Osmocom Open Build Service

osmo-s1gw_0.4.0.271.0a09.202603021800.dsc -> osmo-s1gw_0.4.0.271.0a09.202603031800.dsc Changed

@@ -2,7 +2,7 @@
 Source: osmo-s1gw
 Binary: osmo-s1gw, osmo-s1gw-cli
 Architecture: any
-Version: 0.4.0.271.0a09.202603021800
+Version: 0.4.0.271.0a09.202603031800
 Maintainer: Osmocom team <openbsc@lists.osmocom.org>
 Homepage: https://osmocom.org/projects/osmo-s1gw
 Standards-Version: 4.5.0
@@ -13,8 +13,8 @@
  osmo-s1gw deb net optional arch=any
  osmo-s1gw-cli deb utils optional arch=any
 Checksums-Sha1:
- ea0f04ba6099f175668d47005b1964fca0542bd4 16483180 osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz
+ cdab43f6e49b7f23e7733a2fd5624165beda20ac 16506748 osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz
 Checksums-Sha256:
- 0fbe8536fba3e5513b89a8aa9eaa4c3d4945c868f58a6a0b6df8b6c1930afa65 16483180 osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz
+ ad206117ef70506f380e0bd7dac27028f3d6d477edd723ff4661db4ee368558e 16506748 osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz
 Files:
- da77280387ecab3e4c1cf1a069067d93 16483180 osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz
+ 4014c873d4ab0c86d4da2e955e179549 16506748 osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/.tarball-version -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/.tarball-version Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/CHANGELOG.md -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/CHANGELOG.md Changed

@@ -1,5 +1,33 @@
 # CHANGELOG
 
+## v0.12.2 (2026-02-27)
+
+* Exclude `src/safe_erl_term.erl` from package.
+
+## v0.12.1 (2026-02-27)
+
+* Fix unsafe deserialization of Erlang terms in API responses (CVE-2026-21619).
+
+## v0.12.0 (2025-10-26)
+
+* Add short URL API `hex_api_short_url:create/2`.
+* Add OAuth API:
+  * `hex_api_oauth:device_authorization/3,4`
+  * `hex_api_oauth:poll_device_token/3`
+  * `hex_api_oauth:refresh_token/3`
+  * `hex_api_oauth:revoke_token/3`
+  * `hex_api_oauth:client_credentials_token/4,5`
+* Support 2FA authentication, any API request can now return `{error, otp_required | invalid_totp}`
+  if 2FA is required. The config option `api_otp` can be used to provide the TOTP code.
+* Differentiate between registry verification errors. `{error, unverified}` has been replaced with
+  `{error, bad_repo_name | bad_signature}`.
+* Support nested maps in `extra` package metadata field.
+
+## v0.11.0 (2024-12-03)
+
+* Use secure SSL defaults for OTP 25+.
+* Start inets and ssl applications.
+
 ## v0.10.3 (2024-06-28)
 
 * Fix `hex_api_release:retirement_params/0` type spec.

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/README.md -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/README.md Changed

@@ -90,6 +90,28 @@
 {ok, {200, _Headers, _Body} = hex_api_package:publish(Config, Tarball).
 ```
 
+### Two-Factor Authentication
+
+When using OAuth tokens, two-factor authentication may be required. If required, the server will return `{error, otp_required}` and you should retry the request with the TOTP code via the `api_otp` configuration option. If the TOTP code is incorrect, the server will return `{error, invalid_totp}` and you should retry with the correct TOTP code.
+
+```erlang
+%% First attempt without OTP
+case hex_api_release:publish(Config, Tarball) of
+    {error, otp_required} ->
+        %% Retry with TOTP code
+        ConfigWithOTP = Config#{api_otp := <<"123456">>},
+        hex_api_release:publish(ConfigWithOTP, Tarball);
+    {error, invalid_totp} ->
+        %% Retry with correct TOTP code
+        ConfigWithOTP = Config#{api_otp := <<"123456">>},
+        hex_api_release:publish(ConfigWithOTP, Tarball);
+    Result ->
+        Result
+end.
+```
+
+API keys don't require TOTP validation.
