Prepare 0.7.0: version and changelog

CHANGELOG.md

@@ -6,18 +6,23 @@ commands, `--json` output and exit codes. Each release's notes start with its se
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-11-01
+
 ### Changed
 
 - The page the browser shows at the end of `hodeishield login` is now a styled page with the product mark,
   for success, denied access, a failed or mismatched response and unknown paths. It follows the system
   light or dark preference, needs no script, font or outside request, and uses the language of the
   browser when it is supported.
+- `SECURITY.md` now counts the fix target for medium-severity vulnerabilities from the report, like the
+  coordinated disclosure period, so it never runs past it: within 90 days of the report, extendable by
+  mutual agreement. Critical and high are still counted from the first assessment.
 
 ### Fixed
 
-- `whoami` exits 3, like every other command, when the API does not accept the credential, after
-  printing the local details and the warning. An API that cannot be reached or fails on its side still
-  gives exit 0.
+- **Behaviour change for scripts:** `whoami` now exits 3, like every other command, when the API
+  does not accept the credential, after printing the local details and the warning. It used to exit
+  0. An API that cannot be reached or fails on its side still gives exit 0.
 - The README now describes the two macOS steps to allow a blocked browser download: **Allow Anyway** in
   System Settings → Privacy & Security, then **Open Anyway** in the dialog shown on the next run
   (measured on macOS 27.0.1 with 0.6.1).
@@ -506,7 +511,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se
 - Profiles (`config`), shell completions, and release archives for Linux, macOS and Windows signed
   with Sigstore and with SLSA provenance.
 
-[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.6.1...HEAD
+[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.7.0...HEAD
+[0.7.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.6.1...v0.7.0
 [0.6.1]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.6.0...v0.6.1
 [0.6.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.5.1...v0.6.0
 [0.5.1]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.5.0...v0.5.1

Cargo.toml

@@ -5,7 +5,7 @@ default-members = ["crates/hodeishield-api", "crates/hodeishield-cli"]
 
 [workspace.package]
 authors = ["Hodeitek S.L. <info@hodeitek.com>"]
-version = "0.6.1"
+version = "0.7.0"
 edition = "2024"
 rust-version = "1.98"
 license = "Apache-2.0"

README.md

@@ -61,7 +61,7 @@ Windows blocks the downloaded binary, see
 | Windows x86_64 | `hodeishield-<version>-x86_64-pc-windows-msvc.zip` |
 | Windows arm64 | `hodeishield-<version>-aarch64-pc-windows-msvc.zip` (from 0.4.0) |
 
-`<version>` has no leading `v`: release `v0.6.1` ships `hodeishield-0.6.1-…`. The Linux binaries are
+`<version>` has no leading `v`: release `v0.7.0` ships `hodeishield-0.7.0-…`. The Linux binaries are
 statically linked and run on any distribution. Homebrew and Scoop packages (next section) and a
 [container image](#container-image) are also available.
 
@@ -76,7 +76,7 @@ neither is part of a distribution's default install.
 From source, with the Rust toolchain installed (pin the release tag you want):
 
 ```sh
-cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.6.1 hodeishield-cli
+cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.7.0 hodeishield-cli
 ```
 
 ### Homebrew and Scoop
@@ -343,7 +343,7 @@ exact version, or better its digest. The image carries no documentation: the
 0.4.2, as `USER-INFORMATION.md` in its archives.
 
 ```sh
-v=0.6.1   # the version you want
+v=0.7.0   # the version you want
 docker pull ghcr.io/hodeitek/hodeishield-cli:$v
 docker run --rm -e HODEISHIELD_API_KEY ghcr.io/hodeitek/hodeishield-cli:$v vendors list
 ```
@@ -357,7 +357,7 @@ The image is signed by digest with cosign (keyless) and carries the release's Cy
 signed attestation. Verify both before you rely on the image:
 
 ```sh
-v=0.6.1
+v=0.7.0
 image=ghcr.io/hodeitek/hodeishield-cli:$v
 cosign verify $image \
   --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/container-image.yml@refs/tags/v$v \
@@ -393,11 +393,11 @@ Each release has a `SHA256SUMS` file, a Sigstore bundle (`*.sigstore.json`) for
 `SHA256SUMS`, and SLSA provenance (`hodeishield.intoto.jsonl`). In short:
 
 ```sh
-grep hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz SHA256SUMS | sha256sum -c -
+grep hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz SHA256SUMS | sha256sum -c -
 
-cosign verify-blob hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz \
-  --bundle hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
-  --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.6.1 \
+cosign verify-blob hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz \
+  --bundle hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
+  --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.7.0 \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
   --certificate-github-workflow-trigger push
 ```
@@ -408,12 +408,12 @@ On Windows, PowerShell has no `sha256sum`: compare the hash of the zip or MSI wi
 fail with a missing-source error), and the same `verify-blob` command works with Windows paths:
 
