diff --git a/CHANGELOG.md b/CHANGELOG.md index 2847695..dc2746d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se ## [Unreleased] +## [0.4.0] - 2026-10-12 + ### Added - Each release now includes a Windows on Arm build, `hodeishield--aarch64-pc-windows-msvc.zip`. @@ -210,7 +212,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se - Profiles (`config`), shell completions, and release archives for Linux, macOS and Windows signed with Sigstore and with SLSA provenance. -[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.3.1...HEAD +[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.0...HEAD +[0.4.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.3.1...v0.4.0 [0.3.1]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.3.0...v0.3.1 [0.3.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.2.0...v0.3.0 [0.2.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.1.1...v0.2.0 diff --git a/Cargo.lock b/Cargo.lock index 61bf3f2..fb882c9 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -970,7 +970,7 @@ dependencies = [ [[package]] name = "hodeishield-api" -version = "0.3.1" +version = "0.4.0" dependencies = [ "mockito", "reqwest", @@ -983,7 +983,7 @@ dependencies = [ [[package]] name = "hodeishield-cli" -version = "0.3.1" +version = "0.4.0" dependencies = [ "apple-native-keyring-store", "assert_cmd", @@ -3066,7 +3066,7 @@ checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc" [[package]] name = "xtask" -version = "0.3.1" +version = "0.4.0" dependencies = [ "clap", "clap_mangen", diff --git a/Cargo.toml b/Cargo.toml index 9dd5bfb..f27fa9c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -5,7 +5,7 @@ default-members = ["crates/hodeishield-api", "crates/hodeishield-cli"] [workspace.package] authors = ["Hodeitek S.L. "] -version = "0.3.1" +version = "0.4.0" edition = "2024" rust-version = "1.98" license = "Apache-2.0" diff --git a/README.md b/README.md index 695f98f..7c9e9ac 100644 --- a/README.md +++ b/README.md @@ -54,16 +54,16 @@ section), and put `hodeishield` (`hodeishield.exe` on Windows) somewhere on your | Linux arm64 | `hodeishield--aarch64-unknown-linux-musl.tar.gz` | | macOS (Apple silicon and Intel) | `hodeishield--universal-apple-darwin.tar.gz` | | Windows x86_64 | `hodeishield--x86_64-pc-windows-msvc.zip` | -| Windows arm64 | `hodeishield--aarch64-pc-windows-msvc.zip` (from the first release after 0.3.1) | +| Windows arm64 | `hodeishield--aarch64-pc-windows-msvc.zip` (from 0.4.0) | -`` has no leading `v`: release `v0.3.1` ships `hodeishield-0.3.1-…`. The Linux binaries are -statically linked and run on any distribution. Homebrew and Scoop packages are also available -(next section). +`` has no leading `v`: release `v0.4.0` ships `hodeishield-0.4.0-…`. The Linux binaries are +statically linked and run on any distribution. Homebrew and Scoop packages (next section) and a +[container image](#container-image) are also available. From source, with the Rust toolchain installed (pin the release tag you want): ```sh -cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.3.1 hodeishield-cli +cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.4.0 hodeishield-cli ``` ### Homebrew and Scoop @@ -159,9 +159,9 @@ that check (the checksum still runs). `sh install.sh --help` lists the options ( ### Container image -From the first release after 0.3.0, each stable release also publishes a multi-architecture -(`linux/amd64`, `linux/arm64`) image at `ghcr.io/hodeitek/hodeishield-cli`, for CI jobs and container -pipelines. It holds only the release's own `hodeishield` binary on a +From 0.4.0, each stable release also publishes a multi-architecture (`linux/amd64`, `linux/arm64`) +image at `ghcr.io/hodeitek/hodeishield-cli`, for CI jobs and container pipelines. It holds only the +release's own `hodeishield` binary on a [distroless](https://github.com/GoogleContainerTools/distroless) static base (no shell, no package manager, CA certificates included) and runs as a non-root user. There is no `latest` tag: use the exact version, or better its digest. @@ -218,9 +218,9 @@ Each release has a `SHA256SUMS` file, a Sigstore bundle (`*.sigstore.json`) for ```sh sha256sum --ignore-missing -c SHA256SUMS -cosign verify-blob hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz \ - --bundle hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.3.1 \ +cosign verify-blob hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz \ + --bundle hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push ``` @@ -248,7 +248,7 @@ xattr -d com.apple.quarantine ./hodeishield # "No such xattr" means there was Or download with `curl`, which does not set that attribute in the first place: ```sh -curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.3.1/hodeishield-0.3.1-universal-apple-darwin.tar.gz +curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.4.0/hodeishield-0.4.0-universal-apple-darwin.tar.gz ``` **Windows, before 0.2.0.** Unblock the archive before unpacking it, so the executable does not diff --git a/docs/verifying-releases.md b/docs/verifying-releases.md index 10b058e..87e25f0 100644 --- a/docs/verifying-releases.md +++ b/docs/verifying-releases.md @@ -7,8 +7,8 @@ Every release of `hodeishield-cli` publishes, for each platform archive: "bundle" files produced by **keyless** `cosign sign-blob` (no private key: the workflow signs using its GitHub Actions OIDC identity, and the signature is recorded in the public Rekor transparency log). -- `hodeishield--aarch64-pc-windows-msvc.zip` (Windows on Arm, from the first release - after 0.3.1), checksummed, signed with Sigstore, covered by the provenance and accompanied by its +- `hodeishield--aarch64-pc-windows-msvc.zip` (Windows on Arm, from 0.4.0), + checksummed, signed with Sigstore, covered by the provenance and accompanied by its SBOM like the other archives. Its `hodeishield.exe` carries the same Authenticode signature (section 5). There is no arm64 MSI yet. - `hodeishield--x86_64-pc-windows-msvc.msi` (from 0.3.0), with its own @@ -25,14 +25,14 @@ Every release of `hodeishield-cli` publishes, for each platform archive: [`slsa-framework/slsa-github-generator`](https://github.com/slsa-framework/slsa-github-generator) generic generator. -The steps below use `v0.3.1` and `hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz` +The steps below use `v0.4.0` and `hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz` as examples — substitute the actual version and archive you downloaded. ## 1. Download the files From the release page, download: -- the archive you want (e.g. `hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz`) +- the archive you want (e.g. `hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz`) - `SHA256SUMS` - the matching `.sigstore.json` - `SHA256SUMS.sigstore.json` @@ -55,7 +55,7 @@ Requires [`cosign`](https://github.com/sigstore/cosign) (v2 or newer). ```sh cosign verify-blob \ --bundle SHA256SUMS.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.3.1 \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ SHA256SUMS @@ -65,11 +65,11 @@ Repeat for the archive itself, using its own `.sigstore.json`: ```sh cosign verify-blob \ - --bundle hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.3.1 \ + --bundle hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ - hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz + hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz ``` A successful verification confirms the file was signed by the @@ -82,11 +82,11 @@ The SBOM is verified the same way, with its own bundle: ```sh cosign verify-blob \ - --bundle hodeishield-0.3.1-x86_64-unknown-linux-musl.cdx.json.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.3.1 \ + --bundle hodeishield-0.4.0-x86_64-unknown-linux-musl.cdx.json.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ - hodeishield-0.3.1-x86_64-unknown-linux-musl.cdx.json + hodeishield-0.4.0-x86_64-unknown-linux-musl.cdx.json ``` ## 4. Verify SLSA build provenance @@ -95,10 +95,10 @@ Requires [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier). ```sh slsa-verifier verify-artifact \ - hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz \ + hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz \ --provenance-path hodeishield.intoto.jsonl \ --source-uri github.com/Hodeitek/hodeishield-cli \ - --source-tag v0.3.1 + --source-tag v0.4.0 ``` `hodeishield.intoto.jsonl` is attached to the release and covers every