Everstra Overlay — Release notes

v0.6.0 2026-10-14

Security: Other apps installed on the camera could until now reach this app's internal endpoints directly, without the camera's login check — the app's FastCGI socket was reachable for other local processes, a side entrance past the web server. It is now closed: access goes only through the camera's web server and its login.
Security: A licence is now accepted only in the form this app's own page sends it. Until now a web page on another site, opened in the same browser while you were logged in to the camera, could send the camera a licence file in your name — it could not install a forged licence (every licence is checked against this camera), but the way in is now closed. If you install licences with your own scripts: send {"license": "<file content>"} with Content-Type: application/json.
New: The captions you can override in the AIS, Water Levels, Weather and Text overlays — ship types, time words such as “today”, “yesterday”, “ago” and “of”, weekdays, tide and weather terms, compass directions, AM/PM — can now be pre-filled from a language list: 12 languages, one field at a time or all fields of a panel at once. The camera stores the finished text, so every field stays freely editable, and the default stays English. Translations other than English and German are machine translations and marked “(auto)” in the list — corrections are welcome. In the Weather overlay the built-in English/German wording remains the fallback for empty fields.
New: The Privacy page now has a line under the counters that says how many third-party services Overlay talks to, highlighted in orange, with each of them listed below — the same line the other Everstra apps show in green as “Third parties: 0”.
Privacy page: the exports now show the encryption that the page shows — the CSV has the columns “protocol” and “encrypted”, and the PNG marks every connection that travels without encryption as “unencrypted”.
Change: Managing your own files and settings (deleting media, restoring a configuration backup) no longer needs a licence, as in Everstra Capture (renaming already worked) — but nothing the app shows is unlocked: an imported backup switches on no overlay, and uploading new media stays locked, until a licence is active again.
Fix: At start, Overlay could wait without limit for the camera to answer one of its own requests (device information, location, image settings) and stay unusable for that time. Such a request now gives up after 30 seconds, as in the other Everstra apps.
Change: The light/dark choice is now kept on the camera, as in Everstra Live — it is the same in every browser. A choice this browser had kept until now is taken over once.
Change: The language choice for a single text is now a small globe at the end of the field instead of a full list under every field — the page is tidier, and the list that fills all fields of a panel at once stays where it was.
Notices on the settings pages behave the same in every Everstra app: a success or info message goes after a few seconds, a warning or an error stays until the next message, so it cannot vanish before it is read, and a new message no longer hides a fresh error early.
Privacy page: a service that is set up but switched off is now shown as “Configured” (blue) instead of “Armed” (yellow) — the same word as in the other Everstra apps; yellow is kept for real warnings. The headline counts these services as “configured and idle”, and “last updated” shows the date and time zone.
Fix: A caption that was cut off inside an umlaut or another multi-byte character could leave the rest of a panel empty — text was shortened byte by byte, and half a character puts the drawing library into an error state in which nothing more is drawn. This could hit any installation with such characters in long captions, German ones for example (the weather wind line too). Text is now shortened only between whole characters.
Fix: Seven AIS captions (Type, Distance, Speed, Course, Position, Inbound, Outbound) were silently cut to 31 bytes although the field accepted 63, and the time stamp could not hold a longer word for “today”; text fields sent from the settings page (location name, custom title and others) were cut at a byte count. All of them now keep the full text the field accepts, cut only between whole characters.

