Nimstead Assure 0.3.0 (preview)

Preview release. Early access for trial installs: feature-complete for what it covers and proven on real machines, but not yet a beta or stable release. Expect changes before 1.0.

Agents and the server now keep themselves up to date from signed releases, approved fixes start within minutes, and machines that stop reporting are flagged. Everything was proven on real systems: a Docker Compose host (a forged release refused, a broken one rolled back with its database restored, a good one installed), a Windows 11 VM (the scheduled task updating the agent on its own), Linux machines on real systemd, and the full suite on PostgreSQL 17.

What's new

• The agent updates itself (agent 0.2.0). At each run it installs a newer release only if it's signed by the Nimstead release key built into the agent. That key lives in this repository's protected release workflow, never on your server, so a compromised server can't push code to your machines. Older versions are never installed. The new version has to run on the machine before it replaces the old one, and the old one is kept beside it as nimstead_agent.py.prev.
  • Pause updates for your organisation in Settings → Agent updates, or turn them off on one machine by enrolling with --no-auto-update.
  • The Assets page says what will happen to each agent: updating, failed and why, paused, off, or reinstall needed.
• Approved fixes start within 15 minutes. Machines that allow remediation check for approved jobs every 15 minutes, and send inventory only when a job ran. The agent now writes its own systemd timers and scheduled tasks, so changes like this reach machines without a reinstall.
• Not reporting: a machine silent for 14 hours is flagged on Assets and Home, and your alert targets hear about it once per outage.
• Uninstall: nimstead_agent.py uninstall --yes removes the agent, its schedule, key and state from a machine.
• Server updates:
  • Settings → This server shows the version you're running and the result of the last update.
  • deploy/update.sh installs a release only if it's signed and its tag points at the signed commit. It builds while the old version keeps serving, then backs up the database and starts the new version.
  • If the new version isn't healthy within 5 minutes, it restores the previous version and the database.
  • --install-timer runs it nightly (opt-in).
• /api/health reports whether the database is reachable and the schema is at this release's migration head. The Docker healthcheck uses it.

What changes for you

• Agents older than 0.2.0 can't update themselves. Rerun the install command from the app on each machine once. The enrolment is kept, and later releases then install themselves.
• Install scripts now let the agent create its schedule. It's the same 6-hourly timer or task, plus the 15-minute job check where remediation is allowed.
• Getting the next release: while releases are previews, 0.3.0's Settings → This server won't show them as available, because 0.3.0 only looks at GitHub's "Latest" release. Run deploy/update.sh --dry-run on the Docker host to see what's newer, and deploy/update.sh to install it. From the next release on, Settings follows your chosen release channel (preview, beta or stable).

Upgrade

From 0.2.0, on the Docker host, in your checkout:

git fetch --tags && git checkout v0.3.0 && docker compose up -d --build

Migrations run on start. Then rerun the install command on each machine once (see above). Future updates: deploy/update.sh (install guide).

Verify this release

release.json is signed by the Nimstead release key (primary a91fa653…, backup 2438f2cc…, both built into the agent). Check it with the agent from a copy you already trust:

gh release download v0.3.0 --repo Nimstead/assure --pattern 'release.json*'

python3 -I agent/nimstead_agent.py verify-release release.json release.json.sig

It prints the manifest: version 0.3.0, agent 0.2.0 with SHA-256 017bf2d4dcd89f75a5271c96fc0588ccbbc16f4ecfebc412f000278c3b29b6ba, and commit 18b87ee664983c935d756fb75c248d403af1624e, which is the tag. The agent file also carries a GitHub build attestation:

gh attestation verify nimstead_agent.py --repo Nimstead/assure

Files

• nimstead_agent.py: agent 0.2.0, also served by your server at /agent/nimstead_agent.py.
• release.json: the signed manifest your server relays to agents and deploy/update.sh checks (version, agent SHA-256, commit). It was signed before release channels existed, so it counts as a preview release.
• release.json.sig: its Ed25519 signature.

Known limits

• deploy/update.sh supports the documented Docker Compose + PostgreSQL install only.
• Install-script side effects are undone on rollback only with zypper + snapper (openSUSE/SLES). Other package managers restore package files and their database.
• The full list of what is and isn't proven is in STATUS.md. The design reasons are in DECISIONS.md (items 31–32).

Full list: CHANGELOG. This release becomes available under Apache 2.0 on 2028-10-28 (FSL-1.1-ALv2).