-
Notifications
You must be signed in to change notification settings - Fork 9.8k
Rebuild Docker Hub image (ships M7 WS auth-bypass fix + #1004 sensing-server simulate-latch fix) #1040
Description
Rebuild & push ruvnet/wifi-densepose:latest — ships fixes incl. a security fix
The Docker Hub image (docker/Dockerfile.rust) bundles three release binaries that were materially changed by the beyond-SOTA sweep (PRs #1023–#1039, v0.9.0) and the #1009/#1004 fixes. The currently-published image predates all of them.
| Binary in image | Fix now on main, NOT in the published image |
|---|---|
| homecore-server | SECURITY (ADR-161 / #1025): critical WebSocket auth bypass — the WS handshake accepted any non-empty token without checking the token store. Also: the automation engine was constructed-but-never-started (Time/RunMode/Choose/template were no-ops), and the dev bin bound 0.0.0.0 accept-any. |
| sensing-server | #1004: --source auto simulate-latch — a container that starts before CSI flows latches to simulate forever and never binds UDP :5005, silently serving fake poses. Plus Matter-commissioning + M3/M7 fixes. |
| cog-ha-matter | M5 (ADR-159) honest-labeling; minimal runtime change. |
Impact: a deployed ruvnet/wifi-densepose:latest is running a homecore-server with the unauthenticated-WebSocket hole and a sensing-server that can serve simulated data indefinitely.
Action: rebuild multi-arch (amd64+arm64) from docker/Dockerfile.rust at current main and push ruvnet/wifi-densepose:latest + a dated tag (e.g. v0.9.1). The Python image (Dockerfile.python, archive/v1) is untouched by the v2 sweep and does not need a rebuild.
Validation before push: bash scripts/prove.sh (workspace 3,166 / 0, proof PASS) — already green on main.
Requires Docker buildx + the Docker Hub token (GCP Secret Manager). Tracking here so it isn't lost; can be done locally or wired into a release CI job.