v0.2.0

Added

• Signed Windows binary. hodeishield.exe is signed with Authenticode, so Windows accepts it
  without manual unblocking. macOS signing and notarization come in a later release. Sigstore
  signatures and SLSA provenance continue as before for every archive.
  (#50)
• Each release publishes a CycloneDX SBOM per archive (<archive>.cdx.json): the crates compiled
  into that binary, signed with Sigstore and listed in SHA256SUMS.
  (#34)
• A man page for every command (man hodeishield, man hodeishield-vendors-list, …), generated
  from the command-line definition and shipped in the Linux and macOS archives under man/.
  (#28)
• --csv on every list command and on compliance controls prints the items as CSV (RFC 4180,
  UTF-8, the same fields as --json), also with --all. Text cells that a spreadsheet would run
  as a formula are prefixed with '.
  (#19)

Changed (scripting surface)

• New exit code 8: the tenant's licence is not in force. A 403 that the API marks as
  LICENCE_INACTIVE used to exit with 4 (missing scope); it now exits with 8. Scripts that treat 4
  as "get a key with the right scope" no longer see this case, which only a tenant administrator can
  fix. (#47)

Changed

• Release notes start with the version's section of this changelog, and a release cannot be tagged
  without one. (#24)
• GET requests to the API are retried up to twice, with exponential backoff and jitter, on 502,
  503, 504 or a connection error or timeout, honouring Retry-After; other errors are not
  retried; --verbose logs each retry. (#49)

Fixed

• A tenant with no licence in force is reported as such, with the licence state, instead of as a
  missing scope. (#47)

Verify the download as described in Verifying releases.

What's Changed

• Name the copyright holder, add NOTICE and SPDX headers, require DCO sign-off by Gorka Gonzalo (@d0ubl3g) in #10
• Add security@hodeitek.com as a vulnerability contact by Gorka Gonzalo (@d0ubl3g) in #11
• Fill in the copyright line in the LICENSE appendix by Gorka Gonzalo (@d0ubl3g) in #12
• Point product links at the hodeishield.com landing page by Gorka Gonzalo (@d0ubl3g) in #13
• Report an inactive tenant licence instead of a missing scope by Gorka Gonzalo (@d0ubl3g) in #62
• Explain what to do when macOS or Windows blocks the binary by Gorka Gonzalo (@d0ubl3g) in #63
• Test that logout revokes only the chosen profile's tokens by Gorka Gonzalo (@d0ubl3g) in #64
• Retry GET requests on 502, 503, 504 and connection errors by Gorka Gonzalo (@d0ubl3g) in #65
• Add --csv to the list commands by Gorka Gonzalo (@d0ubl3g) in #66
• Sign macOS and Windows release binaries, behind a switch by Gorka Gonzalo (@d0ubl3g) in #67
• Update the Rust toolchain to 1.99.0 and replace a yanked crate by Gorka Gonzalo (@d0ubl3g) in #68
• Drop Renovate and review the pins Dependabot cannot read by hand by Gorka Gonzalo (@d0ubl3g) in #69
• Exempt eight web-merge commits from the sign-off check, by SHA by Gorka Gonzalo (@d0ubl3g) in #70
• Take the release notes from the changelog, and require an entry by Gorka Gonzalo (@d0ubl3g) in #71
• Publish a CycloneDX SBOM for each release archive by Gorka Gonzalo (@d0ubl3g) in #72
• Generate man pages from the command line and ship them in the archives by Gorka Gonzalo (@d0ubl3g) in #73
• Prepare 0.2.0 by Gorka Gonzalo (@d0ubl3g) in #74
• Release 0.2.0 by Gorka Gonzalo (@d0ubl3g) in #44

Full Changelog: v0.1.1...v0.2.0