Skip to content

v0.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Oct 09:39
· 12 commits to main since this release
v0.5.0
08592ce

jumpgate v0.5.0 adds a terminal UI, a signed controller/agent model for the boxes you manage, and desktop builds for macOS, Windows and Linux.
Long operations now run on the box as durable jobs; the first one, node.migrate-names, moves legacy nodes to the jumpgate-node account. Read Upgrading before you upgrade.

Highlights

  • Terminal UI. Run jumpgate with no arguments in a terminal, or open the terminal launcher for your OS. It has six screens: Fleet, Hosts, Signers, Gateways, Jobs and Settings. They cover every box at once, plus each box's status, disk, endpoints, firewall, live logs and services, pairing, and the signing key. 1–6 switch screens, : takes a command (:logs box-a, :restart beacon box-a) and ? lists every key. Stopping or restarting a service asks you to type its name. The TUI needs an 80x24 terminal. It draws in plain ASCII on the classic Windows console and the Linux virtual console, or with JUMPGATE_ASCII=1, and NO_COLOR=1 turns colour off. The TUI holds no keys and does no work itself: it talks to the local server, and quitting leaves the server running. jumpgate home shows the plain line-based screen instead.
  • Controller and agent. jumpgate keys init creates a controller signing key in the macOS Keychain, Windows Credential Manager, Secret Service, 1Password or an owner-only file. jumpgate hosts add pairs a box: you confirm its host key by fingerprint, and jumpgate installs a small agent (jumpgate-agent.service) and a restricted jumpgate tunnel user. Every command to a paired box is then a signed intent, which the agent checks against its policy and answers with a signed receipt. Each release carries both Linux agents (amd64 and arm64), so a controller on any OS can pair a box with nothing else to download.
  • A command line. jumpgate help lists the commands: status, logs, service, hosts, keys, jobs, ssh, open, serve and stop. Exit codes are documented in the README. A security failure, such as an unconfirmed or changed host key or a reply the paired agent didn't sign, always exits 4.
  • macOS, Windows and Linux. macOS ships Jumpgate.app (a window and a menubar icon) and Jumpgate Terminal.app. Windows ships jumpgate.exe and jumpgate-tray.exe (a window and a notification icon). Linux ships a desktop bundle with "Jumpgate" and "Jumpgate (window)" menu entries, on amd64 and arm64. One background server per user is shared by the app, the TUI and the CLI. Downloads come with SHA-256 checksums and build-provenance attestations.
  • Durable jobs. A durable job is a multi-step operation that the box runs itself, so it outlives the TUI, the controller and an agent restart. Every step and answer goes into a signed, hash-chained log that the controller verifies. When a step can't choose safely, the job stops and asks you. One controller drives a job at a time; the others watch, and can adopt a job whose controller has been silent for 90 seconds. Press 5 in the TUI to open the jobs inbox, or run jumpgate jobs.
  • node.migrate-names. jumpgate migrate-names HOST --yes renames a legacy node's valve-node-app account, group, units and data root to jumpgate-node. It checks the box before it renames anything, leaves a mounted data root at its path once you agree, and asks before it stops leftover processes. New setups use jumpgate-node from the start.
  • Also new:
    • jumpgate relay runs keyed, metered RPC as its own process, away from the controller key. API keys are issued, listed and revoked from the RPC screen.
    • A Public gateway tier serves your own domain with a Let's Encrypt certificate.
    • Log lines sent for an AI explanation have addresses, peer ids and secrets redacted first.

Upgrading from v0.4.4

  • Quit v0.4.4 before you start v0.5.0. Both listen on 127.0.0.1:8799.
  • Your settings move automatically. On first run, ~/.valve-node-app moves to ~/.jumpgate, and a MOVED note is left in the old place. It's a rename, not a copy, so secrets never exist twice on disk. If both directories hold a config.json, jumpgate stops and asks you to keep one and remove the other. It doesn't merge two configs.
  • Secrets are tightened at startup. The server makes existing secret files private to you. It refuses to start if a signing key can't be made private.
  • Bare jumpgate in a terminal now opens the TUI. You get the web app with jumpgate open, with a flag such as --bind, or with no terminal (a pipe or the app bundle).
  • Browser sign-in uses a one-time login link. jumpgate open signs your browser in with a link that works once, within 60 seconds, from this computer only. The session token is never put in a URL or on a command line. For a browser that can't read ~/.jumpgate, use jumpgate open --print.
  • Host keys are checked strictly. A box that is paired, confirmed or listed in your ~/.ssh/known_hosts must present the same key. A changed key is refused, not learned again. Only a box with no such record is still trusted on first use.
  • Pairing is optional for existing boxes, but jobs need it. Boxes you already manage keep working over SSH. Durable jobs and signed intents need a paired box: run jumpgate keys init once, then jumpgate hosts add NAME --ssh root@HOST. Once pairing succeeds, disable root SSH login on the box (PermitRootLogin no).
  • Upgrade every controller before you migrate a box's names. A controller from before this release doesn't know about the migration. Running setup from it afterwards would set the box up under the legacy names again. A current controller refuses to set up a migrated box under the legacy names.
  • While a job runs, the node belongs to the job. The box refuses service start, stop and restart, and the controller refuses setup and service clear on it (409 job_active).
  • Platform minimums:
    • macOS 10.15.
    • Windows 10 1803 or Windows Server 2019.
    • The Linux window needs WebKitGTK 4.1 (Ubuntu 22.04+, Debian 12+, Fedora 38+).

Security fixes

  • Built with Go 1.26, which carries the current fixes to net/http, HTTP/2 and crypto/tls.
  • Updated golang.org/x/crypto for two SSH denial-of-service fixes.
  • A cookie-authorised write to the local API must now come from the app's own origin. Before this fix, a page on another local port could drive the API with your cookie.
  • The Gemini API key is sent in a header, not in the URL, so it no longer appears in error messages.
  • The browser is signed in with a one-time login code instead of the session token.
  • Host keys that were paired, confirmed or listed in known_hosts are checked strictly: a changed key is refused.
  • Every secret jumpgate writes is created private to you: owner-only files on Linux and macOS, DACLs on Windows. Existing ones are tightened at startup.

Known limitations

  • Durable jobs need a Linux box with systemd. A box without systemd refuses to start one (jobs_unsupported). Controllers on any OS can list, watch, decide and adopt jobs.
  • There is no approval-tier signer yet. jumpgate refuses an approval-tier question with 409 approval_unavailable.
  • Validators are not supported.
  • The agent runs on Linux only. To run a node on macOS or Windows, use a WSL2 or Lima VM as an ordinary Linux box.
  • jumpgate ssh refuses a box that is reached through a jump host.
  • Pairing this machine with --local works on Linux only.
  • Downloads are not code-signed yet. Windows SmartScreen may warn you, and macOS may ask you to allow the app in System Settings > Privacy & Security.
Assets 17
Loading