v0.5.0 2026-10-11

New: Online activation. In the License tab, “Activate online” lets the camera fetch its licence key itself, in one click. The camera contacts activate.everstra.com once — only when you click — and sends its hardware ID, its model, its firmware version (e.g. 11.11) and the module name, plus an e-mail address if you enter one for a copy of your key. The hardware ID is used only to sign the key and is not stored. Offline activation with a key file works as before.
New: The premium modules AIS Ship Tracker and Water Levels can be activated online the same way, each on its own page.
Privacy: Activations are counted anonymously — only the module, the camera model, the firmware version (major.minor) and the day of activation, without time of day, to keep Everstra working on the cameras and firmware in use; no hardware ID, no IP address, no e-mail address. The License tab lists what is kept and what is used once and discarded. The privacy policy on everstra.com and the app's Interfaces page now list the activation connection. In operation the app does not contact Everstra.
Licence: After an online activation the key is shown in the app and can be downloaded as a file; after a reinstall on the same camera it can be loaded again without any server contact. The licence agreement (EULA) is updated to version 1.1 accordingly.
Licence: The app reads the new licence format issued by the online activation. Existing licence files remain valid — nothing to do.
Licence: A licence key can also be pasted into the License tab instead of choosing a file. Licence files are now named with the camera's hardware ID and end in .lic (everstra_<module>_license_<hardware ID>.lic); existing .dat files still work.
New: Update notifications (optional, off by default). Switched on in the License tab, the camera fetches a small file with the newest version number from updates.everstra.com once a day and shows a banner on every page when a newer version — or a security update — is available, with its release date and a Download button; a regular notice can be dismissed for that version, a security notice cannot. “Check now” in the License tab checks at once. Nothing about the camera is sent: no hardware ID, no model, not even its version. Switched off, no connection is made.
Licence: Without a valid licence the start page now says so at the top — above every tab — with a button straight to the License tab; the notice on the editor pages links there too.
Licence: While the app is licensed, the License tab offers the licence key at any time — “Show license key” and “Download license file” (everstra_<module>_license_<hardware ID>.lic). The camera reads its own licence file; no server contact. So the key is never lost, even after an online activation without e-mail.
AIS and Water Levels: each page now has a licence status card (badge, hardware ID, and while licensed the key to show or download again); with the core licence paused it says so and links to it; the premium notice links to the activation below; the core License tab lists both premium modules at a glance.
Privacy: The Interfaces page lists the update check as a connection of its own — on or off, and what it sends.

v0.4.0 2026-10-06

New: Water Levels (Premium module) — tide and water-level information for Axis cameras, with a panel, a tidal curve and a map, drawing on the German BSH and PEGELONLINE services.
New: Water Levels panel — the current water level with a trend in cm/h, the next high and low waters with time and height, the water temperature, and optional mean high/low water values; times in the camera's local time, with out-of-date or provider-flagged values marked.
New: Water Levels tidal curve — the measured level and the forecast over a configurable time window, with high- and low-water markers and a "now" marker; where no official curve is available, an approximate curve is drawn and labelled as such.
New: Water Levels map — the chosen station and nearby stations with their current values on an OpenStreetMap background, with a scale bar, a north arrow and a level colour that reflects high, normal or low water; map tiles are loaded in the background and cached, so they are not re-fetched each time.
New: Water Levels water temperature — the current water temperature at a station of your choice, shown in the panel and on the map, and optionally in the weather overlay.
New: Water Levels data sources — tides, curve and forecast from BSH, and level, trend and water temperature from PEGELONLINE, covering the North Sea and Baltic coasts as well as inland rivers and waterways nationwide; stations without tides show level and trend only, and a relative gauge without a defined zero is shown in metres above sea level.
New: Water Levels tide file — as an alternative or fallback to the online tide service, you can upload a BSH tide prediction file, which is checked before it is accepted.
New: Water Levels display options — panel, curve and map can each be placed, sized, styled and enabled independently, can be scheduled like the other overlays, and can be shown automatically only when the level crosses a threshold; the on-screen labels can be translated by overriding the text fields.
New: the weather overlay can show the water temperature from Water Levels as an additional line, in the unit of the weather card.
New: reorganised module overview and navigation with a consistent order and layout across all pages.
Changed: the map attribution on the AIS and Water Levels overlays is now shown in a compact box in the lower-left corner and names only the sources actually in use.
Privacy: with Water Levels, the camera fetches water-level and tide data from BSH and PEGELONLINE, and map tiles from OpenStreetMap; when nearby stations are shown on the map, the centre of the map view and a radius are sent to PEGELONLINE. The station picker in the settings loads OpenStreetMap tiles in your browser. All connections are listed on the Privacy page with their current status.
Fixed: the AIS map now always shows the required "© OpenStreetMap contributors" attribution; when a MapTiler style is used, the MapTiler attribution and logo are shown as required, and the logo can be hidden with a paid MapTiler account.
Robustness: the media archive is now built without invoking a shell and no longer follows symbolic links, closing a potential security weakness.

