Skip to content

Veil 0.9.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Oct 14:19
· 180 commits to main since this release
v0.9.2
9449ac6

veil v0.9.2

veil 0.9.2 fixes the Windows binaries: they no longer need the Visual C++ runtime. veil itself has the same code
as 0.9.1; the other changes are in how releases are packaged and distributed.

Install
Debian, Ubuntu signed apt repository, apt install veil (the service starts)
RHEL-compatible, Fedora, Amazon Linux signed dnf repository, dnf install veil, systemctl enable --now veil
Homebrew (macOS, Linux) brew install aofusa/tap/veil, brew services start veil
Windows MSI and zip (x64 and arm64) on this page; winget install Aofusa.Veil once the package is accepted
FreeBSD, OpenBSD, NetBSD ports for each tree (veil-0.9.2-bsd-ports.tar.gz, packaging/bsd/ports)
Rust cargo binstall veil-proxy (prebuilt, minisign-verified) or cargo install veil-proxy --locked --features full
Container ghcr.io/aofusa/veil and docker.io/aofusa/veil (same digests and signatures)
Kubernetes helm install veil oci://ghcr.io/aofusa/charts/veil --version 0.9.2

Where each one puts the configuration and how veil finds it:
docs/guide/running.md#configuration-file.

Fixes

  • The Windows veil.exe did not start without the Visual C++ runtime (B-167). The 0.9.0 and 0.9.1 Windows
    binaries (zip and MSI, x64 and arm64) were linked against VCRUNTIME140.dll and the Universal CRT DLLs, so on a
    Windows without the Visual C++ Redistributable they failed with "VCRUNTIME140.dll was not found"
    (exit code 0xC0000135). The C runtime is now linked statically. Each release now checks that veil.exe
    imports no C runtime DLL and runs veil.exe --version in a Nano Server container, which has no Visual C++
    runtime.
  • OpenBSD port. The _veil user and group now use id 906, the next free id in OpenBSD's user.list.

Packaging and distribution

  • Homebrew. The formula no longer repeats the version given by the URL (brew audit --strict rejected it), and
    the release test now runs brew audit --strict before publishing.
  • After publishing (release-downstream). The minisign key secret may contain only the key line, the Docker Hub
    mirror copies the cosign signatures (OCI referrers) with the images, and re-running the workflow uses the
    scripts of the workflow's commit, so a failed step can be re-run after a fix. Updating the Homebrew tap no longer
    fails when only the tap's CI is missing.

Upgrade notes

  • No configuration or behavior changes from 0.9.1.
  • Windows: if you installed the Visual C++ Redistributable only for veil, it is no longer needed.

Known limitations

  • Prebuilt BSD binaries are x86_64 only (aarch64 BSD: build from the ports or from source).
  • macOS binaries are not signed with a Developer ID or notarized. Homebrew and cargo binstall installs are not
    affected by Gatekeeper; an archive downloaded with a browser may need xattr -d com.apple.quarantine veil.
  • winget: the package Aofusa.Veil is under review in winget-pkgs; later versions are proposed automatically.

Default configuration by install method

Install method Configuration and page Notes
Container in the image (/etc/veil/conf.d/config.toml) docker run --rm -p 8080:8080 ghcr.io/aofusa/veil:musl-v0.9.2
deb (Debian, Ubuntu) /etc/veil/config.toml, /usr/share/veil/www/ the service starts on install
rpm (RHEL-compatible, Fedora, Amazon Linux) /etc/veil/config.toml, /usr/share/veil/www/ sudo systemctl enable --now veil
Homebrew $(brew --prefix)/etc/veil/config.toml brew services start veil
winget / MSI %ProgramData%\veil\config.toml
BSD ports FreeBSD /usr/local/etc/veil/, OpenBSD /etc/veil/, NetBSD /usr/pkg/etc/veil/
cargo binstall, cargo install not installed: provide your own configuration and page
Archives (.tar.gz, .zip below) not installed: ./veil -c examples/config.toml examples/ is not read automatically

With a package's default configuration, veil serves a page on http://127.0.0.1:8080/. How veil finds its
configuration file (-c, then VEIL_CONFIG, then the default path):
running.md.

