Skip to content

Prepare 0.4.0 #139

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Gorka Gonzalo (d0ubl3g) merged 2 commits into from
Oct 12, 2026
Merged

Prepare 0.4.0 #139

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2df390a
Prepare 0.4.0: version and changelog
d0ubl3g Oct 11, 2026
67998dc
Point the install examples at 0.4.0
d0ubl3g Oct 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se

## [Unreleased]

## [0.4.0] - 2026-10-12

### Added

- Each release now includes a Windows on Arm build, `hodeishield-<version>-aarch64-pc-windows-msvc.zip`.
Expand Down Expand Up @@ -210,7 +212,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se
- Profiles (`config`), shell completions, and release archives for Linux, macOS and Windows signed
with Sigstore and with SLSA provenance.

[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.3.1...HEAD
[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.0...HEAD
[0.4.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.3.1...v0.4.0
[0.3.1]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.3.0...v0.3.1
[0.3.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.2.0...v0.3.0
[0.2.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.1.1...v0.2.0
Expand Down
6 changes: 3 additions & 3 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ default-members = ["crates/hodeishield-api", "crates/hodeishield-cli"]

[workspace.package]
authors = ["Hodeitek S.L. <info@hodeitek.com>"]
version = "0.3.1"
version = "0.4.0"
edition = "2024"
rust-version = "1.98"
license = "Apache-2.0"
Expand Down
24 changes: 12 additions & 12 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,16 +54,16 @@ section), and put `hodeishield` (`hodeishield.exe` on Windows) somewhere on your
| Linux arm64 | `hodeishield-<version>-aarch64-unknown-linux-musl.tar.gz` |
| macOS (Apple silicon and Intel) | `hodeishield-<version>-universal-apple-darwin.tar.gz` |
| Windows x86_64 | `hodeishield-<version>-x86_64-pc-windows-msvc.zip` |
| Windows arm64 | `hodeishield-<version>-aarch64-pc-windows-msvc.zip` (from the first release after 0.3.1) |
| Windows arm64 | `hodeishield-<version>-aarch64-pc-windows-msvc.zip` (from 0.4.0) |

`<version>` has no leading `v`: release `v0.3.1` ships `hodeishield-0.3.1-…`. The Linux binaries are
statically linked and run on any distribution. Homebrew and Scoop packages are also available
(next section).
`<version>` has no leading `v`: release `v0.4.0` ships `hodeishield-0.4.0-…`. The Linux binaries are
statically linked and run on any distribution. Homebrew and Scoop packages (next section) and a
[container image](#container-image) are also available.

From source, with the Rust toolchain installed (pin the release tag you want):

```sh
cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.3.1 hodeishield-cli
cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.4.0 hodeishield-cli
```

### Homebrew and Scoop
Expand Down Expand Up @@ -159,9 +159,9 @@ that check (the checksum still runs). `sh install.sh --help` lists the options (

### Container image

From the first release after 0.3.0, each stable release also publishes a multi-architecture
(`linux/amd64`, `linux/arm64`) image at `ghcr.io/hodeitek/hodeishield-cli`, for CI jobs and container
pipelines. It holds only the release's own `hodeishield` binary on a
From 0.4.0, each stable release also publishes a multi-architecture (`linux/amd64`, `linux/arm64`)
image at `ghcr.io/hodeitek/hodeishield-cli`, for CI jobs and container pipelines. It holds only the
release's own `hodeishield` binary on a
[distroless](https://github.com/GoogleContainerTools/distroless) static base (no shell, no package
manager, CA certificates included) and runs as a non-root user. There is no `latest` tag: use the
exact version, or better its digest.
Expand Down Expand Up @@ -218,9 +218,9 @@ Each release has a `SHA256SUMS` file, a Sigstore bundle (`*.sigstore.json`) for
```sh
sha256sum --ignore-missing -c SHA256SUMS

cosign verify-blob hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz \
--bundle hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.3.1 \
cosign verify-blob hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz \
--bundle hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-github-workflow-trigger push
```
Expand Down Expand Up @@ -248,7 +248,7 @@ xattr -d com.apple.quarantine ./hodeishield # "No such xattr" means there was
Or download with `curl`, which does not set that attribute in the first place:

```sh
curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.3.1/hodeishield-0.3.1-universal-apple-darwin.tar.gz
curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.4.0/hodeishield-0.4.0-universal-apple-darwin.tar.gz
```

