Rasputin Firewall 2026.07.1

Channel: stable. Artifacts: *-ab.img.gz is the full A/B disk (INITIAL FLASH — write to the whole disk); *.rootfs is the bare rootfs squashfs (the OTA artifact the control plane pushes into the inactive slot). Verify signatures with the public root CA (vars.RASPUTIN_ROOT_CA_PEM on the geekdojo org) — openssl cms -verify -binary -inform DER -in <file>.sig -content <file> -CAfile root-ca.pem. Per-asset SHA-256 in manifest.json. The *.sbom.txt asset is the package manifest (canary workflow uses this to detect upstream drift).

Rasputin Firewall 2026.07.1-dev.57

Channel: dev. Artifacts: *-ab.img.gz is the full A/B disk (INITIAL FLASH — write to the whole disk); *.rootfs is the bare rootfs squashfs (the OTA artifact the control plane pushes into the inactive slot). Verify signatures with the public root CA (vars.RASPUTIN_ROOT_CA_PEM on the geekdojo org) — openssl cms -verify -binary -inform DER -in <file>.sig -content <file> -CAfile root-ca.pem. Per-asset SHA-256 in manifest.json. The *.sbom.txt asset is the package manifest (canary workflow uses this to detect upstream drift).

Rasputin Firewall 2026.07.1-dev.55

Channel: dev. Artifacts: *-ab.img.gz is the full A/B disk (INITIAL FLASH — write to the whole disk); *.rootfs is the bare rootfs squashfs (the OTA artifact the control plane pushes into the inactive slot). Verify signatures with the public root CA (vars.RASPUTIN_ROOT_CA_PEM on the geekdojo org) — openssl cms -verify -binary -inform DER -in <file>.sig -content <file> -CAfile root-ca.pem. Per-asset SHA-256 in manifest.json. The *.sbom.txt asset is the package manifest (canary workflow uses this to detect upstream drift).

Rasputin Firewall 2026.07.1-dev.54

Channel: dev. Artifacts: *-ab.img.gz is the full A/B disk (INITIAL FLASH — write to the whole disk); *.rootfs is the bare rootfs squashfs (the OTA artifact the control plane pushes into the inactive slot). Verify signatures with the public root CA (vars.RASPUTIN_ROOT_CA_PEM on the geekdojo org) — openssl cms -verify -binary -inform DER -in <file>.sig -content <file> -CAfile root-ca.pem. Per-asset SHA-256 in manifest.json. The *.sbom.txt asset is the package manifest (canary workflow uses this to detect upstream drift).

Rasputin Firewall 2026.07.1-dev.53

Channel: dev. Artifacts: *-ab.img.gz is the full A/B disk (INITIAL FLASH — write to the whole disk); *.rootfs is the bare rootfs squashfs (the OTA artifact the control plane pushes into the inactive slot). Verify signatures with the public root CA (vars.RASPUTIN_ROOT_CA_PEM on the geekdojo org) — openssl cms -verify -binary -inform DER -in <file>.sig -content <file> -CAfile root-ca.pem. Per-asset SHA-256 in manifest.json. The *.sbom.txt asset is the package manifest (canary workflow uses this to detect upstream drift).

Rasputin Firewall 2026.07.1-dev.52

Channel: dev. Artifacts: *-ab.img.gz is the full A/B disk (INITIAL FLASH — write to the whole disk); *.rootfs is the bare rootfs squashfs (the OTA artifact the control plane pushes into the inactive slot). Verify signatures with the public root CA (vars.RASPUTIN_ROOT_CA_PEM on the geekdojo org) — openssl cms -verify -binary -inform DER -in <file>.sig -content <file> -CAfile root-ca.pem. Per-asset SHA-256 in manifest.json. The *.sbom.txt asset is the package manifest (canary workflow uses this to detect upstream drift).

Rasputin Firewall 2026.07.1-dev.51

Channel: dev. Artifacts: *-ab.img.gz is the full A/B disk (INITIAL FLASH — write to the whole disk); *.rootfs is the bare rootfs squashfs (the OTA artifact the control plane pushes into the inactive slot). Verify signatures with the public root CA (vars.RASPUTIN_ROOT_CA_PEM on the geekdojo org) — openssl cms -verify -binary -inform DER -in <file>.sig -content <file> -CAfile root-ca.pem. Per-asset SHA-256 in manifest.json. The *.sbom.txt asset is the package manifest (canary workflow uses this to detect upstream drift).

Rasputin Firewall 2026.07.1-dev.50

Channel: dev. Artifacts: *-ab.img.gz is the full A/B disk (INITIAL FLASH — write to the whole disk); *.rootfs is the bare rootfs squashfs (the OTA artifact the control plane pushes into the inactive slot). Verify signatures with the public root CA (vars.RASPUTIN_ROOT_CA_PEM on the geekdojo org) — openssl cms -verify -binary -inform DER -in <file>.sig -content <file> -CAfile root-ca.pem. Per-asset SHA-256 in manifest.json. The *.sbom.txt asset is the package manifest (canary workflow uses this to detect upstream drift).

Rasputin Firewall 2026.07.1-dev.49

Channel: dev. Artifacts: *-ab.img.gz is the full A/B disk (INITIAL FLASH — write to the whole disk); *.rootfs is the bare rootfs squashfs (the OTA artifact the control plane pushes into the inactive slot). Verify signatures with the public root CA (vars.RASPUTIN_ROOT_CA_PEM on the geekdojo org) — openssl cms -verify -binary -inform DER -in <file>.sig -content <file> -CAfile root-ca.pem. Per-asset SHA-256 in manifest.json. The *.sbom.txt asset is the package manifest (canary workflow uses this to detect upstream drift).

Rasputin Firewall 2026.07.1-dev.48

Channel: dev. Artifacts: *-ab.img.gz is the full A/B disk (INITIAL FLASH — write to the whole disk); *.rootfs is the bare rootfs squashfs (the OTA artifact the control plane pushes into the inactive slot). Verify signatures with the public root CA (vars.RASPUTIN_ROOT_CA_PEM on the geekdojo org) — openssl cms -verify -binary -inform DER -in <file>.sig -content <file> -CAfile root-ca.pem. Per-asset SHA-256 in manifest.json. The *.sbom.txt asset is the package manifest (canary workflow uses this to detect upstream drift).