+
diff --git a/containers/libreportal/frontend/components/updater/js/updater-page.js b/containers/libreportal/frontend/components/updater/js/updater-page.js
index 38dbf5c..55dfe4f 100644
--- a/containers/libreportal/frontend/components/updater/js/updater-page.js
+++ b/containers/libreportal/frontend/components/updater/js/updater-page.js
@@ -14,6 +14,7 @@ class UpdaterPage {
this.updates = null; // { generated_at, apps: [...] }
this.cves = null; // { generated_at, apps: [...], totals: {...} }
this.history = null; // { entries: [...] }
+ this.artifacts = null; // { signed, serial, artifacts: [...] } (hotfixes)
this.apps = []; // merged per-app view rendered in the table
this._pushedAnyTab = false;
this._eventBound = false;
@@ -31,7 +32,7 @@ class UpdaterPage {
}
parseTabFromUrl() {
- const allowed = new Set(['overview', 'updates', 'security', 'recovery', 'history']);
+ const allowed = new Set(['overview', 'updates', 'improvements', 'security', 'recovery', 'history']);
const seg = window.location.pathname.replace(/^\/updater\/?/, '').split('/')[0];
if (seg && allowed.has(seg)) return seg;
return null;
@@ -45,7 +46,7 @@ class UpdaterPage {
// coordinator). Self-guards against a torn-down page.
this.services.tasks && this.services.tasks.refresh && this.services.tasks.refresh.register({
id: 'updater',
- match: (d) => /^(updater_|libreportal\s+updater)/.test((d && (d.action || (d.task && d.task.command))) || ''),
+ match: (d) => /^(updater_|artifact_|libreportal\s+(updater|artifact))/.test((d && (d.action || (d.task && d.task.command))) || ''),
run: () => {
if (window.updaterPage === this && document.getElementById('updater-page')) {
return this.refreshAll().then(() => this.render());
@@ -71,6 +72,8 @@ class UpdaterPage {
case 'update': this.applyUpdate(app); break;
case 'update-all': this.applyAll(); break;
case 'rollback': this.rollback(app); break;
+ case 'apply-artifact': this.applyArtifact(action.dataset.id); break;
+ case 'revert-artifact': this.revertArtifact(action.dataset.id); break;
case 'goto': this.switchTab(action.dataset.tab); break;
}
});
@@ -100,12 +103,13 @@ class UpdaterPage {
async refreshAll() {
const get = (url) => fetch(url, { cache: 'no-store' }).then(r => r.ok ? r.json() : null).catch(() => null);
- const [u, c, h] = await Promise.all([
+ const [u, c, h, av] = await Promise.all([
get('/data/updater/generated/updates.json'),
get('/data/updater/generated/cves.json'),
get('/data/updater/generated/history.json'),
+ get('/data/updater/generated/artifacts_available.json'),
]);
- this.updates = u; this.cves = c; this.history = h;
+ this.updates = u; this.cves = c; this.history = h; this.artifacts = av;
this.apps = this.mergeApps();
}
@@ -149,7 +153,9 @@ class UpdaterPage {
const cveTotals = (this.cves && this.cves.totals) || this.tallyCves();
const totalCves = (cveTotals.critical || 0) + (cveTotals.high || 0) + (cveTotals.medium || 0) + (cveTotals.low || 0);
const drReady = this.apps.filter(a => a.dr_ready !== false).length; // snapshot-before-update is on by default
- return { apps: this.apps.length, updatesAvailable, cveTotals, totalCves, drReady, lastChecked: this.updates && this.updates.generated_at };
+ const artList = (this.artifacts && Array.isArray(this.artifacts.artifacts)) ? this.artifacts.artifacts : [];
+ const improvements = artList.filter(a => a.applicable && !a.applied).length;
+ return { apps: this.apps.length, updatesAvailable, cveTotals, totalCves, drReady, improvements, lastChecked: this.updates && this.updates.generated_at };
}
tallyCves() {
@@ -178,6 +184,14 @@ class UpdaterPage {
if (!app) return;
this.dispatch('updater_rollback', { app }, `Rolling ${app} back to its pre-update snapshot…`);
}
+ applyArtifact(id) {
+ if (!id) return;
+ this.dispatch('artifact_apply', { id }, `Applying hotfix ${id} (a snapshot is taken first)…`);
+ }
+ revertArtifact(id) {
+ if (!id) return;
+ this.dispatch('artifact_revert', { id }, `Reverting hotfix ${id}…`);
+ }
dispatch(action, params, note) {
const route = this.services.tasks && this.services.tasks.route;
@@ -203,6 +217,7 @@ class UpdaterPage {
const titles = {
overview: ['Overview', 'Update health, security posture, and recovery readiness at a glance.'],
updates: ['Updates', 'Available versions per app. Every update is snapshotted first, so it is reversible.'],
+ improvements: ['Improvements', 'Signed, individually-reversible hotfixes from the LibrePortal team — applied with a snapshot first.'],
security: ['Security', 'Known vulnerabilities (CVEs) in your installed app images, by severity.'],
recovery: ['Disaster Recovery', 'Pre-update snapshots and rollback points — undo any update.'],
history: ['History', 'A log of update and rollback activity.'],
@@ -225,6 +240,7 @@ class UpdaterPage {
switch (this.currentTab) {
case 'overview': panel.innerHTML = this.renderOverview(); break;
case 'updates': panel.innerHTML = this.renderUpdates(); break;
+ case 'improvements': panel.innerHTML = this.renderImprovements(); break;
case 'security': panel.innerHTML = this.renderSecurity(); break;
case 'recovery': panel.innerHTML = this.renderRecovery(); break;
case 'history': panel.innerHTML = this.renderHistory(); break;
@@ -249,6 +265,8 @@ class UpdaterPage {
${card('verify', c.totalCves, 'Known CVEs',
sev.critical || sev.high ? `${sev.critical || 0} critical · ${sev.high || 0} high` : 'no high-severity issues',
`
`)}
+ ${card('setup', c.improvements, 'Improvements', c.improvements ? 'signed hotfixes to apply' : 'nothing pending',
+ `
`)}
${card('backups', `${c.drReady}/${c.apps}`, 'Recovery-ready', 'snapshot taken before each update',
`
`)}
${card('system', c.apps, 'Apps tracked', `last scan: ${checked}`,
@@ -284,6 +302,39 @@ class UpdaterPage {
${rows}
`;
}
+ renderImprovements() {
+ if (!this.artifacts) return this.empty('No hotfix data yet. Run a check to fetch the signed improvements index.', true);
+ const list = Array.isArray(this.artifacts.artifacts) ? this.artifacts.artifacts : [];
+ const signed = !!this.artifacts.signed;
+ if (!list.length) return this.empty('No improvements available right now — you are all caught up. 🎉');
+ // Map the hotfix severities onto the existing CVE severity colour classes.
