v0.1.3 — signed test release

Initial signed test release

AlgoSec Firewall Analyzer / ASMS provider built with Terraform Plugin Framework.

This is a narrow, documentation-based integration for controlled testing, not full ASMS administration or live-appliance certification. Terraform Registry registration is a separate step; use the packed filesystem mirror instructions until indexing is confirmed.

Coverage

• 2 resources: Panorama URL-category overrides and experimental device groups.
• 12 data sources for devices, groups, URL categories, zones, risk-profile discovery, network objects and trusted traffic.
• Audited both official public AFA REST catalogs: 85 A32.60 pages and 119 A33.20 pages. These are documentation-page counts, not endpoint counts.
• 17 implemented method/route operations including login; complete versioned inventory and exclusions in API coverage.

Safety corrections

Category creation now requires a documented positive acknowledgement with the exact intended name and URL/IP membership before taking ownership. Unconfirmed creates do not adopt a subsequently visible same-name object. Rename/delete acknowledgements and post-write reads fail closed. Positively acknowledged creates retain recoverable identity if readback fails.

The public documentation contains conflicting category examples; the selected contracts and concurrent-writer limitations are documented. Device groups require explicit opt-in to A33.20 Early Availability APIs that AlgoSec does not recommend for production.

Verification

Source commit: f4c4e9e7e8af1b57e8643a4dbad9694c8d3c0aac.

• Exact-commit GitHub CI: successful on Terraform 1.11.0 and 1.16.1, with vulnerability checks.
• Independent code review: no blocking findings; two nonblocking test/checker-strength suggestions remain.
• Local race/protocol tests, formatting, vet, generated docs, coverage consistency, module verification, actionlint and GoReleaser configuration passed.
• No runtime vulnerability found. Documentation tooling has one required-module advisory with no affected imported package or call path reported by govulncheck.
• Eight archives built for Linux, Windows, macOS and FreeBSD, each amd64/arm64. All archive and manifest SHA256 values verified; detached signature verified using a public-only keyring.
• Exact Linux amd64 release ZIP passed real Terraform init, validate and schema loading using an isolated filesystem mirror on 1.11.0 and 1.16.1. Other platforms were cross-built, not execution-tested here.
• No appliance credentials or live appliance calls were used. Live acceptance remains to be performed by the operator in an authorized environment.

Signing and install

Public signing-key fingerprint: 71B43325624199D6C4339C17EE5515CFD4999B22.

The private key/passphrase remain in Vault; only the public .asc key is attached. Check its fingerprint before importing it and verifying SHA256SUMS.sig, then verify your archive against SHA256SUMS. Do not replace assets for this version; fixes require a new version.

Start with the pinned read-only quickstart and installation/testing guide. Use environment-based credentials and TLS verification. Read-only planning still contacts your appliance and stores inventory in plan/state. Only test mutations with explicit opt-in on disposable objects.