WolfStack v25.38.0

v25.38.0: 2FA setup was invisible and leaked its secret to a QR service; monitor uptime history can be reset

Enable 2FA opened its dialog inside a never-closed overlay, so nothing
appeared; the QR code is now generated on the host instead of by
api.qrserver.com. Status monitors no longer go Degraded after every restart,
and each monitor can have its uptime history reset across the cluster.

Reported-by: Mancolt
Reported-by: RutgerDiehard

Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: IntelligentWolf Ltd paul@wolf.uk.com

---

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/intelligentwolf/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo intelligentwolf/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

• wolfstack-x86_64 / wolfstack-aarch64 / wolfstack-armv7 — static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).
• wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
• SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.