 ```powershell
-(Get-FileHash .\hodeishield-0.6.1-x86_64-pc-windows-msvc.zip -Algorithm SHA256).Hash.ToLower()
-Select-String hodeishield-0.6.1-x86_64-pc-windows-msvc.zip SHA256SUMS      # the two hashes must match
+(Get-FileHash .\hodeishield-0.7.0-x86_64-pc-windows-msvc.zip -Algorithm SHA256).Hash.ToLower()
+Select-String hodeishield-0.7.0-x86_64-pc-windows-msvc.zip SHA256SUMS      # the two hashes must match
 # the same two lines with .msi for the MSI
-cosign verify-blob .\hodeishield-0.6.1-x86_64-pc-windows-msvc.zip `
-  --bundle .\hodeishield-0.6.1-x86_64-pc-windows-msvc.zip.sigstore.json `
-  --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.6.1 `
+cosign verify-blob .\hodeishield-0.7.0-x86_64-pc-windows-msvc.zip `
+  --bundle .\hodeishield-0.7.0-x86_64-pc-windows-msvc.zip.sigstore.json `
+  --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.7.0 `
   --certificate-oidc-issuer https://token.actions.githubusercontent.com `
   --certificate-github-workflow-trigger push
 ```
@@ -450,7 +450,7 @@ on the binary, so the block still applies. A download with `curl` does not set i
 place:
 
 ```sh
-curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.6.1/hodeishield-0.6.1-universal-apple-darwin.tar.gz
+curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.7.0/hodeishield-0.7.0-universal-apple-darwin.tar.gz
 ```
 
 **Windows.** SmartScreen can warn about a signed file that is still new to it, and versions before

docs/release-signing.md

@@ -80,7 +80,7 @@ an RFC 3161 timestamp from `http://timestamp.acs.microsoft.com`.
 - **Switch.** The repository variable `WINDOWS_SIGNING_ENABLED` turns the signing on, and only for a
   run started by a pushed `v*` tag.
 
-The signatures of every signed release so far (0.2.0 to 0.6.1) carry:
+The signatures of every signed release so far (0.2.0 to 0.7.0) carry:
 
 | Field | Value |
 |---|---|

docs/verifying-releases.md

@@ -30,14 +30,14 @@ From 0.4.2, every archive, `.deb`, `.rpm` and MSI also contains `USER-INFORMATIO
 too. The `.deb` and `.rpm` install it in `/usr/share/doc/hodeishield/`, the MSI next to
 `hodeishield.exe`.
 
-The steps below use `v0.6.1` and `hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz`
+The steps below use `v0.7.0` and `hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz`
 as examples — substitute the actual version and archive you downloaded.
 
 ## 1. Download the files
 
 From the release page, download:
 
-- the archive you want (e.g. `hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz`)
+- the archive you want (e.g. `hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz`)
 - `SHA256SUMS`
 - the matching `<archive>.sigstore.json`
 - `SHA256SUMS.sigstore.json`
@@ -46,7 +46,7 @@ From the release page, download:
 ## 2. Check the checksum
 
 ```sh
-grep hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz SHA256SUMS | sha256sum -c -
+grep hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz SHA256SUMS | sha256sum -c -
 ```
 
 Checking only the line of your archive works with GNU `sha256sum` and with the BusyBox one on
@@ -65,7 +65,7 @@ in the format cosign v3 reads by default. Older cosign versions cannot read them
 ```sh
 cosign verify-blob \
   --bundle SHA256SUMS.sigstore.json \
-  --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.6.1 \
+  --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.7.0 \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
   --certificate-github-workflow-trigger push \
   SHA256SUMS
@@ -75,11 +75,11 @@ Repeat for the archive itself, using its own `.sigstore.json`:
 
 ```sh
 cosign verify-blob \
-  --bundle hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
-  --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.6.1 \
+  --bundle hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \
+  --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.7.0 \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
   --certificate-github-workflow-trigger push \
-  hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz
+  hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz
 ```
 
 A successful verification confirms the file was signed by the
@@ -92,11 +92,11 @@ The SBOM is verified the same way, with its own bundle:
 
 ```sh
 cosign verify-blob \
-  --bundle hodeishield-0.6.1-x86_64-unknown-linux-musl.cdx.json.sigstore.json \
-  --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.6.1 \
+  --bundle hodeishield-0.7.0-x86_64-unknown-linux-musl.cdx.json.sigstore.json \
+  --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.7.0 \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
   --certificate-github-workflow-trigger push \
-  hodeishield-0.6.1-x86_64-unknown-linux-musl.cdx.json
+  hodeishield-0.7.0-x86_64-unknown-linux-musl.cdx.json
 ```
 
 ## 4. Verify SLSA build provenance
@@ -105,10 +105,10 @@ Requires [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier).
 
 ```sh
 slsa-verifier verify-artifact \
-  hodeishield-0.6.1-x86_64-unknown-linux-musl.tar.gz \
+  hodeishield-0.7.0-x86_64-unknown-linux-musl.tar.gz \
   --provenance-path hodeishield.intoto.jsonl \
   --source-uri github.com/Hodeitek/hodeishield-cli \
-  --source-tag v0.6.1
+  --source-tag v0.7.0
 ```
 
 `hodeishield.intoto.jsonl` is attached to the release and covers every