+
 ### Package tarballs
 
 Unpack package tarball:
@@ -199,7 +221,7 @@
 
 ```erlang
 {deps, 
-  {hex_core, "0.10.3"}
+  {hex_core, "0.12.2"}
 }
 ```
 
@@ -210,7 +232,7 @@
 ```elixir
 defp deps do
   
-    {:hex_core, "~> 0.10.3"}
+    {:hex_core, "~> 0.12.2"}
   
 end
 ```

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/hex_metadata.config -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/hex_metadata.config Changed

@@ -5,16 +5,18 @@
  <<"CHANGELOG.md">>,<<"LICENSE">>,<<"README.md">>,<<"rebar.config">>,
   <<"rebar.config.script">>,<<"rebar.lock">>,<<"src">>,<<"src/hex_api.erl">>,
   <<"src/hex_api_auth.erl">>,<<"src/hex_api_key.erl">>,
-  <<"src/hex_api_organization.erl">>,
+  <<"src/hex_api_oauth.erl">>,<<"src/hex_api_organization.erl">>,
   <<"src/hex_api_organization_member.erl">>,<<"src/hex_api_package.erl">>,
   <<"src/hex_api_package_owner.erl">>,<<"src/hex_api_release.erl">>,
-  <<"src/hex_api_user.erl">>,<<"src/hex_core.app.src">>,
-  <<"src/hex_core.erl">>,<<"src/hex_core.hrl">>,<<"src/hex_erl_tar.erl">>,
-  <<"src/hex_erl_tar.hrl">>,<<"src/hex_filename.erl">>,<<"src/hex_http.erl">>,
+  <<"src/hex_api_short_url.erl">>,<<"src/hex_api_user.erl">>,
+  <<"src/hex_core.app.src">>,<<"src/hex_core.erl">>,<<"src/hex_core.hrl">>,
+  <<"src/hex_erl_tar.erl">>,<<"src/hex_erl_tar.hrl">>,
+  <<"src/hex_filename.erl">>,<<"src/hex_http.erl">>,
   <<"src/hex_http_httpc.erl">>,<<"src/hex_licenses.erl">>,
   <<"src/hex_pb_names.erl">>,<<"src/hex_pb_package.erl">>,
   <<"src/hex_pb_signed.erl">>,<<"src/hex_pb_versions.erl">>,
-  <<"src/hex_registry.erl">>,<<"src/hex_repo.erl">>,<<"src/hex_tarball.erl">>,
+  <<"src/hex_registry.erl">>,<<"src/hex_repo.erl">>,
+  <<"src/hex_safe_binary_to_term.erl">>,<<"src/hex_tarball.erl">>,
   <<"src/safe_erl_term.xrl">>}.
 {<<"licenses">>,<<"Apache-2.0">>}.
 {<<"links">>,
@@ -22,4 +24,4 @@
   {<<"Hex specifications">>,<<"https://github.com/hexpm/specifications">>}}.
 {<<"name">>,<<"hex_core">>}.
 {<<"requirements">>,}.
-{<<"version">>,<<"0.10.3">>}.
+{<<"version">>,<<"0.12.2">>}.

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/src/hex_api.erl -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_api.erl Changed

@@ -101,12 +101,19 @@
     case hex_http:request(Config, Method, build_url(Path, Config), ReqHeaders2, Body) of
         {ok, {Status, RespHeaders, RespBody}} ->
             ContentType = maps:get(<<"content-type">>, RespHeaders, <<"">>),
-            case binary:match(ContentType, ?ERL_CONTENT_TYPE) of
-                {_, _} ->
-                    {ok, {Status, RespHeaders, binary_to_term(RespBody)}};
-                nomatch ->
-                    {ok, {Status, RespHeaders, nil}}
-            end;
+            Response =
+                case binary:match(ContentType, ?ERL_CONTENT_TYPE) of
+                    {_, _} ->
+                        case hex_safe_binary_to_term:safe_binary_to_term(RespBody) of
+                            {ok, Term} ->
+                                {ok, {Status, RespHeaders, Term}};
+                            {error, Reason} ->
+                                {error, Reason}
+                        end;
+                    nomatch ->
+                        {ok, {Status, RespHeaders, nil}}
+                end,
+            detect_otp_error(Response);
         Other ->
             Other
     end.
@@ -133,6 +140,8 @@
 %% @private
 set_header(api_key, Token, Headers) when is_binary(Token) ->
     maps:put(<<"authorization">>, Token, Headers);
+set_header(api_otp, OTP, Headers) when is_binary(OTP) ->
+    maps:put(<<"x-hex-otp">>, OTP, Headers);
 set_header(_, _, Headers) ->
     Headers.
