Hotfix 2026.10.26.4: OpenID Connect audience in the console

jcoffey-dev commented

2026-11-01 16:19:18 +00:00

Owner

Server :latest (2026.10.29.1) refuses a new OpenID Connect directory without an audience, and the console on :latest has no field for one in its setup guide. The server's release notes and GHSA-v3gv-4j87-3mg2 also say existing directories without an audience appear on the Security to-do list, which only the release candidates' console does.

Brought over from main:

#143: the setup guide asks for the audience, and the to-do list flags directories without one or that accept any token on the user info endpoint's word.
56a4cae: GitHub copies of releases get their files.

New here: both CIs leave :latest alone once a final release numbered by series exists, as the server's release/2026 already does.

Sets the version to 2026.10.26.4.

Checked locally: all CI steps. Also, in a browser with this image against server :latest, on data carried over from server 2026.10.29:

The old directory shows both warnings.
The guide won't save without an audience, and saves with one.
A new directory without an audience is refused by the server.

The :latest check was run against the live release list and made-up lists. The branch with a series release, where :latest stays put, hasn't run in real CI, and won't until 27.1 ships.

Server `:latest` (2026.10.29.1) refuses a new OpenID Connect directory without an audience, and the console on `:latest` has no field for one in its setup guide. The server's release notes and GHSA-v3gv-4j87-3mg2 also say existing directories without an audience appear on the Security to-do list, which only the release candidates' console does. **Brought over from main:** - #143: the setup guide asks for the audience, and the to-do list flags directories without one or that accept any token on the user info endpoint's word. - 56a4cae: GitHub copies of releases get their files. **New here:** both CIs leave `:latest` alone once a final release numbered by series exists, as the server's `release/2026` already does. Sets the version to 2026.10.26.4. **Checked locally:** all CI steps. Also, in a browser with this image against server `:latest`, on data carried over from server 2026.10.29: - The old directory shows both warnings. - The guide won't save without an audience, and saves with one. - A new directory without an audience is refused by the server. The `:latest` check was run against the live release list and made-up lists. The branch with a series release, where `:latest` stays put, hasn't run in real CI, and won't until 27.1 ships.

jcoffey-dev added 5 commits 2026-11-01 16:19:18 +00:00

Directory setup: ask an OpenID Connect provider's client ID as the audience b7a178b1a9

The server now refuses a new OpenID Connect directory without a required
audience, since without one a token the provider issued to any other
application signs people in. The guide's connection step asks for the
client ID inbuxa is registered with at the provider, can't go on
without it, and saves it as requireAudience.

Test: the presets test builds an OIDC directory with requireAudience
from the audience typed (it had none before); typecheck, lint and the
full test run pass.

(cherry picked from commit efea8c3fdd)

Security: flag OpenID Connect directories open to other apps' tokens fb4679c418

Two new checks on the security to-do list read every directory:

- SS-30, important: an OpenID Connect directory with no required
  audience (only one saved before the server required it can be like
  this). Tokens its provider issued to other applications sign in.
- SS-31, important: an OpenID Connect directory that takes tokens which
  aren't JWTs on the user info endpoint's word (opaqueTokens: userinfo,
  which directories saved before the setting existed read as). Any
  token the provider issued, to any application, passes.

Both are Reviews that open the directory. They are numbered past the
spec's requirements, SS-19 to SS-29, which share the numbering; the
server keeps acceptances for checks up to SS-40. The page help lists
them after SS-18.

Test: the checks test flags the old directory for both and leaves a
directory with an audience, one using introspection and an LDAP one
alone; the help test still finds every check explained once, in order.

(cherry picked from commit 2b37d229ae)

GitHub release copy: wait for the release files b2d29b836c

github-release needed only publish, so it ran beside files and copied
the Gitea release before files had attached the tarball and SHA256SUMS.
Every GitHub copy of a release had no files. It now needs files too.

(cherry picked from commit 56a4caea72)

CI: leave :latest to the newest series once 27.1 ships a022ce4d2b

A dated release from this branch moved :latest, GHCR's :latest and the
GitHub "latest release" on every tag. That is right while 2026.x is the
newest series, and wrong once 27.1 ships: a security release from this
branch would take :latest back to the older line.

Both CIs now ask Gitea for the newest final releases and move :latest only
while none is numbered by series (v27.1, v27.1.3), so the switch happens on
its own when 27.1 is published. The check fails rather than guess. The
inherited v1.0.x numbers don't count as a series.

Version 2026.10.26.4

ci / build (pull_request) Skipped

Details

ci / publish (pull_request) Skipped

Details

ci / notices (pull_request) Successful in 1m0s

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 1m55s

Details

f131071bde

jcoffey-dev merged commit a628f21d91 into release/2026

2026-11-01 16:21:28 +00:00

jcoffey-dev deleted branch hotfix/oidc-audience

2026-11-01 16:21:28 +00:00

Hotfix 2026.10.26.4: OpenID Connect audience in the console #158