v0.4.0

Added

• Releases are cut automatically. A merge to main whose newest
  CHANGELOG.md heading names a version with no published release tags
  that commit (or builds an existing hand-made tag's commit), builds
  the darwin arm64 and amd64 archives, attests them with build provenance
  and publishes the release with the changelog section as its notes. CI fails if the newest changelog version is behind the latest tag,
  has a malformed date or no link reference.
• SECURITY.md, CONTRIBUTING.md, a pull request template and Dependabot
  version updates for Go modules and GitHub Actions.
• CODE_OF_CONDUCT.md (Contributor Covenant 2.1), issue forms for bugs and
  feature requests that send security reports to the private advisory form,
  and an OpenSSF Scorecard workflow. Conduct reports go privately to
  conduct@bawdo.com.
• Each release carries its build provenance attestation as a Sigstore
  bundle, jellyfish_<version>_provenance.sigstore.json, so an archive can
  be verified with gh attestation verify --bundle without the attestation
  API, and OpenSSF Scorecard sees the release as signed.
• Go native fuzz tests for code that handles untrusted input (terminal
  sanitising, API base URL and cache path derivation, pagination cursors,
  API error bodies, Retry-After, device JSON and email linkifying),
  run by make fuzz and briefly by make pre-ci. CI fuzzes briefly on
  every pull request and manual run, and for longer in a weekly run that
  checks only fuzzing and govulncheck. Fuzzing does not run on pushes to
  main, so it never holds up a release; the seed inputs still run with
  the normal tests.

Changed

• The Iru API token is now kept per tenant, under Keychain account
  iru:<subdomain>-<region> instead of one shared default account.
  Running jellyfish configure with a second config file used to replace
  the first tenant's token, so the first config then sent the second
  tenant's token. A tenant with no token of its own still uses the old
  default item, so existing setups keep working. configure stores a new
  token, or a kept token after a tenant change, under the tenant's account
  and leaves default alone.

Fixed

• users send-email and overview --send-email read both the
  confirmation answer and --message-file - from stdin, so a piped message
  was swallowed by the prompt (an empty message error) or taken as the
  answer (no mail sent). --message-file - now needs --yes or
  --dry-run with these commands, and is refused before any API work.
• A Gmail send that Google refused at the sign-in step (domain-wide
  delegation not granted, a deleted or revoked service-account key, or a
  From address Google doesn't recognise) exited 1 for a single send and 4
  for a bulk send. It now exits 2, like any other auth failure; a rate
  limit or server error from that step exits 4. If Google's sign-in
  endpoint can't be reached at all, the send still exits 1.
• An email Subject with non-ASCII text, such as a user's name with an
  accent, was written as raw 8-bit bytes, which RFC 5322 does not allow and
  some mail clients garble. It is now RFC 2047 encoded. ASCII subjects are
  unchanged.
• A Retry-After header with more digits than fit in a 64-bit integer was
  treated as unreadable, so the client retried after its short backoff
  instead of giving up as it does for any other wait over 10 seconds. It now
  gives up and reports the rate limit (exit code 4).

