Skip to content

WolfStack v25.21.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Aug 16:31
· 17 commits to master since this release
v25.21.2
a095f21

v25.21.2: DNS-01 certificates can finally renew — the credentials file no longer vanishes after issuance

certbot records the absolute path of the --dns--credentials file
in /etc/letsencrypt/renewal/.conf and re-reads it on every renew.
WolfStack handed it a throwaway file under /run/wolfstack/dns-creds/ that
was unlinked the moment issuance returned, so every provider-issued cert
failed to renew with "File not found" — from our daily task and from the
distro's certbot.timer alike.

Real issuances now write a persistent 0600 /etc/wolfstack/dns-creds/.ini
(refreshed on credential rotation, removed with the provider); dry-runs
keep the ephemeral file. The daily renewal task first repairs any renewal
config still pointing at a dead /run/ path, so existing lineages heal
about a minute after upgrading without being reissued.

Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

  • wolfstack-x86_64 / wolfstack-aarch64 / wolfstack-armv7 — static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).
  • wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
  • SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.

Assets 9
Loading