diff --git a/CHANGELOG.md b/CHANGELOG.md index feb82d0..97bb10a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ All notable changes to this project are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses [Semantic Versioning](https://semver.org/). +## [0.7.2] - 2026-10-21 + +### Security + +- The image no longer trusts the eight eMudhra (emSign) intermediates whose private keys leaked in October 2026: certifi goes to 2026.10.19 and the system `ca-certificates` to the trixie-security release that distrusts them. Before, a certificate minted with those keys for any site was accepted, lyrics lookups included. + ## [0.7.1] - 2026-10-07 ### Fixed @@ -72,6 +78,7 @@ All notable changes to this project are documented here. The format follows [Kee - Lossy copies are written through a temp file and renamed, like encodes, so a half-written copy is never visible. - `force_reencode: true` purges the outputs once at startup. It used to purge them again on every periodic sync, which re-encoded the whole library every five minutes. +[0.7.2]: https://github.com/GeiserX/audio-transcode-watcher/releases/tag/v0.7.2 [0.7.1]: https://github.com/GeiserX/audio-transcode-watcher/releases/tag/v0.7.1 [0.7.0]: https://github.com/GeiserX/audio-transcode-watcher/releases/tag/v0.7.0 [0.6.2]: https://github.com/GeiserX/audio-transcode-watcher/releases/tag/v0.6.2 diff --git a/Dockerfile b/Dockerfile index 360ec06..a280d88 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,9 @@ FROM python:3.14-slim -# Install FFmpeg for transcoding +# Install FFmpeg for transcoding. The base image's ca-certificates 20250419 still +# trusts the compromised eMudhra intermediates; trixie-security distrusts them. RUN apt-get update && apt-get install -y --no-install-recommends ffmpeg \ + && apt-get install -y --only-upgrade ca-certificates \ && rm -rf /var/lib/apt/lists/* # Set working directory diff --git a/README.md b/README.md index 20b0fb5..76b2036 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ Keep one library in several formats: lossless for the archive, lossy for phones curl -fsSL -o config.yaml https://raw.githubusercontent.com/GeiserX/audio-transcode-watcher/main/config.example.yaml docker run -d --name audio_transcoder -e CONFIG_FILE=/app/config.yaml \ -v ./config.yaml:/app/config.yaml:ro -v /path/to/flac:/music/flac:ro -v /path/to/mp3:/music/mp3 \ - drumsergio/audio-transcoder:0.7.1 + drumsergio/audio-transcoder:0.7.2 ``` Edit `config.yaml` first so its outputs match the folders you mount; the example writes ALAC, MP3 and AAC. [Getting started](https://github.com/GeiserX/audio-transcode-watcher/blob/main/docs/getting-started.md) has Docker Compose and the full `docker run`. diff --git a/config.example.yaml b/config.example.yaml index 0769052..3827e0f 100644 --- a/config.example.yaml +++ b/config.example.yaml @@ -1,4 +1,4 @@ -# Audio Transcode Watcher Configuration (0.7.1) +# Audio Transcode Watcher Configuration (0.7.2) # ====================================== # # This configuration file defines the source folder and output destinations diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index 4a587f8..227292f 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -1,6 +1,6 @@ # Roadmap -Current version: **0.7.1** +Current version: **0.7.2** ## Completed diff --git a/docs/getting-started.md b/docs/getting-started.md index 7903e1e..2ae7636 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -29,7 +29,7 @@ outputs: ```yaml services: audio-transcoder: - image: drumsergio/audio-transcoder:0.7.1 + image: drumsergio/audio-transcoder:0.7.2 container_name: audio_transcoder environment: - TZ=Europe/Madrid @@ -60,6 +60,6 @@ docker run -d \ -v /path/to/flac:/music/flac:ro \ -v /path/to/mp3:/music/mp3 \ --restart unless-stopped \ - drumsergio/audio-transcoder:0.7.1 + drumsergio/audio-transcoder:0.7.2 ``` diff --git a/pyproject.toml b/pyproject.toml index f0e3625..891e460 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -5,7 +5,7 @@ build-backend = "hatchling.build" [project] name = "audio-transcode-watcher" -version = "0.7.1" +version = "0.7.2" description = "Watch a source folder and automatically transcode audio files to multiple formats" readme = "README.md" diff --git a/src/audio_transcode_watcher/__init__.py b/src/audio_transcode_watcher/__init__.py index f965fc4..1cadf7e 100644 --- a/src/audio_transcode_watcher/__init__.py +++ b/src/audio_transcode_watcher/__init__.py @@ -1,3 +1,3 @@ """Audio Transcode Watcher - Automatic audio file transcoding.""" -__version__ = "0.7.1" +__version__ = "0.7.2" diff --git a/uv.lock b/uv.lock index 5e45b37..c37f3fe 100644 --- a/uv.lock +++ b/uv.lock @@ -4,7 +4,7 @@ requires-python = ">=3.14" [[package]] name = "audio-transcode-watcher" -version = "0.7.1" +version = "0.7.2" source = { editable = "." } dependencies = [ { name = "mutagen" }, @@ -49,11 +49,11 @@ wheels = [ [[package]] name = "certifi" -version = "2026.1.4" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/e0/2d/a891ca51311197f6ad14a7ef42e2399f36cf2f9bd44752b3dc4eab60fdc5/certifi-2026.1.4.tar.gz", hash = "sha256:ac726dd470482006e014ad384921ed6438c457018f4b3d204aea4281258b2120", size = 154268, upload-time = "2026-01-04T02:42:41.825Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/e6/ad/3cc14f097111b4de0040c83a525973216457bbeeb63739ef1ed275c1c021/certifi-2026.1.4-py3-none-any.whl", hash = "sha256:9943707519e4add1115f44c2bc244f782c0249876bf51b6599fee1ffbedd685c", size = 152900, upload-time = "2026-01-04T02:42:40.15Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]]