The deaddrop 4.11.0 release

This update contains mostly fixes, but contain also system changes and application changes.

Upgrade to Sysctl Linux 44

  • Deaddrop is now based on Sysctl Linux 44.
  • Existing installations are upgraded to Sysctl Linux 44 by the upgrade service.

Bug fixes

  • The file size of a dispatched file would be missing if the metadata lookup failed.
  • The “Add a new contact” button would still be shown when local contacts were disabled.
  • Setting upstream_repo_proxy_usr or upstream_repo_proxy_pwd in admin.conf would break the upgrade proxy configuration.
  • Invalid SMS messages could not be moved to the error directory.
  • A regression in 4.7.0 caused saving the SMS gateway configuration in ddadm to replace text values with 1.
  • The TDC SMS gateway would fail to connect when TDC_SSL_Verify was set to 1.
  • Restarting deaddrop would log out all users. Sessions now survive up to four restarts.
  • The time-to-live slider would sometimes start at the maximum instead of the default TTL.
  • Reset to default in the ddadm brand editor would ask for confirmation twice.
  • Activating brands several times in quick succession could fail.
  • Regression since 4.7.0 where API users created via add_account.pl (passing the “api” flag), would have an initial plaintext password. This may not affect you, in case you followed the documentation step: htpasswd -bBC6 /var/deaddrop/html/api\@sysctl.se/.htpasswd api@sysctl.se API_KEY.

Documentation

  • Corrected the dns= line in the static IP example of the system documentation.
  • The ADFS and Keycloak SAML manuals now recommend ShibCompatValidUser On instead of Off.

Features

  • In addition to the scheduled run, upgrades are checked for 1–21 minutes after boot, so an OS upgrade no longer waits a week for its second step.
  • Upgrades now trigger a reboot when needed, e.g. after a kernel update.
  • New gateway.conf setting Sergel_SMS_Gateway_platformId, previously fixed to SMSC.
  • New gateway.conf setting smseagle_ssl_verify, to disable TLS certificate verification towards the SMSEagle gateway. Default 1.

Other

  • Existing SAML configurations with ShibCompatValidUser Off in /opt/sysctl/deaddrop/etc/deaddrop/conf.d/shibd.conf, as previously recommended by the documentation, are changed to ShibCompatValidUser On on upgrade, for compatibility with upcoming features.

Security Hardening

  • New hardened Go service: watermarkd, which replaces watermarkd.pl for watermarking PDFs. Runs with a private temporary file system.
  • Fixed input sanitization in dispatchd.
  • Fixed input sanitization in outgoing e-mail.

Operating system packages

All system components have been updated to their latest respective version.

Update Instructions

If you have default update configuration, Deaddrop releases will be automatically installed as part of the regular update process. No manual steps are required from administrators or users. The system will apply the update seamlessly in the background, ensuring that the latest fixes are in place without any interruption to normal operations.

Documentation

Further details and configuration guidance are available in the official documentation:

https://sysctl.se/deaddrop/documentation/

SBOM

Each ISO and VHD release has a software bill of materials (SBOM) to make introspection of the release easy to integrate with a number of security tools. Current and historical SBOMs are available for download at the customer portal.

Sysctl web page

https://www.sysctl.se

Sysctl page for Deaddrop releases

https://sysctl.se/deaddrop/releases/

Sysctl documentation for Deaddrop

https://sysctl.se/deaddrop/documentation/

Sysctl customer portal

https://portal.sysctl.se/

Sysctl rss/atom

https://sysctl.se/feed.xml