v0.3.0 — experimental durable configuration

AlgoSec provider 0.3.0 expands the experimental durable configuration surface to 12 resources and 12 data sources, implementing 53 selected method/route operations.

Adds AppViz SaaS roles, A33.30 ALGOSEC tags, A33.20 URL/IP membership, FireFlow direct role member/permission bindings, and ACE notification emails, Jira integration, threat entries and manual cloud account registration. Each experimental family requires its documented opt-in.

Includes stricter ownership/acknowledgement checks, planning-time payload validation, Unicode alias rejection and operation mapping regressions. Write-only arguments require Terraform 1.11+; the documented ephemeral saved-plan examples require 1.16.1+.

The release uses synthetic HTTPS lifecycle tests and bounded migration checks from the actual v0.2.0 package. No live appliance compatibility is claimed. Additional API families remain future work: this is not full AlgoSec administration coverage. Consult the contract documents before enabling mutations, especially whole-role ownership and replacement behavior.

v0.2.0 — experimental trusted-rule management

v0.2.0 — experimental trusted-rule management

Adds algosec_trusted_rule for a single A33.20 device/rule assignment, with comment, optional expiry, import, refresh/drift detection, deletion and replacement-only metadata changes. Enable it explicitly with experimental_trusted_rules = true; it is disabled by default and provider read-only mode remains the default.

• Surface: 3 resources, 12 data sources, 20 implemented method/route operations. This is a managed-resource milestone, not complete AlgoSec product coverage.
• Typed GET/POST/DELETE contracts, operation-specific acknowledgements, no write retries, conservative absence checks and recoverable owned state.
• Rejects known invalid replacement expiry during planning before deleting the prior assignment. Unknown expiry and plan-to-apply date rollover remain apply-time limitations.
• Existing A33.20 device groups remain separately gated by experimental_device_groups = true; the vendor marks group APIs Early Availability and does not recommend production use.
• No existing resource or data-source schema is removed; dependencies are unchanged.

Verification and limitations

Release gates exercise race-enabled unit/Framework/Terraform protocol tests against synthetic local HTTPS fixtures, generated documentation parity, coverage mapping, vulnerability checks, package installation and schema validation. These do not establish live appliance compatibility. No live AlgoSec appliance acceptance or appliance mutations were performed for this release. A32.60 remains the base contract; trusted rules and groups use qualified A33.20 contracts. Read the trusted-rule contract, API coverage and live-acceptance checklist before enabling mutations.

Eight OS/architecture ZIPs are built for Linux, Windows, macOS and FreeBSD, amd64 and arm64. Runtime installation smoke is Linux amd64 only. Checksums and protocol manifest are signed with the existing shared Terraform key BB831B4CD32200DD15EDF4E9AB71E7968334DF52.

The v0.1.3 and v0.1.4 releases remain immutable.

v0.1.4 — shared Terraform signing key

Shared Terraform signing key

This release uses the maintainer's existing Terraform Registry signing key: BB831B4CD32200DD15EDF4E9AB71E7968334DF52.

• No provider code, API, schema, or dependency changes from v0.1.3. Example version pins are updated.
• Two resources and twelve data sources. ASMS A32.60 base APIs; A33.20 device groups remain explicitly experimental and opt-in.
• Full local release gates passed; exact Linux amd64 archive passed init/validate/schema via a filesystem mirror on Terraform 1.11.0 and 1.16.1. Detached checksum signature verified independently.
• Private signing material stays in Vault; only the public key is attached.
• v0.1.3 and all its published assets remain unchanged.

Registry ingestion is a separate post-publication verification. No live AlgoSec appliance acceptance has been performed.

v0.1.3 — signed test release

Initial signed test release

AlgoSec Firewall Analyzer / ASMS provider built with Terraform Plugin Framework.

This is a narrow, documentation-based integration for controlled testing, not full ASMS administration or live-appliance certification. Terraform Registry registration is a separate step; use the packed filesystem mirror instructions until indexing is confirmed.

Coverage

• 2 resources: Panorama URL-category overrides and experimental device groups.
• 12 data sources for devices, groups, URL categories, zones, risk-profile discovery, network objects and trusted traffic.
• Audited both official public AFA REST catalogs: 85 A32.60 pages and 119 A33.20 pages. These are documentation-page counts, not endpoint counts.
• 17 implemented method/route operations including login; complete versioned inventory and exclusions in API coverage.

Safety corrections

Category creation now requires a documented positive acknowledgement with the exact intended name and URL/IP membership before taking ownership. Unconfirmed creates do not adopt a subsequently visible same-name object. Rename/delete acknowledgements and post-write reads fail closed. Positively acknowledged creates retain recoverable identity if readback fails.

The public documentation contains conflicting category examples; the selected contracts and concurrent-writer limitations are documented. Device groups require explicit opt-in to A33.20 Early Availability APIs that AlgoSec does not recommend for production.

Verification

Source commit: f4c4e9e7e8af1b57e8643a4dbad9694c8d3c0aac.

• Exact-commit GitHub CI: successful on Terraform 1.11.0 and 1.16.1, with vulnerability checks.
• Independent code review: no blocking findings; two nonblocking test/checker-strength suggestions remain.
• Local race/protocol tests, formatting, vet, generated docs, coverage consistency, module verification, actionlint and GoReleaser configuration passed.
• No runtime vulnerability found. Documentation tooling has one required-module advisory with no affected imported package or call path reported by govulncheck.
• Eight archives built for Linux, Windows, macOS and FreeBSD, each amd64/arm64. All archive and manifest SHA256 values verified; detached signature verified using a public-only keyring.
• Exact Linux amd64 release ZIP passed real Terraform init, validate and schema loading using an isolated filesystem mirror on 1.11.0 and 1.16.1. Other platforms were cross-built, not execution-tested here.
• No appliance credentials or live appliance calls were used. Live acceptance remains to be performed by the operator in an authorized environment.

Signing and install

Public signing-key fingerprint: 71B43325624199D6C4339C17EE5515CFD4999B22.

The private key/passphrase remain in Vault; only the public .asc key is attached. Check its fingerprint before importing it and verifying SHA256SUMS.sig, then verify your archive against SHA256SUMS. Do not replace assets for this version; fixes require a new version.

Start with the pinned read-only quickstart and installation/testing guide. Use environment-based credentials and TLS verification. Read-only planning still contacts your appliance and stores inventory in plan/state. Only test mutations with explicit opt-in on disposable objects.