docs: update README for v0.2.0 release
- Version bump to 0.2.0, changelog with all new features - Fix Quick Start ports (3000→31336) - Fix architecture diagram ports (3000/8080→31336/31337) - Add new features to list: key rotation, replay protection, maintenance windows, supply chain checks - Update Known Issues to be honest about gaps - Update competitive position section
This commit is contained in:
Fimeg
parent
0591b110ee
commit
2665ee36be
1 changed files with 37 additions and 9 deletions
46
README.md
46
README.md
|
|
@ -21,10 +21,10 @@ That said, it works well for its intended use case. Issues and feedback welcome!
|
|||
Cross-platform agents • Web dashboard • Hardware binding • Ed25519 signing • Full error transparency • No enterprise BS
|
||||
|
||||
```
|
||||
v0.1.27 - Alpha Release (Dec 2025)
|
||||
v0.2.0 - May 2026
|
||||
```
|
||||
|
||||
**Latest:** Implemented proper storage metrics subsystem with dedicated table and models. AgentHealth scanner improvements with OS-aware badges and extended defaults. Agent migration system for version management. Error transparency system and hardware binding security. Ed25519 cryptographic signing. Removed 2,369 lines of dead code. Curiously the program stopped working after that... (just kidding). [Update instructions below](#updating).
|
||||
**Latest:** Maintenance windows for gating installs by schedule, OSV.dev supply chain checks for npm/PyPI packages, TD-series security refactors (panic recovery, error transparency, main.go modularization), install URL auto-detection fix, Ed25519 key rotation support, replay attack protection, and the setup wizard now includes the agent-facing URL field. See the [changelog](#-tldr-changelog-dont-trust-the-transport-layer) below. [Update instructions here](#updating).
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -94,7 +94,7 @@ docker-compose build
|
|||
docker-compose up -d
|
||||
|
||||
# Access web UI and run setup
|
||||
open http://localhost:3000
|
||||
open http://localhost:31336
|
||||
# Follow setup wizard, then copy generated .env content
|
||||
|
||||
# Restart with new configuration
|
||||
|
|
@ -216,6 +216,10 @@ Remove-Item "C:\ProgramData\RedFlag\config.json"
|
|||
|
||||
✓ **Hardware Binding** - Machine fingerprint prevents config copying between agents
|
||||
✓ **Ed25519 Signing** - All updates cryptographically verified before installation
|
||||
✓ **Key Rotation** - TTL-based auto-refresh of signing keys with zero-downtime rotation
|
||||
✓ **Replay Protection** - Signed nonces with 10-minute window prevent command replay
|
||||
✓ **Maintenance Windows** - Schedule when updates can be installed (cron-free day/time config)
|
||||
✓ **Supply Chain Checks** - OSV.dev vulnerability scan at approval time for npm/PyPI packages
|
||||
✓ **Secure by Default** - Registration tokens, JWT auth with refresh, rate limiting
|
||||
✓ **Error Transparency** - All errors logged with full context (no sanitization)
|
||||
✓ **Idempotent Installs** - Re-running installers won't create duplicate agents
|
||||
|
|
@ -234,12 +238,12 @@ Remove-Item "C:\ProgramData\RedFlag\config.json"
|
|||
```
|
||||
┌─────────────────┐
|
||||
│ Web Dashboard │ React + TypeScript
|
||||
│ Port: 3000 │
|
||||
│ Port: 31336 │
|
||||
└────────┬────────┘
|
||||
│ HTTPS + JWT Auth + Machine Binding
|
||||
┌────────▼────────┐
|
||||
│ Server (Go) │ PostgreSQL
|
||||
│ Port: 8080 │ Ed25519 Signing Service
|
||||
│ Port: 31337 │ Ed25519 Signing Service
|
||||
└────────┬────────┘
|
||||
│ Pull-based (agents check in every 5 min)
|
||||
┌────┴────┬────────┐
|
||||
|
|
@ -274,19 +278,24 @@ Remove-Item "C:\ProgramData\RedFlag\config.json"
|
|||
## Current Status
|
||||
|
||||
**What Works:**
|
||||
