Skip to content

Prepare 0.4.1 #143

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Gorka Gonzalo (d0ubl3g) merged 2 commits into from
Oct 12, 2026
Merged

Prepare 0.4.1 #143

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e67a812
Prepare 0.4.1: version and changelog
d0ubl3g Oct 12, 2026
d4433f7
Point the install examples at 0.4.1
d0ubl3g Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se

## [Unreleased]

## [0.4.1] - 2026-10-12

### Fixed

- `install.sh` now checks the release's signature with cosign v2 (2.4 or newer) as well as v3. With
Expand Down Expand Up @@ -221,7 +223,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se
- Profiles (`config`), shell completions, and release archives for Linux, macOS and Windows signed
with Sigstore and with SLSA provenance.

[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.0...HEAD
[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.1...HEAD
[0.4.1]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.0...v0.4.1
[0.4.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.3.1...v0.4.0
[0.3.1]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.3.0...v0.3.1
[0.3.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.2.0...v0.3.0
Expand Down
6 changes: 3 additions & 3 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ default-members = ["crates/hodeishield-api", "crates/hodeishield-cli"]

[workspace.package]
authors = ["Hodeitek S.L. <info@hodeitek.com>"]
version = "0.4.0"
version = "0.4.1"
edition = "2024"
rust-version = "1.98"
license = "Apache-2.0"
Expand Down
16 changes: 8 additions & 8 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,14 +56,14 @@ section), and put `hodeishield` (`hodeishield.exe` on Windows) somewhere on your
| Windows x86_64 | `hodeishield-<version>-x86_64-pc-windows-msvc.zip` |
| Windows arm64 | `hodeishield-<version>-aarch64-pc-windows-msvc.zip` (from 0.4.0) |

`<version>` has no leading `v`: release `v0.4.0` ships `hodeishield-0.4.0-…`. The Linux binaries are
`<version>` has no leading `v`: release `v0.4.1` ships `hodeishield-0.4.1-…`. The Linux binaries are
statically linked and run on any distribution. Homebrew and Scoop packages (next section) and a
[container image](#container-image) are also available.

From source, with the Rust toolchain installed (pin the release tag you want):

```sh
cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.4.0 hodeishield-cli
cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.4.1 hodeishield-cli
```

### Homebrew and Scoop
Expand Down Expand Up @@ -169,7 +169,7 @@ manager, CA certificates included) and runs as a non-root user. There is no `lat
exact version, or better its digest.

```sh
v=0.4.0 # the version you want
v=0.4.1 # the version you want
docker pull ghcr.io/hodeitek/hodeishield-cli:$v
docker run --rm -e HODEISHIELD_API_KEY ghcr.io/hodeitek/hodeishield-cli:$v vendors list
```
Expand All @@ -182,7 +182,7 @@ The image is signed by digest with cosign (keyless) and carries the release's Cy
signed attestation. Verify both before you rely on the image:

```sh
v=0.4.0
v=0.4.1
image=ghcr.io/hodeitek/hodeishield-cli:$v
cosign verify $image \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/container-image.yml@refs/tags/v$v \
Expand Down Expand Up @@ -220,9 +220,9 @@ Each release has a `SHA256SUMS` file, a Sigstore bundle (`*.sigstore.json`) for
```sh
sha256sum --ignore-missing -c SHA256SUMS

cosign verify-blob hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz \
--bundle hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \
cosign verify-blob hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz \
--bundle hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.1 \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-github-workflow-trigger push
```
Expand Down Expand Up @@ -250,7 +250,7 @@ xattr -d com.apple.quarantine ./hodeishield # "No such xattr" means there was
Or download with `curl`, which does not set that attribute in the first place:

```sh
curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.4.0/hodeishield-0.4.0-universal-apple-darwin.tar.gz
curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.4.1/hodeishield-0.4.1-universal-apple-darwin.tar.gz
```

**Windows, before 0.2.0.** Unblock the archive before unpacking it, so the executable does not
Expand Down
24 changes: 12 additions & 12 deletions docs/verifying-releases.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ Every release of `hodeishield-cli` publishes, for each platform archive:
"bundle" files produced by **keyless** `cosign sign-blob` (no private key:
the workflow signs using its GitHub Actions OIDC identity, and the
signature is recorded in the public Rekor transparency log).
- `hodeishield-<version>-aarch64-pc-windows-msvc.zip` (Windows on Arm, from 0.4.0),
- `hodeishield-<version>-aarch64-pc-windows-msvc.zip` (Windows on Arm, from 0.4.1),
checksummed, signed with Sigstore, covered by the provenance and accompanied by its
SBOM like the other archives. Its `hodeishield.exe` carries the same Authenticode signature
(section 5). There is no arm64 MSI yet.
Expand All @@ -25,14 +25,14 @@ Every release of `hodeishield-cli` publishes, for each platform archive:
[`slsa-framework/slsa-github-generator`](https://github.com/slsa-framework/slsa-github-generator)
generic generator.

The steps below use `v0.4.0` and `hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz`
The steps below use `v0.4.1` and `hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz`
as examples — substitute the actual version and archive you downloaded.

## 1. Download the files

From the release page, download:

- the archive you want (e.g. `hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz`)
- the archive you want (e.g. `hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz`)
- `SHA256SUMS`
- the matching `<archive>.sigstore.json`
- `SHA256SUMS.sigstore.json`
Expand All @@ -57,7 +57,7 @@ in the format cosign v3 reads by default. Older cosign versions cannot read them
```sh
cosign verify-blob \
--bundle SHA256SUMS.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.1 \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-github-workflow-trigger push \
SHA256SUMS
Expand All @@ -67,11 +67,11 @@ Repeat for the archive itself, using its own `.sigstore.json`:

```sh
cosign verify-blob \
--bundle hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \
--bundle hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.1 \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-github-workflow-trigger push \
hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz
hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz
```

A successful verification confirms the file was signed by the
Expand All @@ -84,11 +84,11 @@ The SBOM is verified the same way, with its own bundle:

```sh
cosign verify-blob \
--bundle hodeishield-0.4.0-x86_64-unknown-linux-musl.cdx.json.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.0 \
--bundle hodeishield-0.4.1-x86_64-unknown-linux-musl.cdx.json.sigstore.json \
--certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.1 \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-github-workflow-trigger push \
hodeishield-0.4.0-x86_64-unknown-linux-musl.cdx.json
hodeishield-0.4.1-x86_64-unknown-linux-musl.cdx.json
```

## 4. Verify SLSA build provenance
Expand All @@ -97,10 +97,10 @@ Requires [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier).

```sh
slsa-verifier verify-artifact \
hodeishield-0.4.0-x86_64-unknown-linux-musl.tar.gz \
hodeishield-0.4.1-x86_64-unknown-linux-musl.tar.gz \
--provenance-path hodeishield.intoto.jsonl \
--source-uri github.com/Hodeitek/hodeishield-cli \
--source-tag v0.4.0
--source-tag v0.4.1
```

`hodeishield.intoto.jsonl` is attached to the release and covers every
Expand Down
Loading