v0.3.5 2026-10-03

Security: An internal security review of Everstra identified weaknesses in how Everstra Overlay handles file names and stored credentials. All of them are closed with this release. Automated tests now guard against these cases.
Security: The media download did not restrict file names, so a request could read files outside the media folder, including settings of other apps on the same camera. This required a camera administrator login; viewer and operator accounts could not use it. File names are now strictly validated and confined to the media folder.
Security: API keys (weather provider, MapTiler) were returned in plain text by the settings interface and included in backup files. They now stay on the camera and are never sent back; the settings page only shows whether a key is set. After restoring a backup on a different camera, enter the keys again.
Security: The settings file containing API keys was readable by other processes on the camera. It is now readable only by Everstra Overlay.
Security: Credentials embedded in a URL were not fully hidden on the Privacy page, and a malformed internal message could write camera access data to the system log. Both are fixed.
Fixed: Everstra Overlay could crash repeatedly when the camera's internet connection was very slow or name resolution (DNS) did not respond. The weather overlay then showed "..." because the app kept restarting. Network requests no longer rely on signals for their timeouts, so a slow connection can no longer bring the app down.
Changed: AIS classic map: while a vessel moving inside the GPS box keeps the map active, all other tracked vessels inside the visible map section are now shown as well — for example an inbound vessel while another one is leaving. The GPS box still decides when the map appears; additional vessels do not change the map section.
Changed: When the number of vessels shown is limited, moving vessels now take precedence over vessels at rest (overview and classic map).
Robustness: A failed weather request is now logged even if no request had succeeded since the app started.
Privacy: The Privacy page now lists the inbound AIS data feed (UDP port) the camera listens on while the AIS module runs.

v0.3.4 2026-10-02

New: AIS Ship Tracker (Premium module) — real-time vessel tracking with an interactive map, ship symbols, true-to-scale silhouettes, and automatic view switching between the classic and overview modes.
New: type badge — a coloured ship-type abbreviation behind the vessel name, in the same colours as the ship symbols.
New: leader lines — when the positions next to a ship are occupied, its label is placed further away and joined to the symbol by a fine line.
New: three-stage label fallback — full name with second line, name only, then a shortened name — so more labels fit on a crowded map.
New: berth lines — assign vessels to berths by line segments instead of zones; the heading of a moored vessel is derived from the line's bearing.
New: departed log — shows each vessel once, with its latest departure; the entry is removed when the vessel returns to the harbour.
New: echo-sounder range rings, spaced progressively from the centre, with a choice of line style (solid, dashed, dotted).
New: the AIS settings show only the fields that apply, and four presets set up the automatic view switching in one step (Fixed view, Harbour watch, Overview only, Custom).
New: configurable date format for arrival and departure times (DD.MM or MM-DD).
New: range ring step in the overview of up to 20 nm.
New: automatic view switching follows the GPS box — the classic view starts when a vessel enters the box and the overview timer starts as soon as it leaves.
New: reorganised start page with Modules, Special use cases and Premium modules, including placeholders for upcoming features.
New: the weather overlay can use uploaded font files for its regular and bold text.
Privacy: with the AIS map shown on a map background, the camera fetches map tiles from OpenStreetMap, or from MapTiler if you enter a MapTiler key. Both connections are listed on the Privacy page with their current status; with the plain background no tiles are fetched at all.
Fixed: a calculation error in the width of the weather sun card.
Robustness: a licence file is now uploaded atomically — a broken or incomplete upload can no longer replace a valid licence.

v0.3.3 2026-09-11

New: Everstra Overlay is now an officially Axis-signed ACAP application. The package is countersigned by Axis Communications, which verifies its origin and integrity — it installs even on cameras configured to reject unsigned apps (AXIS OS 11.11 and later).
New: verified authenticity — the Axis signature establishes a trust chain from the camera's firmware to the application, so the device can confirm the package's origin and integrity. This is a key requirement for use in professional and corporate camera networks.
Changed: migrated the build to ACAP Native SDK 1.15.3 and manifest schema v2 — the technical prerequisite for Axis signing on AXIS OS 11.11.
Changed: declared OS compatibility as AXIS OS 11.11 up to 13; the app installs across this range.
Changed: tightened the requested camera permission to the specific VAPIX credentials method instead of a wildcard.
Improved: smaller, cleaner release binaries — debug symbols and internal build paths are now stripped from the shipped package.
Fixed: the application now reports its correct version (0.3.3) in the system log and in exported backup files.

