diff --git a/NOTICE b/NOTICE
@@ -5,11 +5,11 @@ This project is licensed under the MIT License (see LICENSE).
transtation itself contains no third-party source code. It is a set of shell
scripts and one Dockerfile. The server image redistributes third-party binaries
-unmodified; the client installer downloads one rather than shipping it. Their
-licenses and obligations follow.
+unmodified; the native server install and the client install download them from
+upstream and verify them instead. Their licenses and obligations follow.
================================================================================
-Xray-core -- redistributed in ghcr.io/sqzer-x/transtation
+Xray-core -- redistributed in the image; downloaded by the native installer
================================================================================
Xray-core is licensed under the Mozilla Public License, Version 2.0 (MPL-2.0).
@@ -24,6 +24,11 @@ The `xray` binary in our image is the official upstream release artifact,
byte-for-byte unmodified. We do not patch, recompile, or statically link it
into anything. It is copied into the image as-is.
+The native install (`install.sh server --native`) does not redistribute it at
+all: it downloads the same release artifact from the URL above at install time,
+verifies it against the `.dgst` published with that release, and installs it
+under /usr/local/lib/transtation.
+
The Source Code Form of Xray-core is governed by the MPL-2.0. A copy of that
license is available at https://mozilla.org/MPL/2.0/ and is distributed with
the upstream source at the URL above.
@@ -33,7 +38,7 @@ licenses (CC-BY-SA / GPL-3.0 depending on the dataset) and none of them apply
here.
================================================================================
-wgcf -- redistributed in ghcr.io/sqzer-x/transtation
+wgcf -- redistributed in the image; downloaded by the native installer
================================================================================
wgcf is licensed under the MIT License.
@@ -45,7 +50,8 @@ wgcf is licensed under the MIT License.
The `wgcf` binary is the official upstream release artifact, unmodified. It is
used only once, at first boot, to register a Cloudflare WARP identity. It is
-not part of the data path.
+not part of the data path. As with Xray, the native install downloads and
+verifies it rather than redistributing it.
Upstream's own disclaimer, reproduced verbatim:
diff --git a/README.md b/README.md
@@ -4,8 +4,8 @@ Your own VLESS + REALITY proxy, with optional Cloudflare WARP egress, in one
container on any Linux box that has Docker.
```
-curl -fsSLO https://raw.githubusercontent.com/sqzer-x/transtation/v1.0.14/install.sh
-sha256sum install.sh # compare against the hash in the v1.0.14 release notes
+curl -fsSLO https://raw.githubusercontent.com/sqzer-x/transtation/v1.0.15/install.sh
+sha256sum install.sh # compare against the hash in the v1.0.15 release notes
less install.sh # please actually read it
sudo sh install.sh
```
@@ -46,8 +46,8 @@ how you feel about a container runtime on your VPS.
### In a container (default)
```
-curl -fsSLO https://raw.githubusercontent.com/sqzer-x/transtation/v1.0.14/install.sh
-sha256sum install.sh # compare against the hash in the v1.0.14 release notes
+curl -fsSLO https://raw.githubusercontent.com/sqzer-x/transtation/v1.0.15/install.sh
+sha256sum install.sh # compare against the hash in the v1.0.15 release notes
less install.sh # please actually read it
sudo sh install.sh
```
@@ -513,7 +513,9 @@ The Xray binary is verified inside the Dockerfile against the `.dgst` file from
the same GitHub release. That defends against a bad mirror or a truncated
transfer, **not** against a compromised upstream — Xray publishes no signatures.
sing-box publishes no checksum file at all, so its hashes are pinned in
-`client/Dockerfile` and reviewed as part of this repo.
+`install.sh` and reviewed as part of this repo. The native server install
+verifies Xray the same way the image does, against the `.dgst` from its own
+release, and wgcf against upstream's `checksums.txt`.
## What has been tested
diff --git a/install.sh b/install.sh
@@ -15,14 +15,12 @@
# last line. If the download is truncated, nothing runs.
set -eu
-VERSION=${TT_VERSION:-v1.0.14}
+VERSION=${TT_VERSION:-v1.0.15}
IMAGE_SERVER=${TT_IMAGE_SERVER:-ghcr.io/sqzer-x/transtation}
-IMAGE_CLIENT=${TT_IMAGE_CLIENT:-ghcr.io/sqzer-x/transtation-client}
# Filled in by the release workflow. A tag is mutable -- the same stolen-token
# compromise we already concede for Xray's .dgst would let someone retag
-# v1.0.14, and the hash-verified installer you read would vouch for nothing.
+# v1.0.15, and the hash-verified installer you read would vouch for nothing.
SERVER_DIGEST=${TT_SERVER_DIGEST:-}
-CLIENT_DIGEST=${TT_CLIENT_DIGEST:-}
# sing-box ships no checksum file, so these were computed once from the official
# release artifacts and are reviewed as part of this repo. The -musl builds are
@@ -62,7 +60,6 @@ step() { printf ' %-14s%s\n' "$1" "$2"; }
die() { printf '\ntranstation: %s\n\n' "$*" >&2; exit 1; }
server_image() { printf '%s:%s%s' "$IMAGE_SERVER" "$VERSION" "${SERVER_DIGEST:+@$SERVER_DIGEST}"; }
-client_image() { printf '%s:%s%s' "$IMAGE_CLIENT" "$VERSION" "${CLIENT_DIGEST:+@$CLIENT_DIGEST}"; }
need_root() {
[ "$(id -u)" = 0 ] || die "this needs root. Re-run as root, or with sudo:
|