Internet.nl Versions Save

Release 1.8.5 contains a hotfix for the sectxt library failing on leap days.

To upgrade from a previous Docker release (note it may take several minutes after this release for the packages to be available):

RELEASE=1.8.5 && \
TAG=v1.8.5 && \
cd /opt/Internet.nl/ && \
curl -sSfO --output-dir docker https://raw.githubusercontent.com/internetstandards/Internet.nl/${TAG}/docker/defaults.env && \
curl -sSfO --output-dir docker https://raw.githubusercontent.com/internetstandards/Internet.nl/${TAG}/docker/docker-compose.yml && \
env -i RELEASE=$RELEASE docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env pull && \
env -i RELEASE=$RELEASE docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env up --remove-orphans --wait --no-build

There are no database (version) migrations compared to earlier 1.8 releases, so no special instructions for a downgrade to the previous release.

Release 1.8.4:

• Updates unbound to 1.19.1-internetnl to fix CVE-2023-50387 and CVE-2023-50868.
• Restricts HTTPS redirects to the same domain, no longer allowing directions to a subdomain first (#1208).
• Updates a number of other dependencies.
• Fixes an issue where certbot renewals were not correctly run.

To upgrade from a previous Docker release (note it may take several minutes after this release for the packages to be available):

RELEASE=1.8.4 && \
TAG=v1.8.4 && \
cd /opt/Internet.nl/ && \
curl -sSfO --output-dir docker https://raw.githubusercontent.com/internetstandards/Internet.nl/${TAG}/docker/defaults.env && \
curl -sSfO --output-dir docker https://raw.githubusercontent.com/internetstandards/Internet.nl/${TAG}/docker/docker-compose.yml && \
env -i RELEASE=$RELEASE docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env pull && \
env -i RELEASE=$RELEASE docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env up --remove-orphans --wait --no-build

There are no database (version) migrations compared to earlier 1.8 releases, so no special instructions for a downgrade to the previous release.

Release 1.8.3 fixes an issue where HSTS and CSP headers were missing from the www-subdomain of the main domain (#1210, #1211).

To upgrade from a previous Docker release (note it may take several minutes after this release for the packages to be available):

RELEASE=1.8.3 && \
TAG=v1.8.3 && \
cd /opt/Internet.nl/ && \
curl -sSfO --output-dir docker https://raw.githubusercontent.com/internetstandards/Internet.nl/${TAG}/docker/defaults.env && \
curl -sSfO --output-dir docker https://raw.githubusercontent.com/internetstandards/Internet.nl/${TAG}/docker/docker-compose.yml && \
env -i RELEASE=$RELEASE docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env pull && \
env -i RELEASE=$RELEASE docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env up --remove-orphans --wait --no-build

There are no database (version) migrations compared to earlier 1.8 releases, so no special instructions for a downgrade to the previous release.

Fixes an issue where the connection test would fail to start in certain cases due to an incorrect HTTP downgrade (#1194, #1195).

To upgrade from a previous Docker release (note it may take several minutes after this release for the packages to be available):

RELEASE=1.8.2 && \
TAG=v1.8.2 && \
cd /opt/Internet.nl/ && \
curl -sSfO --output-dir docker https://raw.githubusercontent.com/internetstandards/Internet.nl/${TAG}/docker/defaults.env && \
curl -sSfO --output-dir docker https://raw.githubusercontent.com/internetstandards/Internet.nl/${TAG}/docker/docker-compose.yml && \
env -i RELEASE=$RELEASE docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env pull && \
env -i RELEASE=$RELEASE docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env up --remove-orphans --wait --no-build

There are no database (version) migrations compared to 1.8.2, so no special instructions for a downgrade to the previous release.

Version 1.8.1 has a number of internal improvements, including:

• Various improvements in the build setup, including building forks.
• Improvements in logging quality and reducing log volume.
• Corrections in the deployment test suite.
• Improved error handling in TLS certificate requests in deployments.

There are no changes to functionality or requirements of the tests for users.