- ✅ Cross-platform agent registration and updates
|
||||
- ✅ Update scanning for all supported package managers
|
||||
- ✅ Linux and Windows agent registration and updates
|
||||
- ✅ Update scanning for APT, DNF, Winget, Windows Update, Docker
|
||||
- ✅ Dry-run dependency checking before installation
|
||||
- ✅ Real-time heartbeat and rapid polling
|
||||
- ✅ Multi-seat registration tokens
|
||||
- ✅ Native service integration (systemd, Windows Services)
|
||||
- ✅ Web dashboard with full agent management
|
||||
- ✅ Docker integration for container image updates
|
||||
- ✅ Maintenance windows for scheduling installs
|
||||
- ✅ Ed25519 key rotation and replay attack protection
|
||||
- ✅ Supply chain vulnerability check (OSV.dev) for npm/PyPI packages at approval time
|
||||
|
||||
**Known Issues:**
|
||||
- Windows Winget detection occasionally misses packages (Windows API limitation)
|
||||
- Some Windows Updates may reappear after installation (known Windows Update quirk)
|
||||
- Limited mobile dashboard optimization (usable but not ideal)
|
||||
- No macOS agent support (Linux + Windows only)
|
||||
- No AUR, Snap, Flatpak, Homebrew scanner support
|
||||
- Frontend is functional but not polished — some pages need UX love
|
||||
---
|
||||
|
||||
## License
|
||||
|
|
@ -313,11 +322,15 @@ That's not a feature difference - that's a **business model disruption**.
|
|||
- ❌ Self-hosted by design (they push "MSP Cloud")
|
||||
- ❌ Code transparency (proprietary, can't audit claims)
|
||||
- ❌ Ed25519 cryptographic verification (opaque signing process)
|
||||
- ❌ Supply chain vulnerability checks at install time
|
||||
|
||||
**What RedFlag does** (architectural advantages):
|
||||
- ✅ Hardware fingerprint binding (machine_id + public_key)
|
||||
- ✅ Self-hosted by design (runs entirely on your infrastructure)
|
||||
- ✅ Ed25519 signing throughout (verifiable supply chain)
|
||||
- ✅ Ed25519 signing throughout with key rotation (verifiable supply chain)
|
||||
- ✅ Replay attack protection (signed nonces, 10-minute window)
|
||||
- ✅ Maintenance windows for gating installs (all, not just a toggle)
|
||||
- ✅ Supply chain vulnerability checks (OSV.dev, npm/PyPI)
|
||||
- ✅ Error transparency (all logs local with full context)
|
||||
- ✅ $600k/year savings (undeniable math)
|
||||
|
||||
|
|
@ -435,6 +448,21 @@ If you're looking for an enterprise-grade solution with SLAs and support contrac
|
|||
|
||||
## 📜 **TLDR Changelog: Don't trust the transport layer**
|
||||
|
||||
**v0.2.0 (May 2026)**:
|
||||
- ✅ Maintenance windows for scheduling/gating install operations
|
||||
- ✅ Supply chain vulnerability checks (OSV.dev) for npm/PyPI at approval time
|
||||
- ✅ Ed25519 key rotation with TTL-based auto-refresh
|
||||
- ✅ Command signing v3: agent_id binding prevents relay attacks
|
||||
- ✅ Replay attack protection via signed nonces (10-minute window)
|
||||
- ✅ Configurable operational timeouts (was 6 hardcoded values)
|
||||
- ✅ Semver-aware version comparison (fixes "0.1.9" > "0.1.22" bug)
|
||||
- ✅ Binary path traversal protection on download endpoints
|
||||
- ✅ Machine ID rebind endpoint for hardware migration recovery
|
||||
- ✅ TD-series refactors: main.go God function split, panic recovery, error transparency
|
||||
- ✅ Test suite: 170+ tests across 18 packages
|
||||
- ✅ Install URL auto-detection: backend uses REDFLAG_PUBLIC_URL, frontend :8080 → :31337
|
||||
- ✅ Setup wizard includes agent-facing URL field with auto-detect
|
||||
|
||||
**v0.1.27 (Dec 2025, Christmas Release) 🎄**:
|
||||
- ✅ Hardware binding with machine fingerprinting (security differentiator)
|
||||
- ✅ Ed25519 cryptographic signing for all updates (supply chain protection)
|
||||
|
|
|
|||
Loading…
Reference in a new issue