* security: write files atomically through an exclusive temp file (CWE-59, CWE-377)
Save, export, plot, autosave and the audit log each wrote their output by
putting bytes in a predictable sibling temporary path (`<path>.cadcraft-tmp`,
`<recovery>.tmp`, or the companion `.adt`) and renaming it over the real file.
Opening that pre-existing temporary path for a truncating write follows a
symlink planted there by another local user, letting them redirect the write
onto any file the victim can write before the rename.
Add a shared `atomic_write` helper that creates a fresh temporary file with
`create_new` (O_CREAT|O_EXCL) in the destination directory, writes through the
retained handle, flushes/syncs, and atomically renames it into place. An
existing entry (symlink or not) makes the exclusive create fail instead of
being followed. Route autosave, save, export, plot and the audit log through it.
The macOS CI cert importer likewise wrote the decoded PKCS#12 container to a
fixed name in a possibly shared temp directory; it now creates a private
per-run directory with `mktemp -d` and creates the file with noclobber.
Addresses findings rows 1, 25, 40 (CWE-59) and 19 (CWE-377).
* fix: preserve permissions during atomic replacement
* fix: restrict temporary permissions during exclusive creation
---------
Co-authored-by: skylartaylor <26588250+skylartaylor@users.noreply.github.com>
- release.yml: new `linux-riscv64` job (ported from GridCraft): cross-compiles on ubuntu-24.04
against ports.ubuntu.com riscv64 libraries, packages a tar.gz, smoke-tests the CLI under
QEMU. The draft-release job now needs it, so SHA256SUMS covers the tarball.
- packaging/linux/package.sh: CROSS_ARCH / CROSS_TARGET / CROSS_COMPILE / EMULATOR support.
- README Downloads and docs/releasing.md list the riscv64 tarball.
- Version 0.4.0 -> 0.5.0 (cargo xtask version set), Cargo.lock refreshed.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The MSI gets a setup wizard (WixUI dialogs, no licence or folder page) with a
Shortcuts page: the Start Menu shortcut as before, plus an opt-in "Create a
desktop shortcut" checkbox bound to DESKTOPSHORTCUT. Silent installs take
DESKTOPSHORTCUT=1. The shortcut goes on the all-users desktop (per-machine
install) in its own component with an HKCU key path (ICE38/43/57), so
uninstall removes it; upgrades read that value back and keep the previous
choice unless DESKTOPSHORTCUT is given.
The build now needs WixToolset.UI.wixext 5.0.2 (release workflow and
package.ps1 updated).
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The DMG opened as a plain Finder window. It now shows the app icon's figure on
the CADCraft colour, with CADCraft.app and the Applications link side by side.
Same approach as PhotoCraft's and VectorCraft's (storytold/photocraft#1201,
storytold/vectorcraft#493).
- packaging/macos/dmg/: background.svg (source; text outlined, no paper grain,
the figure an <image> of assets/app-icon), background.tiff (1x + 2x HiDPI,
16-colour palette, Deflate, sRGB; ~21 KB)
and dmg-layout.DS_Store (Finder view settings: window, icon size 128,
positions, background).
- generate.py writes the TIFF and the layout on any OS, byte-for-byte
reproducible, with nothing from the machine that ran it (no paths, users,
disk names or volume UUIDs).
- package.sh copies them into the staging folder; the image is still built with
hdiutil makehybrid. Nothing extra runs in the signing job.
- The volume name drops the version: the layout finds the background through
an alias that includes the volume name. The DMG file name keeps the version.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Release: Flatpak x86_64/aarch64, AppImage zsync updates, README Downloads
- AppImages embed gh-releases-zsync update information and ship a .zsync beside them.
- New flatpak job repackages each Linux tarball into cadcraft-<ver>-linux-<arch>.flatpak
(bundle manifest + flatpak-bundle.sh); the from-source Flathub manifest moves to runtime
26.08 with the same commented, minimal finish-args (packaging-lint checks they agree).
- Jobs that sign nothing (version, linux, flatpak, freebsd, web) leave the release
environment, so a branch dispatch is a dry run; the draft-release job runs only on release.
- README: Downloads section listing every build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Release: check AppImage update info without extract-and-run; fix the deb/rpm description
APPIMAGE_EXTRACT_AND_RUN makes the runtime pass --appimage-updateinformation to the app.
The package description was PhotoCraft's.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <shared2@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Workflows and packaging adapted from the craftrules playbook (release environment with the twelve
signing secrets, new WiX upgrade code, .dxf/.dwg file associations), app icon set (hicolor, icns,
ico), docs/releasing.md. MTEXT now opens a text editor window for its contents.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