Security

• The release workflow is split so only its final publish job can write to
  the repository, and that job has no checkout and runs no project code.
  The binaries are built with a read-only token and without the Go build
  cache, so neither is in reach of the code that ships.
• Workflow checkouts no longer leave the job token in .git/config, and
  every job has a timeout.
• Dependabot waits seven days before proposing a new dependency version.
  Security updates are not delayed.
• Every gh attestation verify command in the docs and release notes now
  pins the signer to release.yml run from refs/heads/main on a
  GitHub-hosted runner, not just any workflow in the repository on any ref.
• The release workflow refuses to build a hand-made version tag that points
  at a commit not on main. Before, any pushed vX.Y.Z tag was built and
  released once the changelog reached that version, with an attestation
  saying it came from main, even if the commit had never been through
  review or CI.
• golang.org/x/net is updated to v0.62.0 to pick up the fixes for
  GO-2026-6866 and GO-2026-6860. It is an indirect dependency of the Gmail
  client.
• osv-scanner.toml now ignores GO-2026-5932, which flags every
  golang.org/x/crypto version because its openpgp package is
  unmaintained. jellyfish never imports openpgp and no fixed version
  exists; x/crypto stays because the Gmail client needs other packages
  from it (cryptobyte, chacha20poly1305 and hkdf). The ignore
  expires on 2027-10-29 so it gets looked at again.
• A user report no longer trusts Iru's filters to pick out the right
  devices or users. An empty user ID dropped the user_id filter, so
  user show "" (or an unset shell variable) built a report from every
  device in the fleet and could email it; empty, . and .. user IDs and
  user records with no ID are now refused. Only devices assigned to the
  user go into a report, and an email lookup keeps only users whose address
  matches exactly, ignoring case.
• vulns list --serial matched the first device whose serial number
  contained the input, because Iru's serial_number filter is a contains
  match. It now needs an exact serial (ignoring case), reports not found
  otherwise, and fails if more than one device has that serial.
• CSV, JSON and -o email output no longer carry terminal escape
  sequences from API data, such as a device name chosen on the endpoint.
  CSV cells drop control characters (tab and newline are kept), JSON
  escapes DEL and C1 controls as \u escapes so it still decodes to the
  same value, and email headers drop every control character.

Verify a downloaded archive with:

gh attestation verify jellyfish_0.4.0_darwin_<arch>.tar.gz --repo bawdo/jellyfish \
  --signer-workflow bawdo/jellyfish/.github/workflows/release.yml \
  --source-ref refs/heads/main --deny-self-hosted-runners
# or from the attached Sigstore bundle, without the attestation API:
gh attestation verify jellyfish_0.4.0_darwin_<arch>.tar.gz --repo bawdo/jellyfish \
  --signer-workflow bawdo/jellyfish/.github/workflows/release.yml \
  --source-ref refs/heads/main --deny-self-hosted-runners \
  --bundle jellyfish_0.4.0_provenance.sigstore.json
shasum -a 256 -c checksums.txt --ignore-missing

Full Changelog: v0.3.0...v0.4.0

v0.3.0

Security

• config.yml, the detection and vulnerability caches, and the managed
  email logo are now always left at mode 0600. Before, the mode was only set
  when the file was first created, so a file that already existed with wider
  permissions kept them. Each write now goes to a temp file and is renamed
  into place, so an interrupted save can't leave a partial file either.
  A symlinked config.yml keeps its link. Parent directories that already
  exist keep their mode.

Changed

• vulns summary --sort rejects an unknown key with exit 1 before fetching
  anything. It used to ignore the key and return rows unsorted. Shell
  completion now offers the valid keys.
• vulns summary puts rows that tie on the sort key in CVE ID order, so the
  output is the same on every run.
• --message accepts an editor with arguments or quoting in $VISUAL or
  $EDITOR (for example code -w), using the same rules as git. A plain
  command name or path is still run directly.
• Test coverage rose from about 81% to 97%. The coverage check in CI now
  fails below 90%, or when a change drops coverage by more than 1%.
• The gated real-Keychain tests can no longer read, overwrite or delete the
  configured Iru token or Gmail credential.

Verify a download with:

gh attestation verify checksums.txt --repo bawdo/jellyfish
shasum -a 256 -c checksums.txt

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

• Resolved multiple Iru users sharing an email by @bawdo in #2
• chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #3
• chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 by @dependabot[bot] in #4
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in the go_modules group across 1 directory by @dependabot[bot] in #5
• Bumped google.golang.org/grpc v1.82.1 → v1.83.2 by @bawdo in #6
• Fixed security, quality and correctness review findings by @bawdo in #7

Full Changelog: v0.1.1...v0.2.0

v0.1.1

What's Changed

• Add CI workflow and README status badges by @bawdo in #1

Full Changelog: v0.1.0...v0.1.1