v0.6.0

Upgrade notes

• SAML 2.0 console login is new and off unless --saml-* (Helm server.saml) is set. Over https the OIDC login-state cookie is now __Host-halo_oidc; a login started before the upgrade must be restarted.
• Nothing is deleted and nothing is signed unless you set the new flags: every --retention-* defaults to 0 (keep forever) and --audit-signing-key-uri is off.
• halo audit verify reports a missing oldest segment as "the oldest entries were removed" (it said "out of order"); a chain that retention shortened verifies when the matching audit.retention entry is present.
• GET /api/v1/audit total counts the entries kept after retention, not the newest seq.
• Logs written before this release verify unchanged: the new redacted field is omitted from every entry that is not redacted, so no hash changes.
• Go API: server.VerifyAuditDir and server.VerifyAuditBackend take an AuditVerifyOptions argument (pass the zero value for the old behaviour).
• With --audit-signing-key-uri, halo-server first appends a signed audit.signing.enabled entry; every signed entry then binds its seq. halo audit verify --public-key fails on a log with no signed checkpoint, and accepts a redaction or a retention cut only when the vouching entry is signed, unless it predates the marker (erasures and cuts made before signing was enabled stay valid). halo-server refuses an audit key that is also the kill-switch or release key. Rotate the key with --audit-previous-public-key-files on the server and repeated --public-key (the current key first) on halo audit verify; a previous key is valid only until the current one has signed.
• Every erasure needs two admins: POST /api/v1/users/erase answers 202 with a pending erasure, and a different admin confirms it by resubmitting the same user, aliases and reason to POST /api/v1/users/erase/{id}/confirm. Erasure aliases must identify a person.
• halo-server refuses to sign a checkpoint, an erasure or a retention cut while the audit chain does not verify (halo_server_audit_sign_refused_total).
• Signing an audit log that already holds entries needs one start with --audit-signing-enable=<current head seq> (Helm: --set server.auditSigning.enableAtHead=N, once); without it halo-server refuses to sign and keeps running unsigned. A signed log served without its key refuses erasures and retention cuts. Signed entries bind a log id. Signatures catch edits, recomputation and forged vouches, not deletion: run halo audit verify --strict --public-key ... --compare-export <SIEM export> on a schedule (--public-key alone warns; with several keys the newest checkpoint must be the first key's unless --allow-rotation-window). Rotate the audit key by restarting all replicas together.

Added

• SAML 2.0 console login next to OIDC (ADR-0039): --saml-idp-metadata-file|-url, --saml-sp-key-file, --saml-sp-cert-file, --saml-entity-id, --saml-user-attribute, --saml-groups-attribute, --saml-allow-idp-initiated (off); GET /auth/saml/login, POST /auth/saml/acs, GET /auth/saml/metadata, GET /auth/methods; Helm server.saml. Signed assertion or response, audience, recipient, destination, InResponseTo, 60s skew, single-use assertion ids and policy identity.requireAcr/requireAmr (fail closed) are enforced; namespace-prefix rebinding, multiple assertions, rsa-1_5 and unauthenticated AES-CBC are refused before parsing; the user goes through the same SCIM directory, grants, revocation, session timeouts and audit as OIDC. The login page offers each configured method. New dependency: github.com/crewjam/saml v0.5.1 (with goxmldsig v1.6.1, etree, xml-roundtrip-validator, clockwork, golang.org/x/crypto v0.55.0; golang.org/x/sys moves v0.41.0 -> v0.47.0).
• Data retention (ADR-0040): --retention-fleet-reports, --retention-requests, --retention-devices, --retention-audit and --retention-interval on halo-server (Helm server.retention), on both the file and Postgres backends; the sweep runs on the leader only and audits what it removed. Audit retention never deletes entries a SIEM sink has not delivered and records each cut as a chained audit.retention entry.
• GDPR erasure (ADR-0040): POST /api/v1/users/erase (admin, a person, global binding, never oneself, a reason; dryRun; confirmed by a second admin) revokes a person's sessions, deletes their devices, access requests and fleet reports, pseudonymises them in requests they decided and in every audit entry, and returns what was erased and retained per store. A high-severity subject.erase entry vouches for each pseudonymised entry, so the chain still verifies.
• Signed audit checkpoints (ADR-0041): --audit-signing-key-uri (file, awskms://, exec://) and --audit-checkpoint-interval (Helm server.auditSigning) append signed audit.checkpoint entries that reach every SIEM sink. halo audit verify gains --public-key (repeatable), --anchor (the newest checkpoint in your SIEM's export; catches a recomputed or truncated chain), --compare-export (compares every entry the log and the SIEM export both hold), --max-unsigned-tail and --file (verify an export). GET /api/v1/audit reports signed, checkpoints and lastCheckpoint.
• install.sh --require-signature / install.ps1 -RequireSignature (or HALOS_REQUIRE_SIGNATURE=1): refuse to install when cosign is missing instead of falling back to the same-origin sha256.

Changed

• Over https the OIDC login-state cookie is __Host-halo_oidc (Path=/) instead of halo_oidc (Path=/auth), so a sibling subdomain cannot plant it; a login started before the upgrade must be restarted.

Fixed

• make load-fleet runs halo-server with --api-rate-limit 0: all simulated devices enroll through one portal identity, which the per-principal API budget (v0.5.2) throttled to 20/s, so the 5,000- and 10,000-device scenarios failed with 429. The sizing guide says to raise the budget for bulk enrollment through one identity.
• Install docs: Homebrew 7+ refuses formulae from untrusted taps; run brew trust dshakes/tap first.

Documentation

• Every page, the Helm README and all 45 diagram pairs were checked claim by claim against the code (about 950 claims verified, 60+ corrected). Notably the Helm README documented halo-shadow.* values that the chart ignores (the key is shadow), and diagrams showed ed25519-only signing and no SAML, DLP or posture/budget gates. Diagrams are generated by assets/src/build.py.