Skip to content

Gobstopper v0.8.10

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Oct 06:08
· 5 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.8.10
a597ae1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A managed installation whose executable bytes no longer match its verified install receipt repairs itself instead of deadlocking every command.

Changes

  • gobstopper update on such an install reinstalls a verified release: the drifted bytes are preserved beside the install record, a pinned install is restored to its recorded pin, and the recorded tag is reinstalled when nothing newer is published.
  • gobstopper update status and gobstopper update check report a mismatch status with repair guidance instead of exiting before command dispatch.
  • Automatic-policy startup repairs the installation and re-enters the verified image before any product work — including a supervised proxy serve, which therefore self-heals through launchd relaunch. Disabled policies and suppressing contexts still fail closed, and repair attempts are bounded once per day.
  • proxy doctor reports a drifted flag when the service executable has a valid managed receipt whose bytes no longer match.

Install

On macOS (Apple silicon) or Linux (x86_64 or arm64):

curl -fsSL https://gobstopper.sh/install.sh | GOBSTOPPER_VERSION=0.8.10 sh

On Windows (x86_64), in PowerShell:

$env:GOBSTOPPER_VERSION = "0.8.10"; irm https://gobstopper.sh/install.ps1 | iex

Each installer downloads the archive for your platform from this release, checks it against its .sha256 file, and installs gobstopper for your user only: ~/.local/bin on macOS and Linux, %LOCALAPPDATA%\Programs\gobstopper\bin on Windows. Nothing runs as root or administrator.

On other platforms, build this version from source with Cargo:

cargo install --git https://github.com/hraness/gobstopper --tag v0.8.10 --locked gobstopper

Verify

SHA256SUMS on this release lists the SHA-256 of each archive:

  • gobstopper-0.8.10-darwin-aarch64.tar.gz: 01383623ba4ee018a0477d59d4e7aefb8c6626a1361522db13121377c4cce318
  • gobstopper-0.8.10-linux-aarch64.tar.gz: fef4285570f7ebb54e8c8f87418f459c3c0f66abea6dab0b7407ab184e2d59ba
  • gobstopper-0.8.10-linux-x86_64.tar.gz: bc1567d4c86090d995041e3438081d636b4170290ae4409ac4723f0d80d82584
  • gobstopper-0.8.10-windows-x86_64.zip: c856d252e39bc3dc7be5019f4fc78a25bd481de568f42e1f81c0110f806f0f07

Source commit: a597ae19ab47401c3e87c8bf3263c18fdac854b5

The release workflow signed a build provenance attestation for each archive, and GitHub signs an attestation for the release itself. Check both for a downloaded archive with:

gh attestation verify gobstopper-0.8.10-linux-x86_64.tar.gz --repo hraness/gobstopper
gh release verify v0.8.10 --repo hraness/gobstopper
gh release verify-asset v0.8.10 gobstopper-0.8.10-linux-x86_64.tar.gz --repo hraness/gobstopper

How to check a Gobstopper release

Assets 12
Loading