mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-10-24 21:43:06 +00:00
UNITRONIX
6af0c5a65a
Pin the upstream gateway source, verify checksums and licenses in CI, and prepare reviewed dependency update PRs. Keep runtime activation fail-closed while the VNC GPL dependency remains outside the project policy. Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
44 lines
2.1 KiB
Markdown
44 lines
2.1 KiB
Markdown
# BetterDesk RDP/VNC gateway
|
|
|
|
This directory contains the deployment contract for the optional Guacamole
|
|
daemon used by BetterDesk's RDP/VNC session broker. The pinned source version
|
|
is verified by `.github/workflows/remote-gateway-supply-chain.yml`; the
|
|
workflow reports upstream changes but never changes the manifest or deploys
|
|
code automatically. `.github/workflows/remote-gateway-update.yml` may prepare
|
|
an update PR against `dev`, but merging that PR remains a reviewed decision.
|
|
|
|
The broker in `betterdesk-server/api/remote_target_gateway.go` only connects
|
|
to `GUACD_ADDRESS` on loopback. It rejects remote guacd addresses and refuses
|
|
to create a session when the daemon is unavailable. The browser never receives
|
|
the target password or a direct target socket.
|
|
|
|
## Supply-chain and licence policy
|
|
|
|
Only an upstream Apache Guacamole release and dependencies whose runtime
|
|
licences are explicitly approved by BetterDesk may be used. The installer must
|
|
not download an unpinned npm fork or an unverified binary. A release must
|
|
include:
|
|
|
|
- the exact upstream source version and SHA-256 checksums;
|
|
- a generated SBOM and complete third-party licence notices;
|
|
- a review proving that the RDP and VNC dependency paths meet the project's
|
|
permissive-licence requirement (Apache-2.0, MIT, BSD or ISC);
|
|
- a reproducible build or a signed, checksum-verified artifact.
|
|
|
|
Until that manifest is present, the session broker remains fail-closed. The
|
|
database/API/UI parts can still be configured and tested for reachability.
|
|
|
|
The current pinned source is Apache Guacamole `1.6.0`. Its RDP path still
|
|
requires a complete transitive runtime audit. The VNC path is explicitly
|
|
blocked because the required LibVNCServer dependency is GPL-2.0, which is
|
|
outside BetterDesk's permissive-license policy. A future replacement or
|
|
separate licensing decision is required before VNC can be enabled.
|
|
|
|
## Runtime contract
|
|
|
|
- guacd listens on `127.0.0.1:4822` only;
|
|
- `REMOTE_TARGET_VAULT_KEY` is a dedicated AES-GCM key and must not be
|
|
replaced by `JWT_SECRET`;
|
|
- systemd/NSSM must run guacd as a separate unprivileged service account;
|
|
- no public firewall rule may expose port 4822.
|