+ const sevClass = { security: 'sev-critical', breakage: 'sev-high', compat: 'sev-medium', tweak: 'sev-low' };
+ const rows = list.map(a => {
+ const sv = sevClass[a.severity] || 'sev-low';
+ const scope = a.app ? this.escape(a.app) : 'system';
+ const appliedBadge = a.applied ? '
applied' : '';
+ const autoBadge = a.auto ? '
auto' : '';
+ const naBadge = a.applicable ? '' : '
not applicable';
+ let btn = '';
+ if (a.applied) btn = `
`;
+ else if (a.applicable && signed) btn = `
`;
+ return `
+
${this.escape(a.title || a.id)}
+ ${this.escape(a.severity || 'tweak')}
+ ${scope}
+ ${appliedBadge} ${autoBadge} ${naBadge}
+
${this.escape(a.why || '')}
+
${btn}
+
`;
+ }).join('');
+ const banner = signed
+ ? `
Small, signed, individually-reversible improvements curated by the LibrePortal team. Security & breakage fixes apply automatically (a snapshot is taken first); the rest are one click. Every apply is logged in History and can be reverted.
`
+ : `
⚠ The improvements index is unsigned (signing not activated on this build) — applying is disabled for safety.
`;
+ return `${banner}
+
+
${rows}
`;
+ }
+
renderSecurity() {
const withCves = this.apps.filter(a => (a.cves || []).length);
if (!this.cves) return this.empty('No vulnerability scan yet. Run a check to scan your app images for known CVEs.', true);
diff --git a/containers/libreportal/frontend/core/tasks/js/task-actions.js b/containers/libreportal/frontend/core/tasks/js/task-actions.js
index 9b58b10..3055bf6 100755
--- a/containers/libreportal/frontend/core/tasks/js/task-actions.js
+++ b/containers/libreportal/frontend/core/tasks/js/task-actions.js
@@ -287,6 +287,22 @@ async configUpdate(changes) {
} catch (error) { throw new Error(`Failed to roll back ${app}: ${error.message}`); }
}
+ // Hotfix (artifact) actions — apply/revert one signed hotfix via the locked-down
+ // `libreportal artifact` CLI as a task. The id is from the signed index; still
+ // charset-guard it before it goes into the command string (defense in depth).
+ async artifactApply(id) {
+ if (!id || !/^[A-Za-z0-9._-]+$/.test(id)) throw new Error('Invalid hotfix id');
+ try {
+ return await this.executeTask('artifact_apply', id, `libreportal artifact apply ${id}`, `Apply hotfix ${id}`);
+ } catch (error) { throw new Error(`Failed to apply hotfix ${id}: ${error.message}`); }
+ }
+ async artifactRevert(id) {
+ if (!id || !/^[A-Za-z0-9._-]+$/.test(id)) throw new Error('Invalid hotfix id');
+ try {
+ return await this.executeTask('artifact_revert', id, `libreportal artifact revert ${id}`, `Revert hotfix ${id}`);
+ } catch (error) { throw new Error(`Failed to revert hotfix ${id}: ${error.message}`); }
+ }
+
/**
* Create a task object
*/
diff --git a/containers/libreportal/frontend/core/tasks/js/task-router.js b/containers/libreportal/frontend/core/tasks/js/task-router.js
index 6dabb97..70a24bb 100755
--- a/containers/libreportal/frontend/core/tasks/js/task-router.js
+++ b/containers/libreportal/frontend/core/tasks/js/task-router.js
@@ -79,6 +79,13 @@ class TaskRouter {
case 'updater_rollback':
return await this.actions.updaterRollback(params.app);
+ // Hotfix channel (components/updater "Improvements") — apply/revert one
+ // signed hotfix via the locked-down `libreportal artifact` CLI as a task.
+ case 'artifact_apply':
+ return await this.actions.artifactApply(params.id);
+ case 'artifact_revert':
+ return await this.actions.artifactRevert(params.id);
+
default:
throw new Error(`Unknown action: ${action}`);
}