diff --git a/CHANGELOG.md b/CHANGELOG.md index 7328c02..55a75f3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se ## [Unreleased] +## [0.5.0] - 2026-10-15 + ### Added - An opt-in plain-text token store, for machines that have no system keychain (an SSH or jump host, @@ -379,7 +381,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se - Profiles (`config`), shell completions, and release archives for Linux, macOS and Windows signed with Sigstore and with SLSA provenance. -[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.4...HEAD +[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.5.0...HEAD +[0.5.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.4...v0.5.0 [0.4.4]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.3...v0.4.4 [0.4.3]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.2...v0.4.3 [0.4.2]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.1...v0.4.2 diff --git a/Cargo.lock b/Cargo.lock index 0672816..bf518b6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -970,7 +970,7 @@ dependencies = [ [[package]] name = "hodeishield-api" -version = "0.4.4" +version = "0.5.0" dependencies = [ "mockito", "reqwest", @@ -983,7 +983,7 @@ dependencies = [ [[package]] name = "hodeishield-cli" -version = "0.4.4" +version = "0.5.0" dependencies = [ "apple-native-keyring-store", "assert_cmd", @@ -3067,7 +3067,7 @@ checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc" [[package]] name = "xtask" -version = "0.4.4" +version = "0.5.0" dependencies = [ "clap", "clap_mangen", diff --git a/Cargo.toml b/Cargo.toml index 71fff82..8ae10c8 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -5,7 +5,7 @@ default-members = ["crates/hodeishield-api", "crates/hodeishield-cli"] [workspace.package] authors = ["Hodeitek S.L. "] -version = "0.4.4" +version = "0.5.0" edition = "2024" rust-version = "1.98" license = "Apache-2.0" diff --git a/README.md b/README.md index e2bc4ee..8d4e54b 100644 --- a/README.md +++ b/README.md @@ -56,14 +56,14 @@ section), and put `hodeishield` (`hodeishield.exe` on Windows) somewhere on your | Windows x86_64 | `hodeishield--x86_64-pc-windows-msvc.zip` | | Windows arm64 | `hodeishield--aarch64-pc-windows-msvc.zip` (from 0.4.0) | -`` has no leading `v`: release `v0.4.4` ships `hodeishield-0.4.4-…`. The Linux binaries are +`` has no leading `v`: release `v0.5.0` ships `hodeishield-0.5.0-…`. The Linux binaries are statically linked and run on any distribution. Homebrew and Scoop packages (next section) and a [container image](#container-image) are also available. From source, with the Rust toolchain installed (pin the release tag you want): ```sh -cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.4.4 hodeishield-cli +cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.5.0 hodeishield-cli ``` ### Homebrew and Scoop @@ -179,7 +179,7 @@ exact version, or better its digest. The image carries no documentation: the 0.4.2, as `USER-INFORMATION.md` in its archives. ```sh -v=0.4.4 # the version you want +v=0.5.0 # the version you want docker pull ghcr.io/hodeitek/hodeishield-cli:$v docker run --rm -e HODEISHIELD_API_KEY ghcr.io/hodeitek/hodeishield-cli:$v vendors list ``` @@ -193,7 +193,7 @@ The image is signed by digest with cosign (keyless) and carries the release's Cy signed attestation. Verify both before you rely on the image: ```sh -v=0.4.4 +v=0.5.0 image=ghcr.io/hodeitek/hodeishield-cli:$v cosign verify $image \ --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/container-image.yml@refs/tags/v$v \ @@ -231,9 +231,9 @@ Each release has a `SHA256SUMS` file, a Sigstore bundle (`*.sigstore.json`) for ```sh sha256sum --ignore-missing -c SHA256SUMS -cosign verify-blob hodeishield-0.4.4-x86_64-unknown-linux-musl.tar.gz \ - --bundle hodeishield-0.4.4-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.4 \ +cosign verify-blob hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz \ + --bundle hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.0 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push ``` @@ -268,7 +268,7 @@ on the binary, so the block still applies. A download with `curl` does not set i place: ```sh -curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.4.4/hodeishield-0.4.4-universal-apple-darwin.tar.gz +curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.5.0/hodeishield-0.5.0-universal-apple-darwin.tar.gz ``` **Windows, before 0.2.0.** Unblock the archive before unpacking it, so the executable does not diff --git a/docs/release-signing.md b/docs/release-signing.md index 945e22d..e47d5a8 100644 --- a/docs/release-signing.md +++ b/docs/release-signing.md @@ -80,7 +80,7 @@ an RFC 3161 timestamp from `http://timestamp.acs.microsoft.com`. - **Switch.** The repository variable `WINDOWS_SIGNING_ENABLED` turns the signing on, and only for a run started by a pushed `v*` tag. -The signatures of every signed release so far (0.2.0 to 0.4.4) carry: +The signatures of every signed release so far (0.2.0 to 0.5.0) carry: | Field | Value | |---|---| diff --git a/docs/verifying-releases.md b/docs/verifying-releases.md index eb13afb..0bb181b 100644 --- a/docs/verifying-releases.md +++ b/docs/verifying-releases.md @@ -30,14 +30,14 @@ From 0.4.2, every archive, `.deb`, `.rpm` and MSI also contains `USER-INFORMATIO too. The `.deb` and `.rpm` install it in `/usr/share/doc/hodeishield/`, the MSI next to `hodeishield.exe`. -The steps below use `v0.4.4` and `hodeishield-0.4.4-x86_64-unknown-linux-musl.tar.gz` +The steps below use `v0.5.0` and `hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz` as examples — substitute the actual version and archive you downloaded. ## 1. Download the files From the release page, download: -- the archive you want (e.g. `hodeishield-0.4.4-x86_64-unknown-linux-musl.tar.gz`) +- the archive you want (e.g. `hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz`) - `SHA256SUMS` - the matching `.sigstore.json` - `SHA256SUMS.sigstore.json` @@ -62,7 +62,7 @@ in the format cosign v3 reads by default. Older cosign versions cannot read them ```sh cosign verify-blob \ --bundle SHA256SUMS.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.4 \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.0 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ SHA256SUMS @@ -72,11 +72,11 @@ Repeat for the archive itself, using its own `.sigstore.json`: ```sh cosign verify-blob \ - --bundle hodeishield-0.4.4-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.4 \ + --bundle hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.0 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ - hodeishield-0.4.4-x86_64-unknown-linux-musl.tar.gz + hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz ``` A successful verification confirms the file was signed by the @@ -89,11 +89,11 @@ The SBOM is verified the same way, with its own bundle: ```sh cosign verify-blob \ - --bundle hodeishield-0.4.4-x86_64-unknown-linux-musl.cdx.json.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.4.4 \ + --bundle hodeishield-0.5.0-x86_64-unknown-linux-musl.cdx.json.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.0 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ - hodeishield-0.4.4-x86_64-unknown-linux-musl.cdx.json + hodeishield-0.5.0-x86_64-unknown-linux-musl.cdx.json ``` ## 4. Verify SLSA build provenance @@ -102,10 +102,10 @@ Requires [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier). ```sh slsa-verifier verify-artifact \ - hodeishield-0.4.4-x86_64-unknown-linux-musl.tar.gz \ + hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz \ --provenance-path hodeishield.intoto.jsonl \ --source-uri github.com/Hodeitek/hodeishield-cli \ - --source-tag v0.4.4 + --source-tag v0.5.0 ``` `hodeishield.intoto.jsonl` is attached to the release and covers every