Skip to content

v0.1.0 — first public release

Choose a tag to compare

View all tags
@rjevsky rjevsky released this 15 Jul 08:23
v0.1.0
2e1064d

The first public release of Attachra — a self-hosted attachment policy engine for corporate mail.

A Postfix milter that applies policies to outbound attachments, offloads them to S3-compatible or filesystem storage, and replaces them with personal, revocable download links — with a tamper-evident audit trail, a Bearer-auth REST API, an admin CLI, a first-run setup wizard (attachra setup) and an install diagnostics command (attachra doctor).

This release corresponds to the internally reviewed, production-piloted state of the v0.1 line — tested end to end on a live grommunio (Postfix-based) mail deployment: milter → MIME parsing → policy engine → storage → personal download links → MIME rewrite → audit trail.

Status: usable today, at your own risk. Config, policy-file and API formats are not frozen until v1.0.0 (SemVer) — see ROADMAP.md for the path there, and CHANGELOG.md for the full feature list.

Install

Build the Debian packages from source (amd64 + arm64):

make build-deb
sudo apt install ./dist/attachra_*_amd64.deb
sudo attachra setup

See the installation guide for a full walkthrough (Postfix wiring, reverse proxy, first admin token). Pre-built packages will be attached to releases starting with the next tagged version.

Highlights

  • The mail is sacred: every failure resolves to a configured fail-open (deliver unmodified) or fail-closed (tempfail) — a message is never lost or half-rewritten.
  • Inline assets stay intact: logos and signature images referenced from HTML are never turned into links (detected-type + size guarded, never silently).
  • Tamper-evident audit: every decision, stored file and download is a hash-chained audit event with streaming JSONL export.
  • Secrets stay hashed: link tokens are crypto/rand ≥128-bit, stored only as hashes; API tokens are one-time-shown.
  • One static binary per role (attachra, attachractl), cross-compiled for amd64 and arm64, no runtime dependencies.

A note on versioning. These v0.1.0 packages were built from a 2026-07-15 development snapshot and already include early versions of several features documented under v0.2.0 (the REST API, attachractl, retention, the setup wizard). See the v0.2.0 release for their first properly versioned, documented release.

Assets 5
Loading