v0.4.2

Added

• Every release archive, .deb, .rpm and the MSI now include the user information
  (docs/user-information.md) as USER-INFORMATION.md: next to the binary in the archives, in
  /usr/share/doc/hodeishield/ from the .deb and .rpm, in %ProgramFiles%\HodeiShield CLI
  from the MSI, and in the documentation folder of the Homebrew formula. The release workflow fails
  if an archive or package lacks it. The container image carries the binary and licence files only;
  the README says where its user information is.
  (#133)
• docs/risk-assessment.md: the cybersecurity risk assessment. It lists what the CLI protects, the
  threats considered and the controls. It says how each security requirement of the Cyber Resilience
  Act is met or why it does not apply, and why the CLI does not update itself or keep an activity
  log. (#122,
  #123)

Changed

• docs/release-signing.md lists the credentials and identities that sign releases (Sigstore, SLSA
  provenance, the container image, and Authenticode through Azure Artifact Signing) and who may
  change them, and describes what the maintainers do if the Windows certificate profile or the
  release workflow is compromised. docs/verifying-releases.md now says how to recognise a release
  published after such a change and how to check the Authenticode certificate profile. SECURITY.md
  no longer says that no long-lived signing key exists at all, and points to the published
  security.txt (#126,
  #125).
• docs/release-signing.md also says who controls the Azure access used for Windows signing, with
  its known gaps, and describes a weekly check that compares the release runs, the published files,
  their entries in the Rekor transparency log and the container image signatures, and opens an issue
  when something does not match (#126,
  #152).

Fixed

• Counts on standard error now use the singular for one item: "1 vendor across 2 client tenants",
  "1 vendor." after --all, and "Skipping 1 inactive client tenant".
  (#135)
• An API error message that already ends with a full stop no longer gets a second one ("The API
  rejected the request: … ."). (#136)
• logout now removes a sign-in that the keychain returns in a form the CLI cannot read, and says
  that nothing was revoked at the app. Before, it failed with the same "unreadable" error whose hint
  told the user to run logout. (#154)

Verify the download as described in Verifying releases.

What's Changed

• Count one item in the singular, and end API messages with one full stop by Gorka Gonzalo (@d0ubl3g) in #147
• Ship the user information document with every release package by Gorka Gonzalo (@d0ubl3g) in #148
• Run security tests of the code, the dependencies and the workflows weekly by Gorka Gonzalo (@d0ubl3g) in #150
• Document the signing identities and what to do if one is compromised by Gorka Gonzalo (@d0ubl3g) in #151
• Fix the workflow lint findings and fail the lint job on new ones by Gorka Gonzalo (@d0ubl3g) in #153
• Add the cybersecurity risk assessment by Gorka Gonzalo (@d0ubl3g) in #155
• Record who controls the Azure signing access, and its known gaps by Gorka Gonzalo (@d0ubl3g) in #156
• Let logout remove a sign-in it cannot read by Gorka Gonzalo (@d0ubl3g) in #157
• Install the commit-message hook as a copy by Gorka Gonzalo (@d0ubl3g) in #160
• Check weekly that release runs, files, Rekor entries and images match by Gorka Gonzalo (@d0ubl3g) in #159
• Prepare 0.4.2: version and changelog by Gorka Gonzalo (@d0ubl3g) in #163
• Release 0.4.2 by Gorka Gonzalo (@d0ubl3g) in #164

Full Changelog: v0.4.1...v0.4.2