Skip to content

WolfStack v25.21.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Aug 12:11
· 20 commits to master since this release
v25.21.1
72411b2

v25.21.1: a failed certbot.service now tells you why when you click Repair

The one-click repair for a failed certbot.service ran certbot renew through
run_shell() and unwrapped the result with unwrap_or_default(). run_shell()
returns Err on a non-zero exit, so the renew output was discarded in exactly
the case the operator clicked Repair to read — a failing renewal left the
result panel blank apart from the systemctl restart log. It also located
certbot with a bare which, which runs under systemd's PATH and misses snap
and pipx installs, so a snap host reported "certbot binary not on PATH" and
skipped the renew with certbot sitting at /snap/bin/certbot.

certbot is now resolved through certbot::certbot_path(), the same probe chain
the rest of the certbot module uses, and a genuinely missing binary reports
missing_certbot_error() with its trace and install command. stdout and stderr
are both kept on success and failure alike, along with the exit status and a
pointer to /var/log/letsencrypt/letsencrypt.log. The diagnostic run no longer
passes --quiet: the distro's own certbot.service already runs certbot -q renew, and that silence is what sends operators to this button.

Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

  • wolfstack-x86_64 / wolfstack-aarch64 / wolfstack-armv7 — static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).
  • wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
  • SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.

Assets 9
Loading