Guardana Control 0.17.0

Upgrading from 0.16 changes five things an operator may have to act on.
Plaintext evidence export is gone: an http:// export.endpoint,
export.allow_plaintext: true and collect --listen host:port are refused.
Set export.endpoint: unix:///path with export.collector_uid, or reach the
collector over https. The plane refuses to start if health.socket_uid
names its own account; unset it. Under approvals.authority: signed a plane
refuses to start where its own account could write trust.roster. Under
signed, once a plane has carried a parent's close, it refuses any child of
that parent it never admitted. A child admitted by a 0.16 plane has no
state/<id>.seen, so open it again. On every plane, a --config path, or an
absolute path in a key, that holds a symbolic link followed by .. is now
cleaned before it is read, and may name a different file than before.

New: the operator commands print the roster they judged with to standard
error, doctor checks health.socket, and the tests that need root and two
more accounts run in their own CI job
(ADR-0081).
Under signed the plane's own account still raises the roster's floor, so it
can keep the plane on the roster it holds until that roster expires. The hook
profile's qualification was not run again for this release.

Added

• When health.socket is set, doctor checks whom the socket answers and
  judges its directory as a start does. It warns about the first directory
  above the socket that health.socket_uid may not search, since that
  account is then never answered.
• A CI job, "Two accounts", runs the tests that need root and two
  more accounts: the health and export sockets' peers, a signed start's file
  placement and an operator's signed runs directory, each under real
  ownership. It fails unless every test scripts/expected-runs.txt names
  passed (ADR-0081).
  scripts/lib/github-settings.sh declares it a required check; it gates a
  pull request once the maintainer applies those settings.

Changed

• Breaking: the plane refuses to start when health.socket_uid names
  the plane's own account, and doctor fails its health.socket check: the
  socket answers that account already, and the setting only opened it 0666. Unset it, or
  name the other account that is to read the socket.
• Breaking: under approvals.authority: signed a plane whose own account
  may write the trust.roster file, or a directory on its path, refuses to
  start, and doctor fails its trust check: that account could put an
  older roster back. Place the roster where only its signer's account
  writes, such as /etc/guardana.
• Every operator command that judges with --roster and --root-key
  (pause, stops, runs open and runs close, supervise, react)
  says on standard error, before it signs or lists, judged with roster <id> serial <n>, expires <time>. Its judgement has no roster floor; the
  plane's is the one that counts.
• runs open --key reads the roster and the key before it makes an empty
  directory a signed layout, so a roster it cannot read leaves the
  directory as it was.
• doctor's trust line names every file the signed start checked, the
  roster among them, and counts the roster's read grants, which grant
  nothing yet: a plane is read through health.socket by peer uid and
  through files by their modes.
• dev runs its collector on a unix socket in a directory of its own under
  the system's temporary directory, and refuses, naming TMPDIR, where that
  path would not fit a socket address.
• doctor no longer warns of a TCP export.endpoint: an https one is
  reported as export over TLS, and nothing else but a unix socket loads.
• Breaking: under approvals.authority: signed a plane refuses, as
  closed, a child run it never admitted once it carried the close of its
  parent or of an ancestor above it, up to a run it admitted; it writes an
  empty state/<id>.seen at a child's first admitted call, and /healthz
  counts the refusal under runs.signed as refused_parent_closed. A run
  an operator signs, at any depth, under a closed parent no longer runs,
  even where an open record of that parent was put back. A child a 0.16
  plane admitted has no .seen, so once its parent's close is carried it
  is refused: open it again
  (ADR-0079).
• On every plane, a --config path or an absolute path in a key that holds
  a symbolic link followed by .. is cleaned before it is read: the ..
  drops the component before it rather than leaving the link's target. Such
  a path may now name a different file or directory from the one read before,
  evidence.dir and the other state directories included.

Removed

• Breaking: plaintext evidence export
  (ADR-0080).
  An http:// export.endpoint and export.allow_plaintext: true are
  refused at load, naming 0.17. Run collect --listen unix:///path and set
  export.endpoint: unix:///path with export.collector_uid to the account
  collect prints, or reach the collector over https. A unix endpoint's
  socket path is at most 103 bytes.
• Breaking: collect --listen host:port is refused; collect listens on
  unix:///path only.
• Breaking: otel.Options.AllowPlaintext is gone, and the exporter
  refuses an http endpoint even when built directly.

Fixed

• A signed start judges the very configuration file the plane read, and
  refuses a file renamed over its path after the read; a path holding a
  symbolic link followed by .. is judged where it is read. It no longer
  passes a protected file while the plane runs one its own account may
  write.

Security

• Built with Go 1.27.4, which fixes GO-2026-6859 in net/http: a race on
  MaxBytesReader's header could crash an HTTP/1 server. govulncheck
  found it reachable from the plane's HTTP servers under 1.27.3.

Image: ghcr.io/guardana/control-gateway@sha256:a5acfb45bf062e19791cfd1420f01bdd984a44c8e8355549994655b7c97ce17a