Skip to content

v0.2.0-alpha.4

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Aug 03:00
· 436 commits to main since this release
v0.2.0-alpha.4
645a6fc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

BuildMax is an out-of-the-box, privately deployable Agent platform: a CLI/TUI,
a desktop app, and a team Portal on one shared Go Agent Runtime.

Highlights

  • A container-image-only security fix. Both published images apply their base
    image's pending security updates at build time, so they no longer ship an
    openssl the alpine branch has already patched. Nothing else changed since
    0.2.0-alpha.3.

Upgrade notes

  • Operators running the 0.2.0-alpha.3 images should pull this version.
    ghcr.io/gougoujiang/buildmax:0.2.0-alpha.3 and
    ghcr.io/gougoujiang/buildmax-portal:0.2.0-alpha.3 carry CVE-2026-14456 in
    openssl 3.5.7-r0; their base tags lagged the fix alpine had published as
    3.5.8-r0. The archives are unaffected — the binaries are built with
    CGO_ENABLED=0 and do not link the system openssl — so an installation from
    a 0.2.0-alpha.3 archive needs nothing.

Install

Download the archive for your platform below. Each one contains all three
binaries — buildmax, buildmax-server, buildmax-worker — plus
config-examples/, LICENSE, and NOTICE-THIRD-PARTY. Verify it against
checksums.txt first.

With a Go toolchain, for the CLI alone:

go install github.com/gougoujiang/buildmax/cmd/buildmax@v0.2.0-alpha.4

As a container, for linux/amd64 and linux/arm64:

docker pull ghcr.io/gougoujiang/buildmax:0.2.0-alpha.4

Copy config-examples/settings.example.yaml to ~/.buildmax/settings.yaml,
configure at least one model, then run buildmax for the TUI or
buildmax -p "your prompt" for a single non-interactive turn. Running the
server and Portal additionally needs MySQL and object storage; see the README.

The desktop app is not published here. It needs code signing and notarization
to launch on macOS, so build it locally with ./make build.

Before you deploy this

This is an alpha, and two defaults deserve to be read as warnings rather than
footnotes:

  • Server authentication is bootstrap-level. There is no mail channel, so an
    operator creates accounts and issues single-use login codes with
    buildmax-server user create and user login-code. Self-registration is
    closed by default. There is no password, second factor, SSO, or recovery
    flow; putting the Portal on a network you do not control requires wiring a
    real identity provider first.
  • The bash sandbox is off by default, and worker hardening is incomplete.

SECURITY.md lists both, along with how to report a vulnerability privately.
Interfaces and deployment guidance may change before a stable release.

Security

  • The published container images now apply their base image's pending security
    updates at build time. A base tag lags its branch's updates, so
    ghcr.io/gougoujiang/buildmax:0.2.0-alpha.3 and the matching
    buildmax-portal image shipped openssl 3.5.7-r0 while alpine had already
    published 3.5.8-r0, and the release scan failed on CVE-2026-14456 after both
    images were pushed. The binaries in the archives were never affected: they
    are built with CGO_ENABLED=0 and do not link the system openssl.

Earlier releases are in
CHANGELOG.md.

Assets 13
Loading