This updates the SSL/TLS validation to optionally ignore failures in OCSP/CRL list. If the revocation servers are offline or unavailable, the SSL requests will fail.
With the new option, `--ignore-revocation-failure`, it is now possible to ignore this class of errors and let the connections work anyway.
By default, this is off so we have the strictest possible security.
As part of this PR, there were a few places that did validation/override of certificates. With this change all calls route into the single `SslCertificateValidator` class so all certificate validations are done the same from ServerUtil, reporting modules and backends.
This improves the secret provider by allowing a value of `default://` to get the system default provider (if one exists).
The license checker now supports multiple formats for the on-disk file.
This adds a nonce to the refresh token such that each request to obtain a refresh token must now also provide a matching nonce.
When using non-persisted logins, the request to the server is the same, but the "remember me" flag toggles a shorter duration for the refresh token.
The FE can then store the nonce in either local storage for persisted logins or in session storage for non-persisted logins.
The default is currently to always issue refresh tokens with a nonce, but this can be toggled with the JWT configuration.
The ngax client does not have the non-persisted login so it stores the nonce in local storage, using a name that is compatible with ngclient so the user can swap between them without needing to re-login.
The server util was updated to also store the nonce.
This fixes#6451
This addresses [Issue](https://github.com/duplicati/duplicati/issues/6114).
Whenever in non-write context, the permissions of the folder are not set.
Changing pattern from static constructor execution.
This comes from suggestion on issue https://github.com/duplicati/duplicati/issues/6056
The chosen argument was --json which produces a json that wraps the result with extended properties such as in example:
``
{
"Timestamp": "2025-03-28T15:47:01.3368160-03:00",
"UnixTimestamp": 1743187621,
"Command": "import",
"Success": true,
"ExitCode": 0,
"Messages": [
"Importing backup configuration from ../2-firstbacku.json",
"Connecting to http://127.0.0.1:8200/...",
"No database found in../data/",
"Imported \"firstbackup (5)\" with ID 8"
],
"Exceptions": [],
"Imported": {
"Id": "8",
"Name": "firstbackup (5)"
}
}
``
The documentation will reflect all commands and schemas as this makes its way into Canary
It should be noted that I was unable to completely remove IPv4 on Windows 11 to a state where it would not provide the 127.0.0.1 loopback, even when disabling Ipv4 in various ways, including with registry flags.
On ubuntu/linux, after completely disabling ipv4 the ipv6 loopback was returned.
Added support for `--portable-mode` and `--server-datafolder` for the CLI, ServerUtil, and Agent.
Fixed a few places where file reads were not cached properly.
Moved some responsibilities of UpdaterManager into DataFolderManager.
This now supports storing `machineid.txt` and `installation.txt` inside the path pointed to by `--server-datafolder` or alternatively with `--portable-mode`.
It is possible that some fringe backwards compatibility is lost with this update.
Fixed an issue with AutoUpdater crashing on check/download.
This fixes#5902
Kept the infrastructure to allow re-introducing it later if a better source for a device key is found.
Added support for not having any valid settings encryption key.
Added warnings if the user is running without a settings encryption key.
Added additional checks during startup to help with troubleshooting and configuring a setup with a settings encryption key.
Docker builds will now warn if no encryption key is set.
This fixes#5518
Kenneth Skovhede