From e67a812d51fefb0c7aa873bcfd8dde6a33ba3f1d Mon Sep 17 00:00:00 2001 From: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> Date: Mon, 12 Oct 2026 12:12:26 +0200 Subject: [PATCH 1/2] Prepare 0.4.1: version and changelog Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> --- CHANGELOG.md | 5 ++++- Cargo.lock | 6 +++--- Cargo.toml | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 03a1581..5e4fc82 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se ## [Unreleased] +## [0.4.1] - 2026-10-12 + ### Fixed - `install.sh` now checks the release's signature with cosign v2 (2.4 or newer) as well as v3. With @@ -221,7 +223,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se - Profiles (`config`), shell completions, and release archives for Linux, macOS and Windows signed with Sigstore and with SLSA provenance. -[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.0...HEAD +[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.1...HEAD +[0.4.1]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.0...v0.4.1 [0.4.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.3.1...v0.4.0 [0.3.1]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.3.0...v0.3.1 [0.3.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.2.0...v0.3.0 diff --git a/Cargo.lock b/Cargo.lock index fb882c9..6a2ef28 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -970,7 +970,7 @@ dependencies = [ [[package]] name = "hodeishield-api" -version = "0.4.0" +version = "0.4.1" dependencies = [ "mockito", "reqwest", @@ -983,7 +983,7 @@ dependencies = [ [[package]] name = "hodeishield-cli" -version = "0.4.0" +version = "0.4.1" dependencies = [ "apple-native-keyring-store", "assert_cmd", @@ -3066,7 +3066,7 @@ checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc" [[package]] name = "xtask" -version = "0.4.0" +version = "0.4.1" dependencies = [ "clap", "clap_mangen", diff --git a/Cargo.toml b/Cargo.toml index f27fa9c..ae1ad8e 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -5,7 +5,7 @@ default-members = ["crates/hodeishield-api", "crates/hodeishield-cli"] [workspace.package] authors = ["Hodeitek S.L. "] -version = "0.4.0" +version = "0.4.1" edition = "2024" rust-version = "1.98" license = "Apache-2.0" From d4433f747f39cac00db3d828a693699eb9465772 Mon Sep 17 00:00:00 2001 From: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> Date: Mon, 12 Oct 2026 12:12:27 +0200 Subject: [PATCH 2/2] Point the install examples at 0.4.1 Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> --- README.md | 16 ++++++++-------- docs/verifying-releases.md | 24 ++++++++++++------------ 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/README.md b/README.md index 4cad1bb..cb70c54 100644 --- a/README.md +++ b/README.md @@ -56,14 +56,14 @@ section), and put `hodeishield` (`hodeishield.exe` on Windows) somewhere on your | Windows x86_64 | `hodeishield--x86_64-pc-windows-msvc.zip` | | Windows arm64 | `hodeishield--aarch64-pc-windows-msvc.zip` (from 0.4.0) | -`` has no leading `v`: release `v0.4.0` ships `hodeishield-0.4.0-…`. The Linux binaries are +`` has no leading `v`: release `v0.4.1` ships `hodeishield-0.4.1-…`. The Linux binaries are statically linked and run on any distribution. Homebrew and Scoop packages (next section) and a [container image](#container-image) are also available. From source, with the Rust toolchain installed (pin the release tag you want): ```sh -cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.4.0 hodeishield-cli +cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.4.1 hodeishield-cli ``` ### Homebrew and Scoop @@ -169,7 +169,7 @@ manager, CA certificates included) and runs as a non-root user. There is no `lat exact version, or better its digest. ```sh -v=0.4.0 # the version you want +v=0.4.1 # the version you want docker pull ghcr.io/hodeitek/hodeishield-cli:$v docker run --rm -e HODEISHIELD_API_KEY ghcr.io/hodeitek/hodeishield-cli:$v vendors list ``` @@ -182,7 +182,7 @@ The image is signed by digest with cosign (keyless) and carries the release's Cy signed attestation. Verify both before you rely on the image: ```sh -v=0.4.0 +v=0.4.1 image=ghcr.io/hodeitek/hodeishield-cli:$v cosign verify $image \ --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/container-image.yml@refs/tags/v$v \ @@ -220,9 +220,9 @@ Each release has a `SHA256SUMS` file, a Sigstore bundle (`*.sigstore.json`) for ```sh sha256sum --ignore-missing -c SHA256SUMS -cosign verify-blob hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz \ - --bundle hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \ +cosign verify-blob hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz \ + --bundle hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.1 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push ``` @@ -250,7 +250,7 @@ xattr -d com.apple.quarantine ./hodeishield # "No such xattr" means there was Or download with `curl`, which does not set that attribute in the first place: ```sh -curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.4.0/hodeishield-0.4.0-universal-apple-darwin.tar.gz +curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.4.1/hodeishield-0.4.1-universal-apple-darwin.tar.gz ``` **Windows, before 0.2.0.** Unblock the archive before unpacking it, so the executable does not diff --git a/docs/verifying-releases.md b/docs/verifying-releases.md index b4a15bd..cca6531 100644 --- a/docs/verifying-releases.md +++ b/docs/verifying-releases.md @@ -7,7 +7,7 @@ Every release of `hodeishield-cli` publishes, for each platform archive: "bundle" files produced by **keyless** `cosign sign-blob` (no private key: the workflow signs using its GitHub Actions OIDC identity, and the signature is recorded in the public Rekor transparency log). -- `hodeishield--aarch64-pc-windows-msvc.zip` (Windows on Arm, from 0.4.0), +- `hodeishield--aarch64-pc-windows-msvc.zip` (Windows on Arm, from 0.4.1), checksummed, signed with Sigstore, covered by the provenance and accompanied by its SBOM like the other archives. Its `hodeishield.exe` carries the same Authenticode signature (section 5). There is no arm64 MSI yet. @@ -25,14 +25,14 @@ Every release of `hodeishield-cli` publishes, for each platform archive: [`slsa-framework/slsa-github-generator`](https://github.com/slsa-framework/slsa-github-generator) generic generator. -The steps below use `v0.4.0` and `hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz` +The steps below use `v0.4.1` and `hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz` as examples — substitute the actual version and archive you downloaded. ## 1. Download the files From the release page, download: -- the archive you want (e.g. `hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz`) +- the archive you want (e.g. `hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz`) - `SHA256SUMS` - the matching `.sigstore.json` - `SHA256SUMS.sigstore.json` @@ -57,7 +57,7 @@ in the format cosign v3 reads by default. Older cosign versions cannot read them ```sh cosign verify-blob \ --bundle SHA256SUMS.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.1 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ SHA256SUMS @@ -67,11 +67,11 @@ Repeat for the archive itself, using its own `.sigstore.json`: ```sh cosign verify-blob \ - --bundle hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \ + --bundle hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.1 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ - hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz + hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz ``` A successful verification confirms the file was signed by the @@ -84,11 +84,11 @@ The SBOM is verified the same way, with its own bundle: ```sh cosign verify-blob \ - --bundle hodeishield-0.4.0-x86_64-unknown-linux-musl.cdx.json.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \ + --bundle hodeishield-0.4.1-x86_64-unknown-linux-musl.cdx.json.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.1 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ - hodeishield-0.4.0-x86_64-unknown-linux-musl.cdx.json + hodeishield-0.4.1-x86_64-unknown-linux-musl.cdx.json ``` ## 4. Verify SLSA build provenance @@ -97,10 +97,10 @@ Requires [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier). ```sh slsa-verifier verify-artifact \ - hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz \ + hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz \ --provenance-path hodeishield.intoto.jsonl \ --source-uri github.com/Hodeitek/hodeishield-cli \ - --source-tag v0.4.0 + --source-tag v0.4.1 ``` `hodeishield.intoto.jsonl` is attached to the release and covers every