v0.2.1

The first signed release. Every artifact of this release carries a verifiable Sigstore signature: the container image is signed by digest, and SHA256SUMS ships with a keyless bundle (SHA256SUMS.sigstore.json). See the new Verifying releases section in the README for the two verification commands.

What's in 0.2.1

• Signed artifacts (cosign keyless via GitHub OIDC) — see above.
• Dependency updates: spf13/cobra 1.10.2 and the aws-sdk-go-v2 modules used by the S3 storage driver (config 1.32.30, credentials 1.19.29, s3 1.105.1). No behavior changes; the full mail path including byte-exact attachment download was re-verified live against MinIO.
• CI hardening: every GitHub Action bumped to its current major (checkout v7, build-push-action v7, gitleaks-action v3, golangci-lint-action v9, action-gh-release v3) — the only breaking change across all five is the Node 24 runtime, already provided by GitHub-hosted runners.

Full details in CHANGELOG.md.

Install or upgrade:

curl -fsSL https://attachra.org/install | sudo bash

Tested in production on a live grommunio (Postfix-based) deployment. Use at your own risk before v1.0.0 — config, policy and API formats are not frozen yet.

v0.2.0

Management, onboarding and packaging. Everything an operator does after the first install — inspecting what was processed, revoking a link, checking the system's health — now has a first-class surface.

Highlights

• REST API (/api/v1): messages, attachments, links (hold/unhold/revoke — per link, per message, or per sender), policy view/validate/reload, stats, and a streaming audit export. Bearer-token auth, deny-by-default, three roles (admin, viewer, auditor). The OpenAPI spec is the source of truth and is linted in CI.
• attachractl: a self-contained CLI client for the API above. The token never appears on a command line.
• Automatic retention: stored attachments are deleted after their retention period (30 days by default), with legal holds always respected.
• attachra setup: a guided first-run wizard that detects the mail stack it's running next to (plain Postfix, grommunio, Mailcow, iRedMail) and starts new installs in dry-run mode. attachra doctor checks an install end to end. Man pages and shell completions included.
• Packaging: official Debian packages (amd64/arm64) with a hardened systemd unit, a Docker image at ghcr.io/302-digital/attachra, and a one-line installer — curl -fsSL https://attachra.org/install | sudo bash.
• Pipeline hardening from a live production pilot: message bodies and inline (CID) images are no longer at risk from a broad default: replace policy — bodies are delivered intact and logo/signature-sized inline assets pass through unless a policy explicitly opts in (when.attachment.disposition: [inline]).
• http.trusted_proxies for correct client IPs behind a reverse proxy, a per-message INFO log line, and supply-chain hardening across CI (OpenSSF Scorecard, CodeQL, pinned actions and base images).

Breaking-ish notes (pre-1.0, formats may still change): inline image assets under a broad replace rule are no longer replaced by default; the built-in Russian recipient-notice template was removed (English only until a proper i18n story — custom templates remain supported).

Full details in CHANGELOG.md.

Install or upgrade:

curl -fsSL https://attachra.org/install | sudo bash

Tested in production on a live grommunio (Postfix-based) deployment. Use at your own risk before v1.0.0 — config, policy and API formats are not frozen yet.

---

A note on versioning. If you installed v0.1.0 from GitHub Releases, your package was built from a 2026-07-15 development snapshot and already carried early versions of much of the list above (the REST API, attachractl, retention, the setup wizard). v0.2.0 is the first release in which those features are properly versioned and documented.

v0.1.0 — first public release

The first public release of Attachra — a self-hosted attachment policy engine for corporate mail.

A Postfix milter that applies policies to outbound attachments, offloads them to S3-compatible or filesystem storage, and replaces them with personal, revocable download links — with a tamper-evident audit trail, a Bearer-auth REST API, an admin CLI, a first-run setup wizard (attachra setup) and an install diagnostics command (attachra doctor).

This release corresponds to the internally reviewed, production-piloted state of the v0.1 line — tested end to end on a live grommunio (Postfix-based) mail deployment: milter → MIME parsing → policy engine → storage → personal download links → MIME rewrite → audit trail.

Status: usable today, at your own risk. Config, policy-file and API formats are not frozen until v1.0.0 (SemVer) — see ROADMAP.md for the path there, and CHANGELOG.md for the full feature list.

Install

Build the Debian packages from source (amd64 + arm64):

make build-deb
sudo apt install ./dist/attachra_*_amd64.deb
sudo attachra setup

See the installation guide for a full walkthrough (Postfix wiring, reverse proxy, first admin token). Pre-built packages will be attached to releases starting with the next tagged version.

Highlights

• The mail is sacred: every failure resolves to a configured fail-open (deliver unmodified) or fail-closed (tempfail) — a message is never lost or half-rewritten.
• Inline assets stay intact: logos and signature images referenced from HTML are never turned into links (detected-type + size guarded, never silently).
• Tamper-evident audit: every decision, stored file and download is a hash-chained audit event with streaming JSONL export.
• Secrets stay hashed: link tokens are crypto/rand ≥128-bit, stored only as hashes; API tokens are one-time-shown.
• One static binary per role (attachra, attachractl), cross-compiled for amd64 and arm64, no runtime dependencies.

---

A note on versioning. These v0.1.0 packages were built from a 2026-07-15 development snapshot and already include early versions of several features documented under v0.2.0 (the REST API, attachractl, retention, the setup wizard). See the v0.2.0 release for their first properly versioned, documented release.