Skip to content

v1.0.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Nov 06:05
· 344 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.0.0
This tag was signed with the committer’s verified signature.
Dunky13 Marc Went
GPG key ID: EA4208DC5ABEB135
Verified
Learn about vigilant mode.
2ac7bb3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Hikyo 1.0.0 is here: secrets and configuration you can reason about.

Our first stable release brings your development, staging and production values into one self-hosted control plane. Manage them through the embedded web UI, CLI or API, with explicit state for every environment.

Hikyo is fully open source under MPL-2.0 and ships as one Go binary, with SQLite or PostgreSQL for storage.

Included in 1.0

  • An environment matrix that makes state visible. Declare keys, validation and presence rules, then see which values are set or absent in each environment.
  • Controlled changes. Stage edits as drafts, validate and publish snapshots, and use rollback and durable pins to manage revisions.
  • Deliberate secret access. Normal reads return metadata and presence. Human reveal and copy flows require reauthentication and create dedicated audit events.
  • Access for people and workloads. Federated login, MFA, service accounts and scoped authorization support day-to-day use and automation.
  • Application delivery. Use hikyo run, Compose delivery or the Kubernetes operator to consume published configuration.
  • Self-hosted operation. An embedded UI, encrypted backup and restore, key rotation, and support for both SQLite and PostgreSQL.

Version 1.0.0 establishes the API and CLI compatibility baseline for future stable releases.

Get started

Follow the installation guide, set up your instance and create your first project. The self-hosting guide covers deployment and operation.

Downloads

  • Linux, macOS and Windows: CLI archives for AMD64 and ARM64.
  • Linux packages: DEB, RPM, APK and Arch packages for both architectures.
  • macOS installers: Developer ID signed, notarized DMGs for Apple Silicon and Intel.
  • Containers and Kubernetes: ghcr.io/hikyo-org/hikyo:1.0.0 and the digest-pinned Helm chart at oci://ghcr.io/hikyo-org/charts/hikyo.

Downloads include a signed manifest, checksums, standalone verifiers, SBOMs, a compatibility declaration and first-party build provenance. Follow the verification guide when installing.

Artifact identities and verification details

This release contains 80 uploaded files built from source:

2ac7bb36633d3ae0a99d7724968ca8c3cbf18334

Manifest SHA-256:

038fabba9529eb9880aa86002ecc2102d2c4f0c0fc75393da9c928f6accf6094

Container image:

ghcr.io/hikyo-org/hikyo@sha256:ef518761b1d64bfe914c660dc14a53c4a9ccd2c6eb7082efaa448a55810d0dc7

Helm chart:

ghcr.io/hikyo-org/charts/hikyo@sha256:514d368ba7c9f50c1c7c832ca4a152363ff8ac2984f320846c0ff60f67190f70

Both macOS DMGs received Apple's Accepted notarization result and have stapled tickets. Hosted signature, Gatekeeper and mounted-content checks passed for both architectures. The exact ARM64 download also passed local quarantined native installation, ticket, version and help checks.

Public artifact verification and signed trust synchronization are tracked in the release checklist.

Known limits and follow-up work

The following qualification and operational work remains open:

  • Separate clean-Mac, Intel native and Homebrew installation/upgrade acceptance.
  • Real fine-grained GitHub token contract acceptance: #1116. Disposable GitLab CE qualification was explicitly skipped for this release: #1119.
  • Public MCP client profiles, independent audit collection, live alert destinations and installation-specific operational acceptance: #651, #1037, #1038 and #1055. Their operational deployments and profiles are not claimed as verified by this release.
  • Private-reporting and external acknowledgment receipt reconciliation: #1117. The owner reports successful tests; outstanding original receipts are not presented as independently recovered.
  • Development build-tool minimatch advisories: #1118. Container-local operator command limitations: #1112.

These items retain their recorded acceptance limits and future targets. Source tests, provider checks and deployment acceptance are recorded separately in the release checklist. Issue #79 remains open through applicable public verification and acceptance closeout.

See SECURITY.md for supported versions and security reporting.

Assets 83
Loading