 
@@ -161,3 +170,17 @@
 to_list(B) when is_binary(B) -> unicode:characters_to_list(B);
 to_list(I) when is_integer(I) -> integer_to_list(I);
 to_list(Str) -> unicode:characters_to_list(Str).
+
+%% TODO: not needed after exdoc is fixed
+%% @private
+detect_otp_error({ok, {401, Headers, Body}}) ->
+    case maps:get(<<"www-authenticate">>, Headers, nil) of
+        <<"Bearer realm=\"hex\", error=\"totp_required\"", _/binary>> ->
+            {error, otp_required};
+        <<"Bearer realm=\"hex\", error=\"invalid_totp\"", _/binary>> ->
+            {error, invalid_totp};
+        _ ->
+            {ok, {401, Headers, Body}}
+    end;
+detect_otp_error(Response) ->
+    Response.

osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_api_oauth.erl Added

@@ -0,0 +1,201 @@
+%% @doc
+%% Hex HTTP API - OAuth.
+-module(hex_api_oauth).
+-export(
+    device_authorization/3,
+    device_authorization/4,
+    poll_device_token/3,
+    refresh_token/3,
+    revoke_token/3,
+    client_credentials_token/4,
+    client_credentials_token/5
+).
+
+%% @doc
+%% Initiates the OAuth device authorization flow.
+%%
+%% @see device_authorization/4
+%% @end
+-spec device_authorization(hex_core:config(), binary(), binary()) -> hex_api:response().
+device_authorization(Config, ClientId, Scope) ->
+    device_authorization(Config, ClientId, Scope, ).
+
+%% @doc
+%% Initiates the OAuth device authorization flow with optional parameters.
+%%
+%% Returns device code, user code, and verification URIs for user authentication.
+%%
+%% Options:
+%%   * `name' - A name to identify the token (e.g., hostname of the device)
+%%
+%% Examples:
+%%
+%% ```
+%% 1> Config = hex_core:default_config().
+%% 2> hex_api_oauth:device_authorization(Config, <<"cli">>, <<"api:write">>).
+%% {ok,{200, ..., #{
+%%     <<"device_code">> => <<"...">>,
+%%     <<"user_code">> => <<"ABCD-1234">>,
+%%     <<"verification_uri">> => <<"https://hex.pm/oauth/device">>,
+%%     <<"verification_uri_complete">> => <<"https://hex.pm/oauth/device?user_code=ABCD-1234">>,
+%%     <<"expires_in">> => 600,
+%%     <<"interval">> => 5
+%% }}}
+%%
+%% 3> hex_api_oauth:device_authorization(Config, <<"cli">>, <<"api:write">>, {name, <<"MyMachine">>}).
+%% '''
+%% @end
+-spec device_authorization(hex_core:config(), binary(), binary(), proplists:proplist()) ->
+    hex_api:response().
+device_authorization(Config, ClientId, Scope, Opts) ->
+    Path = <<"oauth/device_authorization">>,
+    Params0 = #{
+        <<"client_id">> => ClientId,
+        <<"scope">> => Scope
+    },
+    Params =
+        case proplists:get_value(name, Opts) of
+            undefined -> Params0;
+            Name -> Params0#{<<"name">> => Name}
+        end,
+    hex_api:post(Config, Path, Params).
+
+%% @doc
+%% Polls the OAuth token endpoint for device authorization completion.
+%%
+%% Returns:
+%% - `{ok, {200, _, Token}}` - Authorization complete
+%% - `{ok, {400, _, #{<<"error">> => <<"authorization_pending">>}}}` - Still waiting
+%% - `{ok, {400, _, #{<<"error">> => <<"slow_down">>}}}` - Polling too fast
+%% - `{ok, {400, _, #{<<"error">> => <<"expired_token">>}}}` - Code expired
+%% - `{ok, {403, _, #{<<"error">> => <<"access_denied">>}}}` - User denied
+%%
+%% Examples:
+%%
+%% ```
+%% 1> Config = hex_core:default_config().
+%% 2> hex_api_oauth:poll_device_token(Config, <<"cli">>, DeviceCode).
+%% {ok, {200, _, #{
+%%     <<"access_token">> => <<"...">>,
+%%     <<"refresh_token">> => <<"...">>,
+%%     <<"token_type">> => <<"Bearer">>,
+%%     <<"expires_in">> => 3600
+%% }}}
+%% '''
+%% @end
+-spec poll_device_token(hex_core:config(), binary(), binary()) -> hex_api:response().
