Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

0.2.3.0: README honesty pass + fresh screenshots — version, clone count, and OSV now tells the truth about checking your deps' deps

Browse source
This commit is contained in:
Fimeg 2026-05-31 22:00:09 -04:00
commit 91e097f54a
5 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
README.md
View file

@ -2,9 +2,9 @@
**Self-hosted update management for operators who own their stack.**
`v0.2.1.1` — May 2026 · MIT License
`v0.2.3.0` — May 2026 · MIT License
> **You're early — over 400 of you cloned this before it was announced.**
> **You're early — nearly 600 of you cloned this before it was announced.**
> If you want it to keep existing, [sponsor the work](#sponsorship--consulting).
---
@ -33,6 +33,9 @@ ConnectWise charges $50/agent/month. RedFlag doesn't.
| ![Heartbeat](Screenshots/RedFlag%20Heartbeat%20System.png) | ![Windows Agent](Screenshots/RedFlag%20Windows%20Agent%20Details.png) | ![Agent List](Screenshots/RedFlag%20Agent%20List.png) |
|---|---|---|
| ![Upstream Tracking](Screenshots/Upstream-Version-Tracking.png) | ![Dependency Resolution](Screenshots/7Zip-Updates-RedFlag-Dependency.png) | |
|---|---|---|
</details>
---
@ -91,7 +94,7 @@ Every command includes a signed nonce with a 10-minute validity window. The agen
Agent-server communication runs over HTTPS. The Ed25519 signing model is a defense-in-depth layer on top of that — commands can't be forged or replayed even if traffic is somehow intercepted or TLS is terminated at a proxy. The signing model doesn't assume the transport is trustworthy. Cert pinning and enforced TLS verification are on the roadmap.
Before a package is installed: the agent fetches the expected SHA-256 from the server, downloads the artifact, verifies the hash. Mismatch blocks the install. OSV.dev is queried for known vulnerabilities at discovery time (async, deduped) for npm, PyPI, apt, and dnf packages — results are visible in the dashboard before approval.
Before a package is installed: the agent fetches the expected SHA-256 from the server, downloads the artifact, verifies the hash. Mismatch blocks the install. OSV.dev is queried for known vulnerabilities at discovery time (async, deduped) for npm, PyPI, apt, and dnf packages — results are visible in the dashboard before approval. The resolved dependency closure is checked too: every transitive artifact the capability token would authorize is queried before the token is minted, not just the package you named.
**Refresh-token rotation (90-day TTL).** Each renewal mints a new refresh token (90-day expiry) and marks the old one consumed. Replaying a consumed token whose successor was also consumed means theft — the server revokes the entire token family and logs a security event. Agent crash-before-save is covered by accept-previous-once grace: a consumed token whose successor is still unconsumed gets a fresh one, not a revocation.