v0.1.4

Changelog

• c77f148 Guidance: who can reach the offline Root, and logging every signing

Verify what you downloaded

cosign verify-blob \
  --certificate-identity "https://github.com/marcioamatte/pki-dash/.github/workflows/release.yml@refs/tags/v0.1.4" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --bundle checksums.txt.sigstore.json checksums.txt
sha256sum --check --ignore-missing checksums.txt

Container image: ghcr.io/marcioamatte/pki-dash:0.1.4 (signed the same way: see the installation guide).

v0.1.3

Changelog

• 1bb44af Trust stores, name constraints and a security guide, after the eMudhra intermediate-key incident

Verify what you downloaded

cosign verify-blob \
  --certificate-identity "https://github.com/marcioamatte/pki-dash/.github/workflows/release.yml@refs/tags/v0.1.3" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --bundle checksums.txt.sigstore.json checksums.txt
sha256sum --check --ignore-missing checksums.txt

Container image: ghcr.io/marcioamatte/pki-dash:0.1.3 (signed the same way: see the installation guide).

v0.1.2

Changelog

• cbbd631 Add a code of conduct and a contributing guide
• 413a4ad Say which ways of serving are set, and document the reset-failed step

Verify what you downloaded

cosign verify-blob \
  --certificate-identity "https://github.com/marcioamatte/pki-dash/.github/workflows/release.yml@refs/tags/v0.1.2" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --bundle checksums.txt.sigstore.json checksums.txt
sha256sum --check --ignore-missing checksums.txt

Container image: ghcr.io/marcioamatte/pki-dash:0.1.2 (signed the same way: see the installation guide).

v0.1.1

Changelog

• 7303c67 Footer: say plainly that there is no warranty and all risk of use is the user's
• 0f5e552 README: describe what the project does today
• ab2b09d README: state plainly that there is no warranty and the user bears all risk

Verify what you downloaded

cosign verify-blob \
  --certificate-identity "https://github.com/marcioamatte/pki-dash/.github/workflows/release.yml@refs/tags/v0.1.1" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --bundle checksums.txt.sigstore.json checksums.txt
sha256sum --check --ignore-missing checksums.txt

Container image: ghcr.io/marcioamatte/pki-dash:0.1.1 (signed the same way: see the installation guide).

v0.1.0

Changelog

• 369c9af Add admin screens to the UI: users, audit log, Root offline wizard, own password
• bb38ced Add certificate issuance, listing and trust instructions to the UI
• 98afab1 Add initial CI workflow
• b649c23 Add internal/api and a runnable server
• 8b1ad40 Add internal/auth: local accounts, sessions and role-based access
• ccf5bf8 Add internal/ca: Root, intermediate and leaf issuance on top of cfssl
• 5bd7944 Add internal/service: business rules joining ca, vault and store
• b85cca0 Add internal/store: SQLite persistence with append-only audit log
• a9b07b7 Add internal/vault for key encryption at rest; add govulncheck to CI
• 91d7ec2 Add the container image, Compose file, deployment docs and Dependabot
• 8a3e2ea Add the web UI foundation: setup, sign-in, vault unlock, CA list and creation
• 311e4f2 Bump node from 24-alpine to 26-alpine
• 6a238af Bump typescript from 5.9.3 to 6.0.3 in /web
• ec09da4 Destroy the key of a revoked intermediate
• 4714d5f End the identity provider's session at sign-out (RP-initiated logout)
• c9f37bb Fix: never whitespace-trim raw DER when decoding a Root CRL
• bcc7647 Import a Root and intermediates signed outside the service
• 3617550 Initial commit
• 8cfc172 Initial project skeleton: vision, stack decision, licensing
• ced1da6 Name constraints for intermediates signed offline
• c969ce1 Redesign the UI: blue/white palette, Philosopher font, full-width layout, responsive tables
• 00e7832 Release pipeline: GoReleaser, .deb/.rpm with systemd, GHCR image, SBOM, cosign
• c1ed31f Revoke intermediate CAs and publish the Root's CRL that is signed offline
• efce37e Revoke service certificates and publish CRLs
• 2702307 Sign in with Keycloak / any OpenID Connect provider
• a323720 Tell Dependabot to skip TypeScript 7 until svelte-check supports it
• 88638b1 Trusted reverse proxies
• 2a05ebe UI for importing a Root and intermediates signed offline
• 682c1bf UI for revoking certificates and watching the revocation lists
• a377ee3 UI for revoking intermediates and publishing the Root's CRL

Verify what you downloaded

cosign verify-blob \
  --certificate-identity "https://github.com/marcioamatte/pki-dash/.github/workflows/release.yml@refs/tags/v0.1.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --bundle checksums.txt.sigstore.json checksums.txt
sha256sum --check --ignore-missing checksums.txt

Container image: ghcr.io/marcioamatte/pki-dash:0.1.0 (signed the same way: see the installation guide).