1.0.7RoachNet for macOS
On this page
1.0.7's installer is withdrawn: its programs carried the names of folders on the Mac it was built on, and later releases fix security problems it has. Use the current release.
RoachNet 1.0.7 is a security and content patch for 1.0.6. It closes a DNS-rebinding hole in the local API, makes every local service refuse requests from other websites, brings the bundled library catalog back in line with what Kiwix serves, and updates the bundled Ollama to 0.40.3. RoachWares tested it by hand. RoachNet 1.1.0 includes every fix below.
Security fixes
- DNS rebinding through look-alike names. 1.0.6 accepted any
Hostheader that started with127.as local.127.<some domain>is an ordinary DNS name, so a web page could point one at your Mac and read or drive the local RoachNet API while RoachNet was running. The 1.0.6 notes said Host checks closed DNS rebinding; this case slipped through. The runtime and the setup service now accept onlylocalhost,::1and dotted-quad127.x.x.xaddresses. - Cross-site requests. Every local service (runtime API, setup service, and the JavaScript fallbacks Setup uses when the native helper is missing) now refuses a request whose
Originis another site, and refuses request bodies that are not JSON. Browsers can no longer fire requests at them from a web page, including bodiless ones. - Download descriptors are only opened from
https://apps.roachnet.org/downloads/. Any other.jsonlink downloads as the file it names, so no other host can redirect a download. - Error responses no longer echo non-error values back to the caller.
- The release workflow no longer uses a dependency cache in its privileged jobs.
These turned up while working through the repository's code-scanning alerts.
Other changes
- Library catalog refreshed. 1.0.6 shipped the June catalog, and 124 of its Kiwix downloads no longer resolved. Every title is re-pinned to the version the Kiwix library serves, 20 titles their publishers withdrew are hidden from the installers, and 10 titles are new: MDWiki, WikEM, Ready.gov, Simple English Wikipedia, DevDocs (JavaScript, Python, SQLite, HTML), the OpenStreetMap wiki and RationalWiki. The catalog matches apps.roachnet.org.
- Bundled Ollama 0.40.3, checksum-verified against the GitHub release (same file list as 0.40.2). Upstream changes: background model upgrades pause while requests run, and two launch-command warnings are gone.
- 1.1 feature packs in the store. apps.roachnet.org lists the RoachSpeech feature packs that install through RoachNet 1.1. Asking 1.0.7 (or the iOS companion paired with it) to install one says it needs RoachNet 1.1, instead of "unknown install action".
Opening the installer
This build is ad-hoc signed and not Apple-notarized, like 1.0.6. On first launch macOS says RoachNet Setup can't be verified: open System Settings › Privacy & Security and choose Open Anyway for RoachNet Setup. Verify the download first:
shasum -a 256 -c RoachNet-Setup-macOS.dmg.sha256Upgrade, roll back or remove
- Upgrade: quit RoachNet and run Setup over the existing install.
~/RoachNet/storage(Vault, settings, models) is kept. Back it up first if you can. - Roll back: 1.0.6 and 1.0.7 use the same storage format, but going back to 1.0.6 brings the security hole back.
- Remove: quit RoachNet, then remove
~/RoachNet/appand~/RoachNet/runtime. Keep~/RoachNet/storageto keep your data.
Known issues
| Limitation | Impact | Workaround |
|---|---|---|
| Ad-hoc signed, no Developer ID or notarization. | Gatekeeper blocks the first launch of RoachNet Setup. | Open Anyway in Privacy & Security, once. |
| The bundled Ollama 0.40.3 has the same open upstream advisories as 0.40.2 (crafted-model and crafted-request denial of service, no auth on model management), with no fixed version. | Another process on the same Mac could crash Ollama or manage its models. | Ollama binds to 127.0.0.1 and checks the Host header, so web pages and other machines can't reach it. 1.1 replaces it with RoachNet's native engine. |
| Network features (catalogs, maps, archives, updates, model downloads, remote providers) need a connection. | They can't refresh or download offline. | Download content and local models ahead of time. |
| Windows and Linux installers are not shipped. | — | Use an Apple Silicon Mac. |
How this release was built
These notes match the tagged source and the test results recorded with it. RoachWares built and tested the DMG by hand on its release Mac rather than in hosted CI, because a hosted build needs Apple Developer ID and notarization credentials, and RoachNet doesn't have those yet.