v0.0.3-rc.1

themis v0.0.3-rc.1

Automated Debian hardening CLI - check/plan/apply/rollback for VPS hardening.

What's Changed

[0.0.3-rc.1] - 2026-07-20

Bug Fixes

• Git-cliff can't resolve version tag on workflow_dispatch runs (d6f685f)

Maintenance

• Rotate release-signing public key (240476b)

Quick Installation

Using curl

curl -sSL https://raw.githubusercontent.com/Elysium-Labs-EU/themis/main/install.sh -o install.sh
sudo bash install.sh

Using wget

wget https://raw.githubusercontent.com/Elysium-Labs-EU/themis/main/install.sh
sudo bash install.sh

Manual Installation

Download the appropriate binary for your architecture:

• Linux AMD64: themis-linux-amd64
• Linux ARM64: themis-linux-arm64

Then:

chmod +x themis-linux-amd64  # or themis-linux-arm64
sudo cp themis-linux-amd64 /usr/local/bin/themis

Verify Download

Check the sha256sums.txt file and verify:

sha256sum -c sha256sums.txt

If this release includes sha256sums.txt.sig, verify it against the
release signing key embedded in install.sh/cmd/update.go:

openssl dgst -sha256 -verify release-signing-pubkey.pem -signature sha256sums.txt.sig sha256sums.txt

See the README for full documentation.

v0.0.2

themis v0.0.2

Automated Debian hardening CLI - check/plan/apply/rollback for VPS hardening.

What's Changed

[0.0.2] - 2026-07-19

Bug Fixes

• Resolve external commands from trusted dirs, not $PATH (d80b568)
• Verify state.json integrity on load (1ebe2c9)

CI/CD

• Make go-crap gate change-scoped to PR churn (cc979fb)
• Run Go jobs in container with named-volume caches (49a1e48)
• Drop dead permissions field from Forgejo workflows (fece221)
• Add Integration Test job (4151729)
• Keep Integration Test job green on the shared runner (0c14356)
• Tune OSV scan (deps-only PRs + weekly cron, prebuilt scanner) (e01002e)

Features

• Verify update signatures with soft-fail fallback (1b12ab2)

Maintenance

• Remove dead GitHub-Actions-only permissions block from workflows (1fb70b4)
• Add go-crap as a hard-blocking CI/local gate (64fc517)
• Run go-crap gate on pre-push, not pre-commit (876393c)
• Exclude cobra command builders from the gate (d39dd08)

Miscellaneous

• Add integration + smoke-update make targets (a947f3d)

• Stage release download in a private mktemp dir (1db51a8)

• Migrate from Codeberg to GitHub

• Rename Go module path codeberg.org/Elysium_Labs/themis -> github.com/Elysium-Labs-EU/themis (all imports, go.mod, Makefile)

• Replace .forgejo Woodpecker/Gitea workflows with GitHub Actions (ci, golangci-lint, osv-scan, release); ubuntu-latest runners

• Rewrite release.yml to publish via softprops/action-gh-release with GITHUB_TOKEN; keep the ECDSA sha256sums.txt signing step

• Repoint install.sh + cmd/update.go at github.com / api.github.com; add required User-Agent header for the GitHub API; tolerate spaced JSON; keep embedded release-signing public key

• Retarget update tests to the github.com download host

• Update README badge/links, cliff.toml, CHANGELOG commit links; add logo (38ae8bf)

Refactoring

• Extract fail2ban/autoupdates/firewall Check-Apply-Revert helpers (734a2a9)
• Split runUpdate and downloadFile into helpers (00429d8)
• Extract report-printing and lynis-run helpers (6e34d39)

Testing

• Add real lynis audit integration test (c7d5131)
• Add apply/revert integration tests for host-mutating fixes (a542be3)
• Add hermetic end-to-end self-update integration test (9aadbe7)
• Gate host-mutating fix tests behind THEMIS_INTEGRATION_MUTATE (6696944)

Quick Installation

Using curl

curl -sSL https://raw.githubusercontent.com/Elysium-Labs-EU/themis/main/install.sh -o install.sh
sudo bash install.sh

Using wget

wget https://raw.githubusercontent.com/Elysium-Labs-EU/themis/main/install.sh
sudo bash install.sh

Manual Installation

Download the appropriate binary for your architecture:

• Linux AMD64: themis-linux-amd64
• Linux ARM64: themis-linux-arm64

Then:

chmod +x themis-linux-amd64  # or themis-linux-arm64
sudo cp themis-linux-amd64 /usr/local/bin/themis

Verify Download

Check the sha256sums.txt file and verify:

sha256sum -c sha256sums.txt

If this release includes sha256sums.txt.sig, verify it against the
release signing key embedded in install.sh/cmd/update.go:

openssl dgst -sha256 -verify release-signing-pubkey.pem -signature sha256sums.txt.sig sha256sums.txt

See the README for full documentation.