* security: validate and atomically install Tor config
* fix: harden candidate generation and HiddenServiceDir handling
Address review blocking findings:
- Replace sed|awk|tee pipelines with generateTorrcCandidate() which
checks every stage explicitly and refuses empty/truncated candidates
before installTorrc ever runs (both add and removal paths)
- Stop sourcing joinin.conf; read values with a grep-based helper
- Validate HiddenServiceDir against the expected Tor data roots
(/var/lib/tor, /mnt/hdd/tor) so a crafted value cannot inject Tor
directives into the candidate
- Quote HiddenServiceDir path expansions
* fix: keep torrc staging writes inside the privileged pipeline
Addresses re-review: sudo mktemp made the stage file root-owned while the
shell redirect ran unprivileged (EACCES on every add/remove path).
* fix: enable pipefail so failed torrc producers are detected
Without pipefail the 'sudo sed|sudo tee' and 'sudo awk|sudo tee' pipelines
only observed tee's status, so a producer failing after partial output could
yield a truncated candidate that still passes tor --verify-config.
---------
Co-authored-by: autoblitzbot <autoblitzbot@users.noreply.github.com>
* security: parse joinin.conf as data instead of sourcing it as code
* fix: guard sourceConf availability in _functions.bitcoincore.sh
---------
Co-authored-by: autoblitzbot <autoblitzbot@users.noreply.github.com>
* fix(ci): make image builds noninteractive
Both image builds fail in packer:
- arm64-rpi: dpkg halts on the interactive initramfs.conf conffile
prompt (Y/I/N/O/D/Z) during 'apt-get upgrade' kernel configuration,
then cascades: E: Sub-process /usr/bin/dpkg returned an error code (1)
- amd64: debconf falls back through Dialog/Readline/Teletype frontends
(no controlling tty) and the build later fails on
'E: Package netcat has no installation candidate' - the netcat
metapackage was removed in Debian trixie
Fixes:
- export DEBIAN_FRONTEND=noninteractive and install an apt.conf.d
dropin with Dpkg::Options --force-confdef/--force-confold so conffile
prompts resolve to the default action and keep the existing config
(build_joininbox.sh and the amd64 update.sh kernel upgrade)
- install netcat-openbsd when the netcat metapackage is unavailable
* feat(ci): skip code signature verification on PR builds, label images
PR CI builds pull head commits from forks which are not signed by the
maintainer keys, so the mandatory PGP verification in
build_joininbox.sh fails every PR image build:
# BUILD FAILED --> PGP verification not OK / signature(0) verify(0)
Behavior after this change:
- pull_request workflow runs pass the PR number through the packer
build chain (workflow -> build script -> packer var -> provisioner
env -> JOININBOX_PR_NUMBER)
- build_joininbox.sh skips the source signature verification when
JOININBOX_PR_NUMBER is set, prints a prominent warning, and labels
the image in /etc/joininbox-build-info as an UNVERIFIED test build
- the uploaded artifact name carries a -pr<N> suffix via BUILD_VERSION
- push-to-master and workflow_dispatch builds never set the variable,
so production images keep mandatory verification
* fix(ci): drop apt policy after build, warn on PR images in main menu
- Remove /etc/apt/apt.conf.d/90joininbox-noninteractive at the end of
build_joininbox.sh: the noninteractive dpkg conffile policy is a
build-time measure and must not ship in deployed images, where
interactive conffile handling is the default again
- Show '!!! UNVERIFIED PR BUILD #<N> - TESTING ONLY !!!' on top of the
main menu whenever /etc/joininbox-build-info is present, so a flashed
PR image cannot be mistaken for a production build
---------
Co-authored-by: autoblitzbot <autoblitzbot@users.noreply.github.com>
* chore: update wallet creation to use watch-only-descriptor-wallet
* remove duplicate version check
* fix: update release URL in install script and correct typo in wallet import message
* ci: test amd64 image descriptor wallet migration with Bats
* ci: boot amd64 image tests with OVMF pflash
* fix: gate descriptor wallet migration on Bitcoin Core v30
Detect the connected Bitcoin Core version over RPC before migrating.
Keep wallet.dat for v29.x or when the version cannot be determined.
Add regression coverage for both migration and compatibility paths.
* ci: make amd64 image tests independent of guest apt
Inject a pinned bats-core checkout into the temporary VM instead of
installing Bats through the guest package repositories.
Remove the duplicate pull request trigger and simplify artifact lookup.
* ci: harden image build run
* docs(FAQ): how automatic migration works
This PR updates JoinMarket to the latest tested commit with Python 3.12/3.13 support and addresses dialog display issues.
### Changes
#### JoinMarket Update
- Update to commit `ce32baf` (latest tested commit from master)
- Refactored install.joinmarket.sh to support both tag-based and commit-based installations
- Improved signature verification using verify.git.sh
- Updated menu.update.sh to display commit hash when using commit-based version
#### Python Support
- Added support for Python 3.12 and 3.13
- Changed version detection order to prefer newer Python versions (3.13 → 3.12 → 3.11 → 3.10 → 3.9 → 3.8)
#### Dialog Fixes
- **Fix border visibility**: Changed dialog border color from `(BLACK,BLACK,ON)` to `(CYAN,BLACK,ON)` in .dialogrc for better visibility
- **Terminal compatibility**: Added fallback for unknown terminal types (e.g., `xterm-ghostty`) by setting `TERM=xterm-256color` when `infocmp` fails
- **Fix box drawing characters**: Set `NCURSES_NO_UTF8_ACS=1` to fix dialog box rendering issues
#### Documentation
- Fixed typo in prepare_remote_node.md: "numbes" → "numbers"
* joinmarket update to v0.9.11
* remove deprecated install tweak
* remove pyhton 3.7 support
* stop using system-side PySide2
* don't install the QT Gui on ARM
* format start.joininbox.sh
* remove arm specific qtgui deps, no qtgui on build for arm
* don't protect system packages from pip install
* add libltdl-dev to apt-get packages
* build: create home folders as 0755 on Debian 12
* build: add bash
* fix: add --shell /bin/bash to user creation
* copy the skeleton files for users with login
* update workflows
* jam-remote update to v0.1.6
* amd64 image update to debian-12.2.0, clean vars
* fix: fix echo-s and format
* feat: add pruned.host4coins.net/blocks, fix data owner
* fix: check bitcoin install permission
* fix: prefer downloads over ipv4
* add hashFileSigName
* update to debian-12.0.0-amd64-netinst image
* fix the owner of the decompressed blocks
* delete old blocks and chainstates
