v1.4.5

Class: feature

Added

• Frontend TLS (client <-> pooler): set PGAGROAL_TLS=on with
  PGAGROAL_TLS_CERT_FILE / PGAGROAL_TLS_KEY_FILE (and PGAGROAL_TLS_CA_FILE
  for mutual TLS) to encrypt client connections. The entrypoint installs the key
  at mode 0600 as pgagroal requires and fails closed if the material is missing
  or the switch value is a typo. The Helm chart exposes this via tls.enabled +
  tls.existingSecret (keys tls.crt/tls.key, and ca.crt when
  tls.mutualTLS), and validates the values. Only verify-ca
  client-certificate checking is available — the pgagroal 2.1.0 pooler has no
  tls_cert_auth_mode key, so verify-full is rejected. No new port. Backend TLS
  (pooler -> PostgreSQL) remains out of scope — upstream marks it experimental and
  it disables pooling (#103, hardened #109).

Security

• Reject HBA source-address injection and invalid CIDRs: build_hba_lines accepts
  each PGAGROAL_HBA_SOURCE entry only if it is all, 0.0.0.0/0, or a valid IPv4
  CIDR with octets 0–255 and an octet-aligned mask (/8,16,24,32), dropping any
  other value with a %q-escaped warning; entries are split on commas only
  (preserving embedded newlines so all\ntrust # is rejected whole rather than
  truncated to all, #111) and never subject to * filename globbing. Previously a
  crafted value (e.g. all trust #) was
  inserted verbatim and could comment out the scram-sha-256 method, leaving a
  no-auth trust rule, and out-of-range octets (999.999.999.999/24) were passed
  to pgagroal. This enforces the hba-source-restriction spec's scram-sha-256-only
  invariant for every input (#105, hardened #109).

---

Supply chain

• Image (Docker Hub): docker.io/elevarq/pgagroal:1.4.5
• Image (GHCR): ghcr.io/elevarq/pgagroal:1.4.5
• Digest: sha256:36017745ebd98816c9adac5868965f32b06f72a4049b5fb107cd5bef629fbfcb
• Architectures: linux/amd64, linux/arm64
• Signed with cosign (keyless, GitHub OIDC)
• SBOM and SLSA provenance attached as OCI attestations

Verify signature and attestations:

IMAGE=docker.io/elevarq/pgagroal:1.4.5   # or ghcr.io/elevarq/pgagroal:1.4.5

cosign verify "$IMAGE" \
  --certificate-identity-regexp='https://github.com/Elevarq/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com'

cosign verify-attestation --type spdxjson      "$IMAGE"   # SBOM
cosign verify-attestation --type slsaprovenance "$IMAGE"   # provenance

Full verification guide:
https://github.com/Elevarq/pgAgroal/blob/main/docs/security/supply-chain-and-release-security.md