+poll_device_token(Config, ClientId, DeviceCode) ->
+    Path = <<"oauth/token">>,
+    Params = #{
+        <<"grant_type">> => <<"urn:ietf:params:oauth:grant-type:device_code">>,
+        <<"device_code">> => DeviceCode,
+        <<"client_id">> => ClientId
+    },
+    hex_api:post(Config, Path, Params).
+
+%% @doc
+%% Refreshes an access token using a refresh token.
+%%
+%% Examples:
+%%
+%% ```
+%% 1> Config = hex_core:default_config().
+%% 2> hex_api_oauth:refresh_token(Config, <<"cli">>, RefreshToken).
+%% {ok, {200, _, #{
+%%     <<"access_token">> => <<"...">>,
+%%     <<"refresh_token">> => <<"...">>,
+%%     <<"token_type">> => <<"Bearer">>,
+%%     <<"expires_in">> => 3600
+%% }}}
+%% '''
+%% @end
+-spec refresh_token(hex_core:config(), binary(), binary()) -> hex_api:response().
+refresh_token(Config, ClientId, RefreshToken) ->
+    Path = <<"oauth/token">>,
+    Params = #{
+        <<"grant_type">> => <<"refresh_token">>,
+        <<"refresh_token">> => RefreshToken,
+        <<"client_id">> => ClientId
+    },
+    hex_api:post(Config, Path, Params).
+
+%% @doc
+%% Exchanges an API key for an OAuth access token using the client credentials grant.
+%%
+%% @see client_credentials_token/5
+%% @end
+-spec client_credentials_token(hex_core:config(), binary(), binary(), binary()) ->
+    hex_api:response().
+client_credentials_token(Config, ClientId, ApiKey, Scope) ->
+    client_credentials_token(Config, ClientId, ApiKey, Scope, ).
+
+%% @doc
+%% Exchanges an API key for an OAuth access token using the client credentials grant with optional parameters.
+%%
+%% This grant type allows exchanging a long-lived API key for a short-lived OAuth access token.
+%% The API key is sent as the client_secret parameter.
+%%
+%% Options:
+%%   * `name' - A name to identify the token (e.g., hostname of the client)
+%%
+%% Returns:
+%% - `{ok, {200, _, Token}}` - Token exchange successful
+%% - `{ok, {400, _, #{<<"error">> => ...}}}` - Invalid request or scope
+%% - `{ok, {401, _, #{<<"error">> => ...}}}` - Invalid API key
+%%
+%% Examples:
+%%
+%% ```
+%% 1> Config = hex_core:default_config().
+%% 2> hex_api_oauth:client_credentials_token(Config, <<"cli">>, ApiKey, <<"api">>).
+%% {ok, {200, _, #{
+%%     <<"access_token">> => <<"...">>,
+%%     <<"token_type">> => <<"bearer">>,
+%%     <<"expires_in">> => 1800,
+%%     <<"scope">> => <<"api">>
+%% }}}
+%%
+%% 3> hex_api_oauth:client_credentials_token(Config, <<"cli">>, ApiKey, <<"api">>, {name, <<"MyMachine">>}).
+%% '''
+%% @end
+-spec client_credentials_token(
+    hex_core:config(), binary(), binary(), binary(), proplists:proplist()
+) -> hex_api:response().
+client_credentials_token(Config, ClientId, ApiKey, Scope, Opts) ->
+    Path = <<"oauth/token">>,
+    Params0 = #{
+        <<"grant_type">> => <<"client_credentials">>,
+        <<"client_id">> => ClientId,
+        <<"client_secret">> => ApiKey,
+        <<"scope">> => Scope
+    },
+    Params =
+        case proplists:get_value(name, Opts) of
+            undefined -> Params0;
+            Name -> Params0#{<<"name">> => Name}
+        end,
+    hex_api:post(Config, Path, Params).
+
+%% @doc
+%% Revokes an OAuth token (RFC 7009).
+%%
+%% Can revoke either access tokens or refresh tokens.
+%% Returns 200 OK regardless of whether the token was found,
+%% following RFC 7009 security recommendations.
+%%
+%% Examples:
+%%
+%% ```
+%% 1> Config = hex_core:default_config().
+%% 2> hex_api_oauth:revoke_token(Config, <<"cli">>, Token).
+%% {ok, {200, ..., nil}}
+%% '''
+%% @end
+-spec revoke_token(hex_core:config(), binary(), binary()) -> hex_api:response().
