v1.0.1

Praxis 1.0.1 release index

• Source: cytechlabs/praxis at commit 1baaaf28a49daa1d2ba6c8328b3910754a53c3c5
• Release tag: v1.0.1
• Built by: https://github.com/cytechlabs/praxis/actions/runs/34622051414

Container images

Image	Digest	Tags
ghcr.io/cytechlabs/praxis-backend	sha256:ac044d73cf131044e49a3a3c7efd7aa5181f2c6452563625c0b0c5efd008bb43	1.0.1, 1.0, latest
ghcr.io/cytechlabs/praxis-frontend	sha256:a1f4d01ce4afb0bdf03a160a1a891f49a206f44aba13e04d44255700524c23be	1.0.1, 1.0, latest

Tags move between releases; digests do not. Deploy the digest:

docker pull ghcr.io/cytechlabs/praxis-backend@sha256:ac044d73cf131044e49a3a3c7efd7aa5181f2c6452563625c0b0c5efd008bb43
docker pull ghcr.io/cytechlabs/praxis-frontend@sha256:a1f4d01ce4afb0bdf03a160a1a891f49a206f44aba13e04d44255700524c23be

Image SBOMs

• sbom-backend-1.0.1.cdx.json (CycloneDX 1.6) for praxis-backend
• sbom-frontend-1.0.1.cdx.json (CycloneDX 1.6) for praxis-frontend

Verifying an image

gh attestation verify oci://ghcr.io/cytechlabs/praxis-backend@sha256:ac044d73cf131044e49a3a3c7efd7aa5181f2c6452563625c0b0c5efd008bb43 \
    --repo cytechlabs/praxis

The same command verifies each image above. It checks the build
provenance and the SBOM attestation, both issued to this repository's
release workflow through GitHub OIDC. There is no long lived signing
key to distribute or rotate.

Fleet agent

Published under agent-v1.0.1: https://github.com/cytechlabs/praxis/releases/tag/agent-v1.0.1

Artifact	SHA-256
praxis-agent-v1.0.1-linux-amd64-sbom.cdx.json	3d62851e912d1807acdf8b2ce1b62fe041e37d54eb79e71cc8cb17c6035ec20a
praxis-agent-v1.0.1-linux-amd64.tar.gz	85eed213e075c3df4955b7e254c78142ea379b484a7a28653f5b02f5e8c3d7fe
praxis-agent-v1.0.1-linux-arm64-sbom.cdx.json	df7d8635fb35d7965c30b767c142d2e355fc6fbd0fef156fe26cb382838e2e87
praxis-agent-v1.0.1-linux-arm64.tar.gz	af5c280981b185324e23e6906361b8b75e48713d824b6094da062fdbe8027a26

checksums.txt is signed with keyless Sigstore. Verify it with checksums.txt.sig and checksums.txt.pem from that release before trusting the checksums above.

Security gates

Gate	Status	Detail
source verification	passed	Backend migrations and tests plus frontend lint and type check ran against this commit.
release readiness	passed	Package metadata across the repository matches the release version.
container vulnerability scan	passed	Trivy found no unaccepted CRITICAL findings in the archived images that were promoted.
image sbom binding	passed	Each SBOM was generated from, and checked against, the published image digest.

Reports

• container scan and SBOM reports

What's Changed

• Release Praxis 1.0.1 by @cfreeman29 in #40
• Backport Wave 9 onboarding and SSH fixes to 1.0.1 by @cfreeman29 in #46
• Backport SSH policy defaults, command audit outcomes, and dependency fixes to 1.0.1 by @cfreeman29 in #49
• Finalize the 1.0.1 security and qualification record by @cfreeman29 in #50

Full Changelog: v1.0.0...v1.0.1

Agent v1.0.1

What's Changed

• Release Praxis 1.0.1 by @cfreeman29 in #40
• Backport Wave 9 onboarding and SSH fixes to 1.0.1 by @cfreeman29 in #46
• Backport SSH policy defaults, command audit outcomes, and dependency fixes to 1.0.1 by @cfreeman29 in #49
• Finalize the 1.0.1 security and qualification record by @cfreeman29 in #50

Full Changelog: v1.0.0...agent-v1.0.1

v1.0.0

Praxis 1.0.0 release index

• Source: cytechlabs/praxis at commit 0784eefef0b589d38e32419fcbc1a35becf03f21
• Release tag: v1.0.0
• Built by: https://github.com/cytechlabs/praxis/actions/runs/31512111467

