nils/mg4
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 28 Wiki Activity

Server 2.6.2: log update checks and downloads; Go 1.27.3

Browse Source 
The update relay logs every check (car, number of releases, newest
pre-release) and every download (car, file, size, then bytes and time,
or that it was cut short); never the forge's address or token, tested.
Go 1.27.3 for the build image and toolchain: govulncheck had found
GO-2026-6809 in crypto/x509 under 1.26.9; source and binary now clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6
This commit is contained in:
nils
2026-10-25 22:40:23 +01:00
co-authored by Claude Opus 5.5
parent 76a6213126
commit acb7e1969e
7 changed files with 81 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/README.md
+5
View File
@@ -52,6 +52,11 @@ with download URLs pointing back at this server, and their attachments streamed
repository stays private and the forge token never reaches the car; redirects away from the
forge are not followed. The car verifies everything itself (`OTA.md`). 404 when unset.
Each check and each download is logged with the car's installation ID ("shared token" for the
shared ingest token): `update check` (how many releases, the newest pre-release), `update
download started` (file, size), then `update handed out` (bytes sent, time taken) or `update
download cut short`. The forge's address and token never appear in the log.
## Settings from a phone
The ABRP credentials are long to type on the car. With pairing on, the car (with its own token)