+revoke_token(Config, ClientId, Token) ->
+    Path = <<"oauth/revoke">>,
+    Params = #{
+        <<"token">> => Token,
+        <<"client_id">> => ClientId
+    },
+    hex_api:post(Config, Path, Params).

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/src/hex_api_organization.erl -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_api_organization.erl Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/src/hex_api_release.erl -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_api_release.erl Changed

@@ -105,15 +105,26 @@
 publish(Config, Tarball, Params) when
     is_map(Config) andalso is_binary(Tarball) andalso is_list(Params)
 ->
-    QueryString = hex_api:encode_query_string(
-        {replace, proplists:get_value(replace, Params, false)}
-    ),
-    Path = hex_api:join_path_segments(hex_api:build_repository_path(Config, "publish")),
-    PathWithQuery = <<Path/binary, "?", QueryString/binary>>,
-    TarballContentType = "application/octet-stream",
-    Config2 = put_header(<<"content-length">>, integer_to_binary(byte_size(Tarball)), Config),
-    Body = {TarballContentType, Tarball},
-    hex_api:post(Config2, PathWithQuery, Body).
+    case hex_tarball:unpack(Tarball, memory) of
+        {ok, #{metadata := Metadata}} ->
+            PackageName = maps:get(<<"name">>, Metadata),
+            QueryString = hex_api:encode_query_string(
+                {replace, proplists:get_value(replace, Params, false)}
+            ),
+            Path = hex_api:join_path_segments(
+                hex_api:build_repository_path(Config, "packages", PackageName, "releases")
+            ),
+            PathWithQuery = <<Path/binary, "?", QueryString/binary>>,
+            TarballContentType = "application/octet-stream",
+            Config2 = put_header(
+                <<"content-length">>, integer_to_binary(byte_size(Tarball)), Config
+            ),
+            Config3 = maybe_put_expect_header(Config2),
+            Body = {TarballContentType, Tarball},
+            hex_api:post(Config3, PathWithQuery, Body);
+        {error, Reason} ->
+            {error, {tarball, Reason}}
+    end.
 
 %% @doc
 %% Deletes a package release.
@@ -171,3 +182,10 @@
     Headers = maps:get(http_headers, Config, #{}),
     Headers2 = maps:put(Name, Value, Headers),
     maps:put(http_headers, Headers2, Config).
+
+%% @private
+maybe_put_expect_header(Config) ->
+    case maps:get(send_100_continue, Config, true) of
+        true -> put_header(<<"expect">>, <<"100-continue">>, Config);
+        false -> Config
+    end.

osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_api_short_url.erl Added

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/src/hex_core.app.src -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_core.app.src Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/src/hex_core.erl -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_core.erl Changed

@@ -12,6 +12,15 @@
 %%
 %% * `api_key' - Authentication key used when accessing the HTTP API.
 %%
+%% * `api_otp' - TOTP (Time-based One-Time Password) code for two-factor authentication.
+%%   When using OAuth tokens, write operations require 2FA if the user has it enabled.
+%%   If required, the server returns one of:
+%%   - `{error, otp_required}' - Retry the request with a 6-digit TOTP code in this option
+%%   - `{error, invalid_totp}' - The provided TOTP code was incorrect, retry with correct code
+%%   - `{ok, {403, _, #{<<"message">> => <<"Two-factor authentication must be enabled for API write access">>}}}' - User must enable 2FA first
+%%   - `{ok, {429, _, _}}' - Too many failed TOTP attempts, rate limited
+%%   API keys do not require TOTP validation.
+%%
 %% * `api_organization' - Name of the organization endpoint in the API, this should
 %%   for example be set when accessing key for a specific organization.
 %%
@@ -47,6 +56,10 @@
 %% * `repo_verify_origin' - If `true' will verify the repository signature origin,
 %%   requires protobuf messages as of hex_core v0.4.0 (default: `true').
 %%
+%% * `send_100_continue' - If `true' will send `Expect: 100-continue' header for
+%%   publish operations. This allows the server to validate authentication and
+%%   authorization before the client sends the request body (default: `true').
+%%
 %% * `tarball_max_size' - Maximum size of package tarball, defaults to
 %%   `16_777_216' (16 MiB). Set to `infinity' to not enforce the limit.