To upgrade from a previous Docker release (note it may take several minutes after this release for the packages to be available):

RELEASE=1.8.1 && \
TAG=v1.8.1 && \
cd /opt/Internet.nl/ && \
curl -sSfO --output-dir docker https://raw.githubusercontent.com/internetstandards/Internet.nl/${TAG}/docker/defaults.env && \
curl -sSfO --output-dir docker https://raw.githubusercontent.com/internetstandards/Internet.nl/${TAG}/docker/docker-compose.yml && \
env -i RELEASE=$RELEASE docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env pull && \
env -i RELEASE=$RELEASE docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env up --remove-orphans --wait --no-build

There are no database (version) migrations compared to 1.8.0, so no special instructions for a 1.8.1->1.8.0 downgrade.

• A new Docker based deployment, development, testing and CI setup has been added to replace all previous processes. See the documentation overview for how to use this.
• The test for Referrer-Policy has been updated to check for a sufficiently secure and valid policy.
• The security.txt test now checks the Canonical field as well.
• Updated to version 0.8.3 of the sectxt library including validation of CSAF fields.
• RFC9091 np= is now permitted in DMARC policies.
• The Content-Security-Policy check now requires explicit https: scheme and an issue was fixed where 'none' combined with other sources was incorrectly accepted.
• The IPv4/IPv6 similarity test was relaxed to a notice when the response contents are different.
• Fixed incorrect handling of IPv6-mapped IPv4 addresses in the RPKI test.
• Improved attributes in input fields for improved user experience.
• Fixed an issue in footer alignment.

This release has API version 2.4.0:

• The referrer_policy_errors and referrer_policy_recommendations fields were added. These contain errors and/or recommendations regarding the Referrer-Policy test.
• https_redirect can now also have “no_https” as status, for a web server that offers either no HTTPS or HTTPS with a very outdated, insecure TLS configuration, as in this case the redirect is not evaluated.

To update an existing Docker deployment to this version:

export RELEASE="1.8.0" && \
export TAG="v$RELEASE" && \
cd /opt/Internet.nl/ && \
curl -sSfO --output-dir docker https://raw.githubusercontent.com/internetstandards/Internet.nl/$TAG/docker/defaults.env && \
curl -sSfO --output-dir docker https://raw.githubusercontent.com/internetstandards/Internet.nl/$TAG/docker/docker-compose.yml && \
env -i RELEASE="$RELEASE" docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env pull && \
env -i RELEASE="$RELEASE" docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env up --remove-orphans --wait --no-build

For new Docker-based deployments, see the Docker documentation overview.

See https://github.com/internetstandards/Internet.nl/blob/main/Changelog.md

Pre release to test Docker builds only

• Fixed the new display of TLS versions for mail tests.
• Fixed a language mix-up in the security.txt labels.
• Fixed an issue with the connection test and CSP form-action.

(1.7.0 was actually released on April 11th)

• Added specific error messages in the technical details for Content-Security-Policy results.
• Added requirements for base-uri and form-action to the Content-Security-Policy test.
• Added translations for security.txt error messages.
• The TLS versions tech table now shows the detected TLS versions instead of only TLS versions with issues.
• Fixed an uncaught exception in the security.txt text which could cause the entire test to fail for some HTTP responses.
• Corrected handling of bogus TLSA records.
• A bare "https:" is no longer allowed in Content-Security-Policy as it matches any HTTPS host.
• Loosened requirement for null MX when a domain has no A or AAAA.
• Fixed an issue where the frame-src test was inconsistent with the documentation.
• Added the version number to the footer.
• Added Sentry support for error reporting.
• Code quality was cleaned up in various places.
• Dependencies were updated.

This release has API version 2.3.0:

• The record_org_domain was added for DMARC (#489).
• The securitytxt_errors and securitytxt_recommendations types were changed. They now contain error codes (and possibly context) rather than full sentences.
• The content_security_policy_errors field was added with error codes for CSP.
• An issue was fixed where the mx_nameservers field was not included in results (#882).