystuff-rev index 84cc2ac..14b777d 100644 --- a/.allmystuff-rev +++ b/.allmystuff-rev @@ -1 +1 @@ -v0.2.47 +v0.2.48 diff --git a/.myownmesh-rev b/.myownmesh-rev index 937cd78..7becae1 100644 --- a/.myownmesh-rev +++ b/.myownmesh-rev @@ -1 +1 @@ -v0.3.1 +v0.3.2 diff --git a/gui/src-tauri/Cargo.toml b/gui/src-tauri/Cargo.toml index 17427ed..f2e7a4c 100644 --- a/gui/src-tauri/Cargo.toml +++ b/gui/src-tauri/Cargo.toml @@ -51,11 +51,11 @@ tauri-plugin-single-instance = "2" # media planes, and the node control socket the client drives. Reused in "CEC # client (customer) mode". Git deps on the sibling branch that adds the CEC # node commands; not yet published, so this won't resolve in this sandbox. -allmystuff-node = { git = "https://github.com/mrjeeves/AllMyStuff", tag = "v0.2.47" } +allmystuff-node = { git = "https://github.com/mrjeeves/AllMyStuff", tag = "v0.2.48" } # The CEC wire contract + Support-ID derivation, and the three-choice consent # store — the customer's per-technician approvals. -allmystuff-cec-protocol = { git = "https://github.com/mrjeeves/AllMyStuff", tag = "v0.2.47" } -allmystuff-cec-consent = { git = "https://github.com/mrjeeves/AllMyStuff", tag = "v0.2.47" } +allmystuff-cec-protocol = { git = "https://github.com/mrjeeves/AllMyStuff", tag = "v0.2.48" } +allmystuff-cec-consent = { git = "https://github.com/mrjeeves/AllMyStuff", tag = "v0.2.48" } # The client's OWN OS-service installer (never AllMyStuff's), so installing the # background service never clobbers an existing AllMyStuff install.