 %%
@@ -79,6 +92,7 @@
 
 -type config() :: #{
     api_key => binary() | undefined,
+    api_otp => binary() | undefined,
     api_organization => binary() | undefined,
     api_repository => binary() | undefined,
     api_url => binary(),
@@ -93,6 +107,7 @@
     repo_organization => binary() | undefined,
     repo_verify => boolean(),
     repo_verify_origin => boolean(),
+    send_100_continue => boolean(),
     tarball_max_size => pos_integer() | infinity,
     tarball_max_uncompressed_size => pos_integer() | infinity,
     docs_tarball_max_size => pos_integer() | infinity,
@@ -103,6 +118,7 @@
 default_config() ->
     #{
         api_key => undefined,
+        api_otp => undefined,
         api_organization => undefined,
         api_repository => undefined,
         api_url => <<"https://hex.pm/api">>,
@@ -117,6 +133,7 @@
         repo_organization => undefined,
         repo_verify => true,
         repo_verify_origin => true,
+        send_100_continue => true,
         tarball_max_size => 16 * 1024 * 1024,
         tarball_max_uncompressed_size => 128 * 1024 * 1024,
         docs_tarball_max_size => 16 * 1024 * 1024,

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/src/hex_core.hrl -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_core.hrl Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/src/hex_http.erl -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_http.erl Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/src/hex_http_httpc.erl -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_http_httpc.erl Changed

@@ -20,25 +20,44 @@
 
 request(Method, URI, ReqHeaders, Body, AdapterConfig) when is_binary(URI) ->
     Profile = maps:get(profile, AdapterConfig, default),
-    HTTPOptions = maps:get(http_options, AdapterConfig, ),
+    HTTPOptions0 = maps:get(http_options, AdapterConfig, ),
 
     HTTPS =
         case URI of
             <<"https", _/binary>> -> true;
             _ -> false
         end,
-    SSLOpts = proplists:get_value(ssl, HTTPOptions),
+    SSLOpts0 = proplists:get_value(ssl, HTTPOptions0),
 
-    if
-        HTTPS == true andalso SSLOpts == undefined ->
-            io:format(
-                "hex_http_httpc using default ssl options which are insecure.~n"
-                "Configure your adapter with: "
-                "{hex_http_httpc, #{http_options => {ssl, SslOpts}}}~n"
-            );
-        true ->
-            ok
-    end,
+    HTTPOptions =
+        if
+            HTTPS == true andalso SSLOpts0 == undefined ->
+                %% Add safe defaults if possible.
+                try
+                    
+                        {ssl, 
+                            {verify, verify_peer},
+                            {cacerts, public_key:cacerts_get()},
+                            {depth, 3},
+                            {customize_hostname_check, 
+                                {match_fun, public_key:pkix_verify_hostname_match_fun(https)}
+                            }
+                        }
+                        | HTTPOptions0
+                    
+                catch
+                    _:_ ->
+                        io:format(
+                            "hex_http_httpc using default ssl options which are insecure.~n"
+                            "Configure your adapter with: "
+                            "{hex_http_httpc, #{http_options => {ssl, SslOpts}}}~n"
+                            "or upgrade Erlang/OTP to OTP-25 or later.~n"
+                        ),
+                        HTTPOptions0
+                end;
+            true ->
+                HTTPOptions0
+        end,
 
     Request = build_request(URI, ReqHeaders, Body),
     case httpc:request(Method, Request, HTTPOptions, {body_format, binary}, Profile) of

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/src/hex_registry.erl -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_registry.erl Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/src/hex_repo.erl -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_repo.erl Changed

@@ -7,7 +7,8 @@
     get_package/2,
     get_tarball/3,
     get_docs/3,
-    get_public_key/1
+    get_public_key/1,
+    get_hex_installs/1
 ).
 
 %%====================================================================
@@ -21,11 +22,11 @@
 %%
 %% ```
 %% > hex_repo:get_names(hex_core:default_config()).
-%% {ok, {200, ...,
-%%     
-%%         #{name => <<"package1">>},
-%%         #{name => <<"package2">>},
-%%     }}
+%% {ok,{200, ...,
+%%      #{packages => 
+%%            #{name => <<"package1">>},
+%%            #{name => <<"package2">>},
+%%            ...}}}
 %% '''
 %% @end
 get_names(Config) when is_map(Config) ->
@@ -42,12 +43,12 @@
 %% ```
 %% > hex_repo:get_versions(Config).
