You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
NET-10: retire inherited FTP listener and bftpd payload #629
Program mapping\n\nNET-10 inherited service retirement.\n\n## Problem\n\nBloom still carries the inherited unencrypted bftpd runtime, anonymous/authenticated configs, dormant start logic, and Tweaks/docs surface even though the reviewed public-key-only SFTP service is the supported transfer path. The compatibility dispatcher is already fail-closed, but shipping the binary leaves unnecessary listener-capable payload and stale user affordances.\n\n## Scope\n\n- remove the bftpd and bftpdutmp payload plus inherited configs\n- remove all bftpd start/auth logic and the Tweaks FTP menu/toggle\n- retain upgrade cleanup of .ftpState / .authftpState and exact bftpd termination\n- replace current FTP documentation with an explicit retirement/migration route to SSH/SFTP\n- regenerate provenance/payload metadata and validate affected host/ARM surfaces\n\n## Safety\n\nNo device mutation is required for this host-safe slice. Historical versioned Onion documentation remains historical. Reviewed key-only SFTP is out of scope and must remain intact.
A signed Full Mini Plus checkpoint on confirmed v0.1.0-dev-3a828a29 found that the retired FileBrowser and bftpd executables are absent and all eight stale network enablement flags are absent, but three inactive upgrade remnants remain: config/filebrowser, config/bftpd.conf, and config/bftpdauth.conf. The FileBrowser directory contains only the known database and theme paths; no database or credential contents were inspected. An independent listener audit is clean with only reviewed key-only SSH.
This is now the concrete remaining #629 device gap: add upgrade-safe removal for those inactive paths, preserve rollback safety, validate it without reading credential contents, and recheck health/listeners. Structured checkpoint evidence is in docs/validation/network/plus-interactive-ssh-lockdown-20260831.json on PR #646.
Signed Mini Plus checkpoint for exact head 32b9639631f85dc650d62c8476044e84ba0dedd5:
all six required hosted checks passed and the PR is clean to merge
hardware workflow 33468134131 succeeded
the 185,671,287-byte archive matched SHA-256 483075fbc0bf19c9d62960a3d03e8bf5de38e71411e07877f24aeee6b8bb0b35
build metadata matched exact commit/version, release metadata and payload inventory validated, the Ed25519 signature verified, and the migration inside onion.pak matched reviewed source SHA-256 14f963188d4df492fcf0f0b7962dcd8d7f7763f01d192161856f96e8a1f9b947
baseline was confirmed 0.1.0-dev-3a828a29, aggregate health green, five snapshots verified, network transaction idle, developer overlay inactive, listener audit clean with only key-only SSH, and all three retired config remnants present without reading their contents
strict transfer completed with exact byte count and device-side SHA-256; stage and prepare passed
activation created pre-update snapshot 20260901T041533Z-pre-update-1411 and entered activation_pending
after one controlled reboot, the device went offline at 5 seconds but did not return on the pinned address within the full 20-minute window; ping, TCP/22, and ARP remained absent at 23 minutes
no second reboot, rollback request, merge, or completion claim was made
A source comparison from the confirmed candidate to this head found no Wi-Fi/network runtime changes; the only added runtime path is 00024_remove_retired_network_configs.sh. Physical power/visible-state access is now required before installed version, rollback outcome, config removal, health, and listeners can be checked. PR #652 remains open and unmerged.
Activity
boburning commentedon Sep 1, 2026
A signed Full Mini Plus checkpoint on confirmed
v0.1.0-dev-3a828a29found that the retired FileBrowser and bftpd executables are absent and all eight stale network enablement flags are absent, but three inactive upgrade remnants remain:config/filebrowser,config/bftpd.conf, andconfig/bftpdauth.conf. The FileBrowser directory contains only the known database and theme paths; no database or credential contents were inspected. An independent listener audit is clean with only reviewed key-only SSH.This is now the concrete remaining #629 device gap: add upgrade-safe removal for those inactive paths, preserve rollback safety, validate it without reading credential contents, and recheck health/listeners. Structured checkpoint evidence is in
docs/validation/network/plus-interactive-ssh-lockdown-20260831.jsonon PR #646.boburning commentedon Sep 1, 2026
Signed Mini Plus checkpoint for exact head
32b9639631f85dc650d62c8476044e84ba0dedd5:483075fbc0bf19c9d62960a3d03e8bf5de38e71411e07877f24aeee6b8bb0b35onion.pakmatched reviewed source SHA-25614f963188d4df492fcf0f0b7962dcd8d7f7763f01d192161856f96e8a1f9b9470.1.0-dev-3a828a29, aggregate health green, five snapshots verified, network transaction idle, developer overlay inactive, listener audit clean with only key-only SSH, and all three retired config remnants present without reading their contents20260901T041533Z-pre-update-1411and enteredactivation_pendingA source comparison from the confirmed candidate to this head found no Wi-Fi/network runtime changes; the only added runtime path is
00024_remove_retired_network_configs.sh. Physical power/visible-state access is now required before installed version, rollback outcome, config removal, health, and listeners can be checked. PR #652 remains open and unmerged.