Vectory v0.2.0

Vectory 0.2.0 is a self-hosted control plane for Vector.

Install

Use the guided quickstart. Download vectory-0.2.0-server-linux-amd64.tar.gz, extract it, and run ./start.sh on a Linux x86-64 Docker host. The kit verifies release signatures, pulls immutable images from GHCR, and guides first administrator setup. No source compilation is needed.

The local evaluation kit is separate. Managed devices need an existing supported Vector installation; Add device provides the platform download and setup command.

Verify

SHA256SUMS.sigstore.json authenticates SHA256SUMS using GitHub OIDC and Sigstore. IMAGE-DIGESTS.env contains the immutable server and validator references. Both images carry Cosign signatures. Verify the certificate identity https://github.com/416rehman/Vectory/.github/workflows/release.yml@refs/tags/v0.2.0 and issuer https://token.actions.githubusercontent.com. The starter does this through a pinned Cosign container, with no host Cosign installation.

Built-in agent-update catalog signatures use a separate operator key and are not enabled by this release signature. Windows Authenticode and Apple Developer ID/notarization are not present; operating systems may show trust prompts even though the download has a verified Sigstore signature.

Validation and operational limits

Publication requires all application, native service, package, isolated validator, starter TLS/bootstrap/restart, provenance and signature gates on this tag. File download or writing configuration is not verified device activation.

Container scans reject every critical record and every high record with an available fix. Unfixed findings remain disclosed in the three *-image-vulnerabilities.json files and summarized in RELEASE.json. Counts are package records, not proof of exploitability or safety. Use least privilege, backups, restricted dashboard access and your deployment review process.

This release supports a Linux x86-64 Docker Compose manager, Linux amd64/arm64 agents, macOS Intel/Apple Silicon agent downloads and Windows amd64 agents. Consult the tested compatibility matrix before production rollout. Native tests cannot cover every OS or workload.

Source: c9aeb26d074d517278f92f29f5fc190ff5bfc20d. CI receipt. Vectory is independent of Datadog and the Vector project.

Publication: CI completion receipt. All tagged qualification, signing and offline-verification gates passed. This job completes publication of that exact signed inventory after correcting the final notes step environment.