v0.3.2 2026-08-20

New: image overlays can now be loaded in JPEG format, in addition to PNG. The two most common image formats are now fully supported.
Improved: the image upload dialog now offers only the formats that are actually supported (PNG and JPEG). Earlier versions also listed BMP, TIFF and SVG, which were never actually processed; the interface has been corrected accordingly. Support for further formats may follow in the future.
Robustness: corrupted, truncated or oversized image files are now rejected safely without affecting the running application.
Under the hood: a routine code review of our modules revealed that earlier versions bundled an undeclared copy of the JPEG library (libjpeg-turbo) via the Skia graphics library. This has been corrected - the application now contains exactly one, correctly documented version of libjpeg-turbo (3.0.1), so that the license notice and the actual program contents match precisely.

v0.3.1 2026-08-18

Improved: the interface now loads faster thanks to smaller, optimised assets.

v0.3.0 2026-08-17

New: the Privacy page — an always-available overview of every connection Everstra Overlay itself opens, built from your actual configuration, showing each interface's status and the data it exchanges.
The weather overlay's use of Open-Meteo is shown for exactly what it is: the one external service Overlay can contact, and only while the weather overlay is switched on. Everything else Overlay opens is local to the camera or inbound access.
Connections are grouped by kind — external service, your own destinations, local, and inbound — with targets masked; secrets such as keys are never shown.
Export the overview as PNG or CSV, with automatic refresh and a clear "last updated" time. The page is always available and never counts against your license.
The report is backed by a build check that fails if any connection the code can open is missing from it, so a forgotten outbound path cannot silently slip past the overview.
Under the hood: interface and styling assets now carry a content hash, so a normal reload always shows the current version after an update.

v0.2.4 2026-08-12

Several UI improvements.

v0.2.3 2026-07-26

Third-party notices now list only the components actually bundled in this module

v0.2.2 2026-07-26

Fix: the shared storage root and media folder are now created with the correct group permissions, preventing a permission conflict with Live's storage check

v0.2.1 2026-07-24

License status is now enforced while the app is running: if a trial or license becomes invalid, active overlays are removed from the stream and the scheduler pauses within five minutes — everything resumes automatically, without a restart, the moment a valid license is active again
Your configuration is never affected by a paused license: all settings stay intact, remain visible, and can still be exported as a backup at any time
Fix: with an expired trial, the Activate button could not be used — a license could be selected but not activated
Fix: the Backup Restore screen now correctly describes that importing a backup merges into your current settings instead of replacing them

v0.2.0 2026-07-23

New overlay type: Weather — live conditions from Open-Meteo, no API key or account required
Five weather layouts: Compact, Current + Clock, Sunrise/Sunset, Wind, and a detailed multi-value card
Per-overlay units, language, colour scheme, time format, font and automatic day/night icons
Weather data attribution is shown as its own overlay, with configurable position, size and style
Weather overlays require a one-time acknowledgement of the Open-Meteo terms — the free data is for non-commercial use; commercial use needs a paid Open-Meteo plan (custom API URL + key)
Up to 2 weather overlays, schedulable with the existing weekly / hourly / sunrise-sunset / date-exception rules
Security: backups no longer export secrets (such as a weather API key), and restoring a backup now merges into your current configuration instead of overwriting it
Fix: 'Layer Order' now actually controls which overlay is drawn on top
Fix: an overlay could stay stuck on screen if its removal failed — overlays are now cleared reliably
Fix: the icon could overlap the temperature in the Compact weather layout

v0.1.1 2026-07-22

Scheduler now requires explicit per-overlay activation — manual on/off is no longer overwritten
Fix: GPS coordinates were lost when saving unrelated scheduler settings
Hourly scheduler: switch a whole row between active and disabled
Reduced logging: periodic text-ticker output removed

v0.1.0 2026-07-19

Initial release of Everstra Overlay
Text overlays with Skia rendering engine
Crawl text animation (left/right) via Graphics2 DMA-BUF pipeline
Graphic overlays with image support
Up to 5 text overlays and 5 graphic overlays
Media Manager for images and fonts (internal + SD card)
Scheduler with weekly plan, hourly plan, sunrise/sunset, date exceptions
Auto-save configuration
Backup & Restore (JSON config export/import, media ZIP download)
Stream-based live preview
7-day trial, free license activation
Supported: ARTPEC-7 (armv7hf) and ARTPEC-8/9 (aarch64)