Heimdall v0.1.4

Changes

Highlights

• Publish only the user-facing heimdall-egress CLI package on crates.io.
• Keep eBPF wire types and configuration parsing as repository-internal crates
  instead of exposing implementation packages as products.
• Preserve one-command cargo install heimdall-egress --locked installation
  with the verified eBPF object embedded in the source crate.

Changed

• Move the canonical shared wire types and configuration schema into the CLI
  source tree, with internal workspace crates reusing those exact files for
  eBPF builds and schema tests.
• Reduce the Cargo Release asset, trusted-publishing workflow, Lasso binding,
  and registry acceptance contract from three crates to heimdall-egress.

Known limitations

• Native macOS support is not available yet.
• Cargo installation compiles the userspace CLI locally and therefore takes
  longer than installing the prebuilt npm, PyPI, or GitHub Release packages.

Install

Download the archive and matching SHA-256 file for your Linux architecture.
Follow the versioned installation guide
for checksum verification, setup authorization, upgrade, and rollback.

Release artifacts

• heimdall-egress-0.1.4-x86_64-linux-musl.tar.gz
• heimdall-egress-0.1.4-aarch64-linux-musl.tar.gz
• heimdall-egress-0.1.4.tgz for npm trusted publishing
• x86_64 and aarch64 heimdall_egress-0.1.4-*.whl files for PyPI
  trusted publishing
• heimdall-egress-0.1.4.crate for crates.io publication
• One SHA-256 file beside each archive

Verification

The release host completed the authoritative local source checks, current and
Linux 6.6 LTS real-eBPF VM suites sequentially, and native, npm, PyPI, and Cargo
package gates before the tag or assets were published.

Full changelog

Compare the complete Git history.

Heimdall v0.1.3

Changes

Highlights

• Publish the official heimdall CLI as the heimdall-egress source crate,
  with no install-time downloader, lifecycle script, or daemon.
• Preserve local release authority by attaching checksum-verified Cargo
  packages to GitHub Releases and reproducing them before any OIDC upload.
• Add one-time crates.io Trusted Publisher setup so routine releases use a
  short-lived GitHub OIDC credential instead of a stored registry token.

Added

• Add publishable heimdall-common, heimdall-config, and heimdall-egress
  crates with complete registry metadata and a project-owned crates.io landing
  page.
• Add Cargo package acceptance for archive inventory, metadata, landing-page
  content, and byte equality between the packaged eBPF ELF and its pinned Nix
  build.

Changed

• Embed the locally verified eBPF object from a versioned crate resource so
  cargo install heimdall-egress --locked needs only stable Rust 1.95 and does
  not require an eBPF compiler at installation time.
• Extend the GitHub Release transaction with three .crate assets and their
  SHA-256 files. The thin Cargo workflow reproduces those packages from the
  immutable tag before publishing the dependency crates and CLI in order.
• Document Cargo installation, source-package architecture, first-publication
  bootstrap, subsequent OIDC publication, and independent fresh-install
  acceptance.

Known limitations

• Native macOS support is not available yet.
• Cargo installation compiles the userspace CLI locally and therefore takes
  longer than installing the prebuilt npm, PyPI, or GitHub Release packages.

Install

Download the archive and matching SHA-256 file for your Linux architecture.
Follow the versioned installation guide
for checksum verification, setup authorization, upgrade, and rollback.

Release artifacts

• heimdall-egress-0.1.3-x86_64-linux-musl.tar.gz
• heimdall-egress-0.1.3-aarch64-linux-musl.tar.gz
• heimdall-egress-0.1.3.tgz for npm trusted publishing
• x86_64 and aarch64 heimdall_egress-0.1.3-*.whl files for PyPI
  trusted publishing
• heimdall-common-0.1.3.crate, heimdall-config-0.1.3.crate, and
  heimdall-egress-0.1.3.crate for crates.io publication
• One SHA-256 file beside each archive

Verification

The release host completed the authoritative local source checks, current and
Linux 6.6 LTS real-eBPF VM suites sequentially, and native, npm, PyPI, and Cargo
package gates before the tag or assets were published.

Full changelog

Compare the complete Git history.

Heimdall v0.1.2

Changes

Highlights

• Publish the official daemonless Heimdall CLI through PyPI for x86_64 and
  aarch64 Linux across glibc and musl systems.
• Keep PyPI packaging local and immutable: each wheel embeds one verified
  release binary and performs no install-time download or build.
• Publish the exact checksum-verified GitHub Release wheels through PyPI OIDC
  with no registry token or second release command.