Assets

File Size
veil-0.9.2-1.aarch64.rpm 8.8 MB
veil-0.9.2-1.x86_64.rpm 9.9 MB
veil-0.9.2-aarch64-pc-windows-msvc.msi 7.3 MB
veil-0.9.2-aarch64-pc-windows-msvc.zip 8.8 MB
veil-0.9.2-aarch64-unknown-linux-gnu.tar.gz 8.8 MB
veil-0.9.2-aarch64-unknown-linux-musl.tar.gz 8.9 MB
veil-0.9.2-bsd-ports.tar.gz 0.0 MB
veil-0.9.2-universal2-apple-darwin.tar.gz 18.3 MB
veil-0.9.2-x86_64-pc-windows-msvc.msi 8.2 MB
veil-0.9.2-x86_64-pc-windows-msvc.zip 9.9 MB
veil-0.9.2-x86_64-unknown-freebsd.tar.gz 9.9 MB
veil-0.9.2-x86_64-unknown-linux-gnu.tar.gz 10.0 MB
veil-0.9.2-x86_64-unknown-linux-musl.tar.gz 10.0 MB
veil-0.9.2-x86_64-unknown-netbsd.tar.gz 9.4 MB
veil-0.9.2-x86_64-unknown-openbsd.tar.gz 9.5 MB
veil_0.9.2_amd64.deb 7.0 MB
veil_0.9.2_arm64.deb 5.8 MB

SHA256SUMS:

dfa6861cb6ac865d743d568cff3fc2f26748272363a103b3a5b2e5f9b131eab5  veil-0.9.2-1.aarch64.rpm
b3912a72db38ba9e059f4f6004985befb6e5d2a32db0a2a38a603aca1359f76f  veil-0.9.2-1.x86_64.rpm
1ceda8a3ad826648848da0d65545f153a7bfe2819909f920a172c4887e031603  veil-0.9.2-aarch64-pc-windows-msvc.msi
edfd8da936920f5bf73e42625e1230b34bda8e7e68f88ef529ab2d8c56180054  veil-0.9.2-aarch64-pc-windows-msvc.zip
43cd0c04ba24ca13afffcccb77a99d42a826ef9295972a8bf1e54299bf794ff3  veil-0.9.2-aarch64-unknown-linux-gnu.tar.gz
6a7b70e18544363abe95c31d623cca54a4d64f693ae4c8b142d1094bedae4f59  veil-0.9.2-aarch64-unknown-linux-musl.tar.gz
23fdd3e433c68c5488c61d8468502edf8ff73333b37b15999ece9774807db8f9  veil-0.9.2-bsd-ports.tar.gz
dfcf857179313085859f8ca58a6ad36218a80aa245a1199c20d5e296a78c07d6  veil-0.9.2-universal2-apple-darwin.tar.gz
cf46a2529f22072037f00add6ff34cebdf7a620202124271a69f12e08ac3b493  veil-0.9.2-x86_64-pc-windows-msvc.msi
785dae2f28a4ef9d27a4d2dcc566dcdc2c56bb9bb4a177366fd96877c5aaaf1a  veil-0.9.2-x86_64-pc-windows-msvc.zip
ffdf3065c8952daef9207be24d76248d3c879c63e6205d768ebad2519d4fe283  veil-0.9.2-x86_64-unknown-freebsd.tar.gz
2eb30813733f82a1eb836f763fa21d98df3b7850e1d7fb8e6d4698e0e111336d  veil-0.9.2-x86_64-unknown-linux-gnu.tar.gz
715a76d702a4ddb305ea96f3b855aeae1c3e3d1aa6be532beb7ddc8cc8769456  veil-0.9.2-x86_64-unknown-linux-musl.tar.gz
3b7f3f3d8d53f06d8b9d316a74be2015b9c225d0045bed35f463f9ba0415ff0b  veil-0.9.2-x86_64-unknown-netbsd.tar.gz
c532febd2c32599e55b3f6668f0cfd9b4870cf53090b2a0c0666894d5b747e4c  veil-0.9.2-x86_64-unknown-openbsd.tar.gz
735e8b43c86fe03edf0440a6979537419802ddd1d1460c19cb55eee5c49315f2  veil_0.9.2_amd64.deb
72b5d86c2dfa334f62c81a0194f4c70bdf8cff6de64893e7df58b05a4e2dfd66  veil_0.9.2_arm64.deb

Verifying

# The checksums' signature (Sigstore keyless, signed by this repository's release workflow)
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/aofusa/veil-proxy/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c SHA256SUMS --ignore-missing
# Where an asset was built (GitHub build-provenance attestation)
gh attestation verify veil-0.9.2-x86_64-unknown-linux-gnu.tar.gz --repo aofusa/veil-proxy
# The container image's signature
cosign verify ghcr.io/aofusa/veil:musl-v0.9.2 \
  --certificate-identity-regexp '^https://github.com/aofusa/veil-proxy/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

When the release is published, the archives also get minisign signatures (<archive>.sig), which cargo binstall checks.

Container images

ghcr.io/aofusa/veil:musl-v0.9.2  sha256:8d9b8dfc0325d1cc3ce5ec6bc0f9b6f6dc5df20b2b52649c7a9b49359c037122
ghcr.io/aofusa/veil:glibc-v0.9.2  sha256:24c8642690eed346e3b4fb2e314caec1bf2ca1414ec10d88ff449a834cad44d7
Assets 34
Loading