 %% {ok, {200, ...,
-%%     
-%%         #{name => <<"package1">>, retired => ,
-%%           versions => <<"1.0.0">>},
-%%         #{name => <<"package2">>, retired => <<"0.5.0>>",
-%%           versions => <<"0.5.0">>, <<"1.0.0">>},
-%%     }}
+%%       #{packages => 
+%%             #{name => <<"package1">>, retired => ,
+%%               versions => <<"1.0.0">>},
+%%             #{name => <<"package2">>, retired => <<"0.5.0>>",
+%%               versions => <<"0.5.0">>, <<"1.0.0">>},
+%%             ...}}}
 %% '''
 %% @end
 get_versions(Config) when is_map(Config) ->
@@ -64,12 +65,13 @@
 %% ```
 %% > hex_repo:get_package(hex_core:default_config(), <<"package1">>).
 %% {ok, {200, ...,
-%%     {
-%%         #{checksum => ..., version => <<"0.5.0">>, dependencies => },
-%%         #{checksum => ..., version => <<"1.0.0">>, dependencies => 
-%%             #{package => <<"package2">>, optional => true, requirement => <<"~> 0.1">>}
-%%         },
-%%     }}
+%%       #{name => <<"package1">>,
+%%         releases => 
+%%             #{checksum => ..., version => <<"0.5.0">>, dependencies => },
+%%             #{checksum => ..., version => <<"1.0.0">>, dependencies => 
+%%                   #{package => <<"package2">>, optional => true, requirement => <<"~> 0.1">>}
+%%             },
+%%     }}}
 %% '''
 %% @end
 get_package(Config, Name) when is_binary(Name) and is_map(Config) ->
@@ -142,6 +144,27 @@
             Other
     end.
 
+%% @doc
+%% Gets Hex installation versions CSV from repository.
+%%
+%% Examples:
+%%
+%% ```
+%% > hex_repo:get_hex_installs(hex_core:default_config()).
+%% {ok, {200, ..., <<"1.0.0,abc123,1.13.0\n1.1.0,def456,1.14.0\n...">>}}
+%% '''
+%% @end
+get_hex_installs(Config) ->
+    ReqHeaders = make_headers(Config),
+    URI = build_url(Config, <<"installs/hex-1.x.csv">>),
+
+    case get(Config, URI, ReqHeaders) of
+        {ok, {200, RespHeaders, CSV}} ->
+            {ok, {200, RespHeaders, CSV}};
+        Other ->
+            Other
+    end.
+
 %%====================================================================
 %% Internal functions
 %%====================================================================
@@ -231,5 +254,7 @@
     maps:put(<<"if-none-match">>, ETag, Headers);
 set_header(repo_key, Token, Headers) when is_binary(Token) ->
     maps:put(<<"authorization">>, Token, Headers);
+set_header(api_otp, OTP, Headers) when is_binary(OTP) ->
+    maps:put(<<"x-hex-otp">>, OTP, Headers);
 set_header(_, _, Headers) ->
     Headers.

osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_safe_binary_to_term.erl Added

@@ -0,0 +1,92 @@
+%% @hidden
+%% Safe deserialization of Erlang terms from binary.
+%%
+%% This module provides a restricted version of `binary_to_term/1' that:
+%% - Uses the `safe' option to prevent creation of new atoms (DoS protection)
+%% - Validates that the term contains no executable code (RCE protection)
+%%
+%% Inspired by Plug.Crypto's non_executable_binary_to_term:
+%% https://github.com/elixir-plug/plug_crypto/blob/c326c3c743b18cf5f4b12735d06dd90c72dcd779/lib/plug/crypto.ex
+-module(hex_safe_binary_to_term).
+
+-export(safe_binary_to_term/1).
+
+-type unsafe_term() :: function() | port().
+-type error_reason() :: invalid_term | {unsafe_term, unsafe_term()}.
+
+-spec safe_binary_to_term(binary()) -> {ok, term()} | {error, error_reason()}.
+safe_binary_to_term(Binary) when is_binary(Binary) ->
+    try binary_to_term(Binary, safe) of
+        Term ->
+            case validate_term(Term) of
+                ok -> {ok, Term};
+                {error, _} = Error -> Error
+            end
+    catch
+        error:badarg ->
+            {error, invalid_term}
+    end.
+
+-spec validate_term(term()) -> ok | {error, {unsafe_term, term()}}.
+validate_term(Term) when is_list(Term) ->
+    validate_list(Term);
+validate_term(Term) when is_tuple(Term) ->
+    validate_tuple(Term, tuple_size(Term));
+validate_term(Term) when is_map(Term) ->
+    validate_map(Term);
+validate_term(Term) when
+    is_atom(Term);
+    is_number(Term);
+    is_bitstring(Term);
+    is_pid(Term);
+    is_reference(Term)
+->
+    ok;
+validate_term(Term) ->
+    {error, {unsafe_term, Term}}.