**Windows, before 0.2.0.** Unblock the archive before unpacking it, so the executable does not
Expand Down
26 changes: 13 additions & 13 deletions docs/verifying-releases.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@ Every release of `hodeishield-cli` publishes, for each platform archive:
"bundle" files produced by **keyless** `cosign sign-blob` (no private key:
the workflow signs using its GitHub Actions OIDC identity, and the
signature is recorded in the public Rekor transparency log).
- `hodeishield-<version>-aarch64-pc-windows-msvc.zip` (Windows on Arm, from the first release
after 0.3.1), checksummed, signed with Sigstore, covered by the provenance and accompanied by its
- `hodeishield-<version>-aarch64-pc-windows-msvc.zip` (Windows on Arm, from 0.4.0),
checksummed, signed with Sigstore, covered by the provenance and accompanied by its
SBOM like the other archives. Its `hodeishield.exe` carries the same Authenticode signature
(section 5). There is no arm64 MSI yet.
- `hodeishield-<version>-x86_64-pc-windows-msvc.msi` (from 0.3.0), with its own
Expand All @@ -25,14 +25,14 @@ Every release of `hodeishield-cli` publishes, for each platform archive:
[`slsa-framework/slsa-github-generator`](https://github.com/slsa-framework/slsa-github-generator)
generic generator.

The steps below use `v0.3.1` and `hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz`
The steps below use `v0.4.0` and `hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz`
as examples — substitute the actual version and archive you downloaded.

## 1. Download the files

From the release page, download:

- the archive you want (e.g. `hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz`)
- the archive you want (e.g. `hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz`)
- `SHA256SUMS`
- the matching `<archive>.sigstore.json`
- `SHA256SUMS.sigstore.json`
Expand All @@ -55,7 +55,7 @@ Requires [`cosign`](https://github.com/sigstore/cosign) (v2 or newer).
```sh
cosign verify-blob \
--bundle SHA256SUMS.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.3.1 \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-github-workflow-trigger push \
SHA256SUMS
Expand All @@ -65,11 +65,11 @@ Repeat for the archive itself, using its own `.sigstore.json`:

```sh
cosign verify-blob \
--bundle hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.3.1 \
--bundle hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-github-workflow-trigger push \
hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz
hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz
```

A successful verification confirms the file was signed by the
Expand All @@ -82,11 +82,11 @@ The SBOM is verified the same way, with its own bundle:

```sh
cosign verify-blob \
--bundle hodeishield-0.3.1-x86_64-unknown-linux-musl.cdx.json.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.3.1 \
--bundle hodeishield-0.4.0-x86_64-unknown-linux-musl.cdx.json.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-github-workflow-trigger push \
hodeishield-0.3.1-x86_64-unknown-linux-musl.cdx.json
hodeishield-0.4.0-x86_64-unknown-linux-musl.cdx.json
```

## 4. Verify SLSA build provenance
Expand All @@ -95,10 +95,10 @@ Requires [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier).

```sh
slsa-verifier verify-artifact \
hodeishield-0.3.1-x86_64-unknown-linux-musl.tar.gz \
hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz \
--provenance-path hodeishield.intoto.jsonl \
--source-uri github.com/Hodeitek/hodeishield-cli \
--source-tag v0.3.1
--source-tag v0.4.0
```

`hodeishield.intoto.jsonl` is attached to the release and covers every
Expand Down
Loading