Container images

Image	Digest	Tags
ghcr.io/cytechlabs/praxis-backend	sha256:c3b6f2c608f6c944c50a946aeb232a8c54e173131d0414f59c9212e526d62dae	1.0.0, 1.0, latest
ghcr.io/cytechlabs/praxis-frontend	sha256:0a46197797605525465f23182ffb02d9d6f3056985bd664b2a6dce9bcedf5b12	1.0.0, 1.0, latest

Tags move between releases; digests do not. Deploy the digest:

docker pull ghcr.io/cytechlabs/praxis-backend@sha256:c3b6f2c608f6c944c50a946aeb232a8c54e173131d0414f59c9212e526d62dae
docker pull ghcr.io/cytechlabs/praxis-frontend@sha256:0a46197797605525465f23182ffb02d9d6f3056985bd664b2a6dce9bcedf5b12

Image SBOMs

• sbom-backend-1.0.0.cdx.json (CycloneDX 1.6) for praxis-backend
• sbom-frontend-1.0.0.cdx.json (CycloneDX 1.6) for praxis-frontend

Verifying an image

gh attestation verify oci://ghcr.io/cytechlabs/praxis-backend@sha256:c3b6f2c608f6c944c50a946aeb232a8c54e173131d0414f59c9212e526d62dae \
    --repo cytechlabs/praxis

The same command verifies each image above. It checks the build
provenance and the SBOM attestation, both issued to this repository's
release workflow through GitHub OIDC. There is no long lived signing
key to distribute or rotate.

Fleet agent

Published under agent-v1.0.0: https://github.com/cytechlabs/praxis/releases/tag/agent-v1.0.0

Artifact	SHA-256
praxis-agent-v1.0.0-linux-amd64-sbom.cdx.json	78ab682be729d4326e5b71f6960b01e4e0639efc4af8a22b2b4708592c5f04e8
praxis-agent-v1.0.0-linux-amd64.tar.gz	5cb932f6c899e78dc7e9fe1c470b8654dcb3a09f8243ccd6a53606eb3edcf071
praxis-agent-v1.0.0-linux-arm64-sbom.cdx.json	cd80459957605087c6f50cd4448bd67c1bbf8c47b328e25496ff76588dd49991
praxis-agent-v1.0.0-linux-arm64.tar.gz	76ceb67de5164f04e42753dd114d7da97d3d0338393499f4be1055e9fc6cab93

checksums.txt is signed with keyless Sigstore. Verify it with checksums.txt.sig and checksums.txt.pem from that release before trusting the checksums above.

Security gates

Gate	Status	Detail
source verification	passed	Backend migrations and tests plus frontend lint and type check ran against this commit.
release readiness	passed	Package metadata across the repository matches the release version.
container vulnerability scan	passed	Trivy found no unaccepted CRITICAL findings in the archived images that were promoted.
image sbom binding	passed	Each SBOM was generated from, and checked against, the published image digest.

Reports

• container scan and SBOM reports

What's Changed

• ci: bump the github-actions group with 10 updates by @dependabot[bot] in #4
• Harden the 1.0 security baseline and enforce DeepSource cleanup by @cfreeman29 in #7
• Harden dependencies and complete semantic UI migration by @cfreeman29 in #8
• Prepare reproducible Praxis release artifacts by @cfreeman29 in #12
• Publish the Praxis documentation experience by @cfreeman29 in #13
• Correct the production broker healthcheck by @cfreeman29 in #17
• Align the default group ID sequence by @cfreeman29 in #18

New Contributors

• @dependabot[bot] made their first contribution in #4
• @cfreeman29 made their first contribution in #7

Full Changelog: https://github.com/cytechlabs/praxis/commits/v1.0.0

Agent v1.0.0

What's Changed

• ci: bump the github-actions group with 10 updates by @dependabot[bot] in #4
• Harden the 1.0 security baseline and enforce DeepSource cleanup by @cfreeman29 in #7
• Harden dependencies and complete semantic UI migration by @cfreeman29 in #8
• Prepare reproducible Praxis release artifacts by @cfreeman29 in #12
• Publish the Praxis documentation experience by @cfreeman29 in #13
• Correct the production broker healthcheck by @cfreeman29 in #17
• Align the default group ID sequence by @cfreeman29 in #18

New Contributors

• @dependabot[bot] made their first contribution in #4
• @cfreeman29 made their first contribution in #7

Full Changelog: https://github.com/cytechlabs/praxis/commits/agent-v1.0.0