Added

• Add the public heimdall-egress PyPI distribution with heimdall and
  heimdall-egress console commands, Python 3.9+ metadata, pipx.run support,
  and project-owned install, architecture, mode, and security documentation.
• Add native wheel acceptance for metadata rendering, checksums, x86_64
  installation and execution, bundled-path discovery, static linkage, and
  aarch64 architecture integrity.

Changed

• Extend just release-github to build and verify the two PyPI wheels locally,
  attach them and their checksums to the GitHub Release, and let the thin
  publish-pypi.yml workflow upload only those immutable assets with pinned
  uv and GitHub OIDC.
• Document persistent and ephemeral installation through uv, pip, and
  pipx, including the stable native-path authorization boundary required by
  real proxy sessions.

Known limitations

• Native macOS support is not available yet.
• Native aarch64 real-eBPF VM acceptance remains future work; the aarch64 wheel
  is checked for architecture, static linkage, metadata, and checksum integrity.

Install

Download the archive and matching SHA-256 file for your Linux architecture.
Follow the versioned installation guide
for checksum verification, setup authorization, upgrade, and rollback.

Release artifacts

• heimdall-egress-0.1.2-x86_64-linux-musl.tar.gz
• heimdall-egress-0.1.2-aarch64-linux-musl.tar.gz
• heimdall-egress-0.1.2.tgz for npm trusted publishing
• x86_64 and aarch64 heimdall_egress-0.1.2-*.whl files for PyPI
  trusted publishing
• One SHA-256 file beside each archive

Verification

The release host completed the authoritative local source checks, current and
Linux 6.6 LTS real-eBPF VM suites sequentially, and native, npm, and PyPI
package gates before the tag or assets were published.

Full changelog

Compare the complete Git history.

Heimdall v0.1.1

Changes

Highlights

• Publish the official daemonless Heimdall CLI through npm for x86_64 and
  aarch64 Linux with no install lifecycle scripts.
• Make npm publication consume the exact locally verified GitHub Release asset
  through GitHub OIDC instead of a long-lived registry token.
• Expand the npm package page with verified install and one-shot commands,
  quick start, architecture, operating modes, and security boundaries.

Added

• Add the public heimdall-egress npm distribution with embedded x86_64 and
  aarch64 Linux musl binaries, heimdall and heimdall-egress launchers, no
  install lifecycle scripts, and local global-install/npm exec acceptance.

Changed

• Expand the npm package page with npm, pnpm, Yarn, Bun, and Deno install and
  one-shot commands plus concise setup, architecture, operating-mode, platform,
  daemonless lifecycle, and security guidance.
• Build the exact npm tarball locally with pinned npm 12 and attach it and its
  checksum to the GitHub Release. Publishing the Release triggers the
  project-owned workflow, whose native npm CLI uses OIDC without a long-lived
  write token or a second release command.
• Require curated GitHub Release notes generated from each version's
  highlights, structured changelog, known limitations, installation and
  artifact details, local verification evidence, and full comparison link.

Removed

• Remove the legacy authenticated local npm publish transaction. npm
  versions now derive only from checksum-verified GitHub Release assets.
• Remove the GitHub Actions Linux CI workflow. Source, package, and current/6.6
  LTS real-eBPF gates remain local (just verify, just test-package,
  just test-vm); just release-github reruns them locally before creating
  the tag and publishing its archives and checksums.

Known limitations

• Native macOS support is not available yet.

Install

Download the archive and matching SHA-256 file for your Linux architecture.
Follow the versioned installation guide
for checksum verification, setup authorization, upgrade, and rollback.

Release artifacts

• heimdall-egress-0.1.1-x86_64-linux-musl.tar.gz
• heimdall-egress-0.1.1-aarch64-linux-musl.tar.gz
• heimdall-egress-0.1.1.tgz for npm trusted publishing
• One SHA-256 file beside each archive

Verification

The release host completed the authoritative local source checks, current and
Linux 6.6 LTS real-eBPF VM suites sequentially, and both static package gates
before the tag or assets were published.

Full changelog

Compare the complete Git history.

Heimdall v0.1.0

Full Changelog: https://github.com/dravengarden/heimdall/commits/v0.1.0