+
+-spec validate_list(list()) -> ok | {error, {unsafe_term, term()}}.
+validate_list() ->
+    ok;
+validate_list(H | T) when is_list(T) ->
+    case validate_term(H) of
+        ok -> validate_list(T);
+        Error -> Error
+    end;
+validate_list(H | T) ->
+    %% Improper list
+    case validate_term(H) of
+        ok -> validate_term(T);
+        Error -> Error
+    end.
+
+-spec validate_tuple(tuple(), non_neg_integer()) -> ok | {error, {unsafe_term, term()}}.
+validate_tuple(_Tuple, 0) ->
+    ok;
+validate_tuple(Tuple, N) ->
+    case validate_term(element(N, Tuple)) of
+        ok -> validate_tuple(Tuple, N - 1);
+        Error -> Error
+    end.
+
+-spec validate_map(map()) -> ok | {error, {unsafe_term, term()}}.
+validate_map(Map) ->
+    try
+        maps:fold(
+            fun(Key, Value, ok) ->
+                case validate_term(Key) of
+                    ok ->
+                        case validate_term(Value) of
+                            ok -> ok;
+                            Error -> throw(Error)
+                        end;
+                    Error ->
+                        throw(Error)
+                end
+            end,
+            ok,
+            Map
+        )
+    catch
+        throw:{error, _} = Error -> Error
+    end.

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/hex_core/src/hex_tarball.erl -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/hex_core/src/hex_tarball.erl Changed

@@ -457,7 +457,7 @@
 normalize_metadata(Metadata1) ->
     Metadata2 = maybe_update_with(<<"requirements">>, fun normalize_requirements/1, Metadata1),
     Metadata3 = maybe_update_with(<<"links">>, fun try_into_map/1, Metadata2),
-    Metadata4 = maybe_update_with(<<"extra">>, fun try_into_map/1, Metadata3),
+    Metadata4 = maybe_update_with(<<"extra">>, fun try_into_nested_map/1, Metadata3),
     guess_build_tools(Metadata4).
 
 %% @private
@@ -665,15 +665,37 @@
 
 %% @private
 try_into_map(Fun, Input) ->
-    case
-        is_list(Input) andalso
-            lists:all(fun(E) -> is_tuple(E) andalso (tuple_size(E) == 2) end, Input)
-    of
+    case has_map_shape(Input) of
         true -> maps:from_list(lists:map(Fun, Input));
         false -> Input
     end.
 
 %% @private
+try_into_nested_map(List) ->
+    try_into_nested_map(fun(X) -> X end, List).
+
+%% @private
+try_into_nested_map(Fun, Input) ->
+    case has_map_shape(Input) of
+        true ->
+            maps:from_list(
+                lists:map(
+                    fun({Key, Value}) ->
+                        Fun({Key, try_into_nested_map(Fun, Value)})
+                    end,
+                    Input
+                )
+            );
+        false ->
+            Input
+    end.
+
+%% @private
+has_map_shape(Input) ->
+    is_list(Input) andalso
+        lists:all(fun(E) -> is_tuple(E) andalso (tuple_size(E) == 2) end, Input).
+
+%% @private
 encode_base16(Binary) ->
     <<X:256/big-unsigned-integer>> = Binary,
     String = string:to_upper(lists:flatten(io_lib:format("~64.16.0b", X))),

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/rebar3_hex/hex_metadata.config -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/rebar3_hex/hex_metadata.config Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/rebar3_hex/rebar.config -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/rebar3_hex/rebar.config Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/rebar3_hex/rebar.lock -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/rebar3_hex/rebar.lock Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/rebar3_hex/src/rebar3_hex.app.src -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/rebar3_hex/src/rebar3_hex.app.src Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/_checkouts/rebar3_hex/src/rebar3_hex_io.erl -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/_checkouts/rebar3_hex/src/rebar3_hex_io.erl Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/build_dep.tar.gz -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/build_dep.tar.gz Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/debian/changelog -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/debian/changelog Changed

osmo-s1gw_0.4.0.271.0a09.202603021800.tar.xz/debian/control -> osmo-s1gw_0.4.0.271.0a09.202603031800.tar.xz/debian/control Changed

Changes of Revision 571