We replaced the jwtauth and jwx libraries with a minimal custom wrapper
around go-jose because we don’t need the full feature set provided by jwx.
Implementing our own wrapper simplifies the codebase and improves
maintainability.
Moreover, go-jose depends only on the standard library, resulting in a
leaner dependency that still meets all our requirements.
This change also reduces the SFTPGo binary size by approximately 1MB
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
rsync was executed as an external command, which means we have no insight
into or control over what it actually does.
From a security perspective, this is far from ideal.
To be clear, there's nothing inherently wrong with rsync itself. However,
if we were to support it properly within SFTPGo, we would need to implement
the low-level protocol internally rather than relying on launching an external
process. This would ensure it works seamlessly with any storage backend,
just as SFTP does, for example.
We recommend using one of the many alternatives that rely on the SFTP
protocol, such as rclone
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
The Azure Trusted Signing certificate is expiring soon, and renewal is no
longer available for individuals or organizations outside of Canada and USA.
Due to this limitation, we are removing the Trusted Signing step from our
CI pipeline.
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
EnabledCommands are initialized after the migration so allow any
command, they will be denied if not allowed and this is temporary.
The migration will be removed in the future
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
Azure login tokens now appear to expire after 5 minutes.
To avoid authentication issues, the login step is now performed
immediately before signing the binaries.
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
- Updated the "Sponsors" section to reflect the current open-core model
- Clarified that sponsorship supports the open-source edition
- Improved "Support" section to distinguish community vs. Enterprise support
- Added instructions on selecting the correct documentation version
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
As per the documentation for external authentication, provider actions
should not be executed post-authentication.
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
Folders and groups now retain their initial order, improving compatibility
and predictability when used with Terraform
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
Git integration has been removed as it is out of scope for a file transfer
solution like SFTPGo.
Maintaining Git support introduces unnecessary complexity and potential
security risks due to reliance on system commands.
In particular, allowing Git operations could enable authorized users to
upload repositories containing hooks, which might then be executed and abused.
To reduce the attack surface and simplify the codebase, Git support has been
fully dropped.
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
