olemd/skyview
Watch
1
0
Fork
You've already forked skyview
 0
Code Issues 10 Pull requests Projects Releases 14 Packages Wiki Activity Actions
14 releases 14 tags
  • v0.0.14 e168b57f3d

    SkyView v0.0.14 - WebSocket Origin Check, Gillham Altitude and Local CPR Stable

    olemd released this 2026-09-29 14:53:54 +02:00 | 5 commits to main since this release

    SkyView v0.0.14 - WebSocket Origin Check, Gillham Altitude and Local CPR

    This follow-up to v0.0.13 includes a security fix for the live data stream, better decoding for older transponders and weak reception, and a corrected man page.

    ⚠️ Upgrade note: reverse proxies

    The WebSocket endpoint (/ws) now accepts browser connections only when the Origin matches the request's Host header. Behind a reverse proxy, the proxy must forward the original Host header, otherwise live updates stop:

    • Caddy: works as-is, because reverse_proxy passes Host through to HTTP backends
    • nginx: add proxy_set_header Host $host;. The default rewrites Host. See the new Reverse Proxy section in docs/CONFIGURATION.md.

    Rejected connections are logged as Rejected WebSocket connection from origin ....

    Security

    • Cross-site WebSocket hijacking: the server previously accepted WebSocket connections from any origin. Any website a visitor opened could read the live data stream through the visitor's browser, including from SkyView instances reachable only on a private network. Non-browser clients (no Origin header) are still accepted.

    Decoding

    • Gillham (Mode C) altitude: the 100 ft altitude coding used by older transponders, and by all transponders above 50,175 ft, was reported as unknown. It is now decoded for both Mode S replies and ADS-B positions. Tests cover every altitude from -1,200 to 126,700 ft plus the pyModeS reference vectors.
    • Local CPR decoding: once an aircraft has a position, a single position frame is decoded relative to it, without waiting for a complete even/odd pair. This keeps positions updating when frames are missed at the edge of coverage or when an aircraft crosses a zone boundary. An aircraft's first position still always requires a complete pair.

    On a strong receiver neither change makes a measurable difference. In testing, no Gillham altitudes appeared in 60 s, and 183 of 189 position frames were decoded with or without local decoding. The gains are for older aircraft and weaker or intermittent reception.

    Documentation

    • The skyview(1) man page listed -port and -debug, which do not exist. It now documents -config, -server, -sources, -verbose and -version, the actual config file search order, and a valid configuration example.
    • New reverse proxy section in docs/CONFIGURATION.md.

    Known issues

    • The Debian changelog (/usr/share/doc/skyview-adsb/changelog.gz) lists the 20 most recent commits under the newest version instead of only the commits since the previous release. This is a long-standing bug in the package build script and will be fixed in the next release.
    • ADS-B GNSS-height positions (TC 20-22) may show an incorrect altitude.

    Package

    • Debian package: skyview-adsb_0.0.14_amd64.deb (7.5 MB, amd64)
    • SHA-256: dd760d3f8835bcf0b02c3e9c7c9eabcd649b1945e5022462e1b25b1d11e2258f
    sudo dpkg -i skyview-adsb_0.0.14_amd64.deb

    Container image:

    BUILDAH_FORMAT=docker podman build \
  --build-arg BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  --build-arg GIT_REVISION=v0.0.14 \
  -t skyview:v0.0.14 .

    🤖 Generated with Claude Code

    Downloads