From e6063238d44356b193947bc4fd84c8fdc5ea30cf Mon Sep 17 00:00:00 2001 From: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> Date: Sat, 31 Oct 2026 20:44:15 +0100 Subject: [PATCH] Prepare 0.7.0: version and changelog Set the version to 0.7.0 in Cargo.toml, Cargo.lock, the README and the release docs (release-signing and verifying-releases), and move the unreleased entries into a new 0.7.0 changelog section dated 2026-11-01. The section has a Changed heading (styled sign-in result page, SECURITY.md medium fix target counted from the report) and a Fixed heading (whoami exit code, macOS download steps). The whoami change is marked as a behaviour change for scripts, which is why this is a minor version. Unreleased is now empty and the compare links are updated. Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> --- CHANGELOG.md | 14 ++++++++++---- Cargo.lock | 6 +++--- Cargo.toml | 2 +- README.md | 28 ++++++++++++++-------------- docs/release-signing.md | 2 +- docs/verifying-releases.md | 24 ++++++++++++------------ 6 files changed, 41 insertions(+), 35 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b2eda6a..338cba5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,18 +6,23 @@ commands, `--json` output and exit codes. Each release's notes start with its se ## [Unreleased] +## [0.7.0] - 2026-11-01 + ### Changed - The page the browser shows at the end of `hodeishield login` is now a styled page with the product mark, for success, denied access, a failed or mismatched response and unknown paths. It follows the system light or dark preference, needs no script, font or outside request, and uses the language of the browser when it is supported. +- `SECURITY.md` now counts the fix target for medium-severity vulnerabilities from the report, like the + coordinated disclosure period, so it never runs past it: within 90 days of the report, extendable by + mutual agreement. Critical and high are still counted from the first assessment. ### Fixed -- `whoami` exits 3, like every other command, when the API does not accept the credential, after - printing the local details and the warning. An API that cannot be reached or fails on its side still - gives exit 0. +- **Behaviour change for scripts:** `whoami` now exits 3, like every other command, when the API + does not accept the credential, after printing the local details and the warning. It used to exit + 0. An API that cannot be reached or fails on its side still gives exit 0. - The README now describes the two macOS steps to allow a blocked browser download: **Allow Anyway** in System Settings → Privacy & Security, then **Open Anyway** in the dialog shown on the next run (measured on macOS 27.0.1 with 0.6.1). @@ -506,7 +511,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se - Profiles (`config`), shell completions, and release archives for Linux, macOS and Windows signed with Sigstore and with SLSA provenance. -[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.6.1...HEAD +[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.7.0...HEAD +[0.7.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.6.1...v0.7.0 [0.6.1]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.6.0...v0.6.1 [0.6.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.5.1...v0.6.0 [0.5.1]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.5.0...v0.5.1 diff --git a/Cargo.lock b/Cargo.lock index cf3aa96..e507a1c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -976,7 +976,7 @@ dependencies = [ [[package]] name = "hodeishield-api" -version = "0.6.1" +version = "0.7.0" dependencies = [ "mockito", "reqwest", @@ -990,7 +990,7 @@ dependencies = [ [[package]] name = "hodeishield-cli" -version = "0.6.1" +version = "0.7.0" dependencies = [ "apple-native-keyring-store", "assert_cmd", @@ -3076,7 +3076,7 @@ checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc" [[package]] name = "xtask" -version = "0.6.1" +version = "0.7.0" dependencies = [ "clap", "clap_mangen", diff --git a/Cargo.toml b/Cargo.toml index 53a9ea8..e807bac 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -5,7 +5,7 @@ default-members = ["crates/hodeishield-api", "crates/hodeishield-cli"] [workspace.package] authors = ["Hodeitek S.L. "] -version = "0.6.1" +version = "0.7.0" edition = "2024" rust-version = "1.98" license = "Apache-2.0" diff --git a/README.md b/README.md index 6333220..b33fdc2 100644 --- a/README.md +++ b/README.md @@ -61,7 +61,7 @@ Windows blocks the downloaded binary, see | Windows x86_64 | `hodeishield--x86_64-pc-windows-msvc.zip` | | Windows arm64 | `hodeishield--aarch64-pc-windows-msvc.zip` (from 0.4.0) | -`` has no leading `v`: release `v0.6.1` ships `hodeishield-0.6.1-…`. The Linux binaries are +`` has no leading `v`: release `v0.7.0` ships `hodeishield-0.7.0-…`. The Linux binaries are statically linked and run on any distribution. Homebrew and Scoop packages (next section) and a [container image](#container-image) are also available. @@ -76,7 +76,7 @@ neither is part of a distribution's default install. From source, with the Rust toolchain installed (pin the release tag you want): ```sh -cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.6.1 hodeishield-cli +cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.7.0 hodeishield-cli ``` ### Homebrew and Scoop @@ -343,7 +343,7 @@ exact version, or better its digest. The image carries no documentation: the 0.4.2, as `USER-INFORMATION.md` in its archives. ```sh -v=0.6.1 # the version you want +v=0.7.0 # the version you want docker pull ghcr.io/hodeitek/hodeishield-cli:$v docker run --rm -e HODEISHIELD_API_KEY ghcr.io/hodeitek/hodeishield-cli:$v vendors list ``` @@ -357,7 +357,7 @@ The image is signed by digest with cosign (keyless) and carries the release's Cy signed attestation. Verify both before you rely on the image: ```sh -v=0.6.1 +v=0.7.0 image=ghcr.io/hodeitek/hodeishield-cli:$v cosign verify $image \ --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/container-image.yml@refs/tags/v$v \ @@ -393,11 +393,11 @@ Each release has a `SHA256SUMS` file, a Sigstore bundle (`*.sigstore.json`) for `SHA256SUMS`, and SLSA provenance (`hodeishield.intoto.jsonl`). In short: ```sh -grep hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz SHA256SUMS | sha256sum -c - +grep hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz SHA256SUMS | sha256sum -c - -cosign verify-blob hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz \ - --bundle hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.6.1 \ +cosign verify-blob hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz \ + --bundle hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.7.0 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push ``` @@ -408,12 +408,12 @@ On Windows, PowerShell has no `sha256sum`: compare the hash of the zip or MSI wi fail with a missing-source error), and the same `verify-blob` command works with Windows paths: ```powershell -(Get-FileHash .\hodeishield-0.6.1-x86_64-pc-windows-msvc.zip -Algorithm SHA256).Hash.ToLower() -Select-String hodeishield-0.6.1-x86_64-pc-windows-msvc.zip SHA256SUMS # the two hashes must match +(Get-FileHash .\hodeishield-0.7.0-x86_64-pc-windows-msvc.zip -Algorithm SHA256).Hash.ToLower() +Select-String hodeishield-0.7.0-x86_64-pc-windows-msvc.zip SHA256SUMS # the two hashes must match # the same two lines with .msi for the MSI -cosign verify-blob .\hodeishield-0.6.1-x86_64-pc-windows-msvc.zip ` - --bundle .\hodeishield-0.6.1-x86_64-pc-windows-msvc.zip.sigstore.json ` - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.6.1 ` +cosign verify-blob .\hodeishield-0.7.0-x86_64-pc-windows-msvc.zip ` + --bundle .\hodeishield-0.7.0-x86_64-pc-windows-msvc.zip.sigstore.json ` + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.7.0 ` --certificate-oidc-issuer https://token.actions.githubusercontent.com ` --certificate-github-workflow-trigger push ``` @@ -450,7 +450,7 @@ on the binary, so the block still applies. A download with `curl` does not set i place: ```sh -curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.6.1/hodeishield-0.6.1-universal-apple-darwin.tar.gz +curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.7.0/hodeishield-0.7.0-universal-apple-darwin.tar.gz ``` **Windows.** SmartScreen can warn about a signed file that is still new to it, and versions before diff --git a/docs/release-signing.md b/docs/release-signing.md index aa91e62..ce75ff0 100644 --- a/docs/release-signing.md +++ b/docs/release-signing.md @@ -80,7 +80,7 @@ an RFC 3161 timestamp from `http://timestamp.acs.microsoft.com`. - **Switch.** The repository variable `WINDOWS_SIGNING_ENABLED` turns the signing on, and only for a run started by a pushed `v*` tag. -The signatures of every signed release so far (0.2.0 to 0.6.1) carry: +The signatures of every signed release so far (0.2.0 to 0.7.0) carry: | Field | Value | |---|---| diff --git a/docs/verifying-releases.md b/docs/verifying-releases.md index d2f991b..6bdbc03 100644 --- a/docs/verifying-releases.md +++ b/docs/verifying-releases.md @@ -30,14 +30,14 @@ From 0.4.2, every archive, `.deb`, `.rpm` and MSI also contains `USER-INFORMATIO too. The `.deb` and `.rpm` install it in `/usr/share/doc/hodeishield/`, the MSI next to `hodeishield.exe`. -The steps below use `v0.6.1` and `hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz` +The steps below use `v0.7.0` and `hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz` as examples — substitute the actual version and archive you downloaded. ## 1. Download the files From the release page, download: -- the archive you want (e.g. `hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz`) +- the archive you want (e.g. `hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz`) - `SHA256SUMS` - the matching `.sigstore.json` - `SHA256SUMS.sigstore.json` @@ -46,7 +46,7 @@ From the release page, download: ## 2. Check the checksum ```sh -grep hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz SHA256SUMS | sha256sum -c - +grep hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz SHA256SUMS | sha256sum -c - ``` Checking only the line of your archive works with GNU `sha256sum` and with the BusyBox one on @@ -65,7 +65,7 @@ in the format cosign v3 reads by default. Older cosign versions cannot read them ```sh cosign verify-blob \ --bundle SHA256SUMS.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.6.1 \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.7.0 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ SHA256SUMS @@ -75,11 +75,11 @@ Repeat for the archive itself, using its own `.sigstore.json`: ```sh cosign verify-blob \ - --bundle hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.6.1 \ + --bundle hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.7.0 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ - hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz + hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz ``` A successful verification confirms the file was signed by the @@ -92,11 +92,11 @@ The SBOM is verified the same way, with its own bundle: ```sh cosign verify-blob \ - --bundle hodeishield-0.6.1-x86_64-unknown-linux-musl.cdx.json.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.6.1 \ + --bundle hodeishield-0.7.0-x86_64-unknown-linux-musl.cdx.json.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.7.0 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ - hodeishield-0.6.1-x86_64-unknown-linux-musl.cdx.json + hodeishield-0.7.0-x86_64-unknown-linux-musl.cdx.json ``` ## 4. Verify SLSA build provenance @@ -105,10 +105,10 @@ Requires [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier). ```sh slsa-verifier verify-artifact \ - hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz \ + hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz \ --provenance-path hodeishield.intoto.jsonl \ --source-uri github.com/Hodeitek/hodeishield-cli \ - --source-tag v0.6.1 + --source-tag v0.7.0 ``` `hodeishield.intoto.jsonl` is attached to the release and covers every