Jack Morrison

writing / 2026 / september

September 2026

BluePortal moves from Fiber to Bosun and gets a full security audit, plus Bosun v0.6.0 and Gantry v0.5.0

2026-09-30 / 5 min read / blueportal, bosun, gantry

fig. 2026-09september

Short version first: September was mostly BluePortal. It was the busiest month that repo has had, around 450 commits on prod, and three big pieces landed: the developer workbench, every Go service moving from Fiber onto Bosun, and a security audit with a fix for every finding. Bosun got v0.6.0 along the way, and Gantry got v0.5.0 in the first week.

Uni started again too, for my final year. Most of that was getting to grips with my new units, but I also joined the university squash team and met a lot of people from other courses, and it was interesting hearing about what they study.

Gantry v0.5.0

The first week went on Gantry. v0.4.2 (2 September) was a Linux fix: the upstream webview binding links webkit2gtk-4.0, which Fedora doesn't ship, so Gantry now vendors a fork that links 4.1. The same release added a capture compatibility option for WebView2 on Windows and moved the module path to my own GitHub account.

v0.5.0 (5 September) added modules: separate Go modules with a manifest that can ship docs pages (mounted in gantry docs) and an importable Go package, with JSON schemas to check the manifest. The docs got a round of SVG diagrams as well.

The other half of v0.5.0 was performance: pprof hooks, better caching for embedded assets, lazy loading for page modules, and patch diffing. Instead of sending the whole UI tree to the webview on every change, the server diffs against the last tree it sent and only sends what changed. TestMeasureScaling checks it with a list of n rows where one row and a counter change. The patch frame stays at 167 bytes, against a full tree of 2.2 KB at 10 rows and 6.8 MB at 32,000 rows. Server CPU is about the same either way, because the diff costs about what a full marshal does, so the win is on the wire and in React on the client.

BluePortal: the developer workbench

The middle of the month (13 to 18 September) was product work. Developer order lifecycle controls, user bans, developer settings and an analytics page, then the developer workbench: API keys, a read API, webhooks with a dispatcher for commerce events, admin views, and end-to-end tests over the whole pipeline (PRs #101 to #106).

After that came a request monitor. Caddy writes JSON access logs, an ingester stores them, and there's an admin UI to look through them, with a retention setting (#107 to #111). GDPR data export (#133) and one-click unsubscribe (#140) also went in, which closes two of the gaps from July's GDPR review.

BluePortal: from Fiber to Bosun

Before the migration I restructured the API from one big internal/services package into vertical domains: legal, marketplace, catalog, orders, payments, accounts, developer, media, discounts, licensing and so on (#113 to #143).

Then the move itself, strangler style, one service converted in place at a time:

  • the relay first, as a spike (#144, 18 September)
  • the email, auth and payments workers (#145 to #148)
  • build-api and protection-api (#150, #151, 21 September)
  • the main API last (#152, 25 September)

Nothing about the move was especially hard. The hassle was moving each service across and redeploying it, then retesting every feature it touched to make sure nothing important had broken, especially in the core systems.

Additionally, late in the month the build pipeline changed too. Builds used to run developers' repo code inside build-api's own container. Now a runner on the host runs each job in a throwaway container (#176). CI also gates staging and prod releases now (#162).

BluePortal: security audit

On 29 September I did a security audit of the whole platform. It came out with 19 findings and 2 bugs. Each fix went on its own branch (#177 to #197), they were merged together in #198, and shipped on the 30th.

The classes of issue: MFA not bound to the password step, ownership checks on upgrades, licence routing for subscriptions, price and tier locking during checkout, invite takeover, RBAC on developer orders, SSRF through developer webhook URLs, symlink-safe writes in the build workspace, revoking sessions on password reset, open redirects, OAuth pre-hijack, and tokens not bound to the user's email address.

The lesson I'm keeping: several findings were gaps in earlier fixes, and one was introduced by another fix from the same audit. A fix is new code and needs the same review as everything else.

Bosun v0.6.0

Bosun had a quieter month in its own repo, since most of its use was inside BluePortal. v0.6.0 (16 September) moved the module path to github.com/bluebeard63/bosun, merged a reconnect supervisor for the AMQP events module (it reconnects and re-subscribes when the broker drops), and the CLI now works out its own version at runtime (cmd/bosun v0.6.1).

Next month

Jack Morrison
Cyber Security and Digital Forensics, Bournemouth Universityabout / cv ->