v0.9.0

Changelog

A machine can now replace the key it signs its own statements with, and its
statements say which operation verified a release's signature. A password in a
bundle URL no longer reaches the journal or a support bundle, doctor says when
attestations have no target to go to, a task's output no longer carries
Compose's progress, and a rollback keeps the source update --check asks.

Upgrading moves the installation schema from 12 to 13, with nothing to migrate.
Once a 0.9.0 manager has written an installation's state, a 0.8.x manager
refuses it rather than rewriting its release record without the new signature
check, so that machine cannot go back to 0.8.x. A bundle built for 0.8.0
installs unchanged. Four things behave differently:

• Attestation statements use the predicate …/attestation/v2. attest verify
  reads v1 and v2; a consumer validating statements against
  schemas/morzer-attestation-v1.json needs morzer-attestation-v2.json for
  new ones.
• After installation rotate-signing-key, a fleet roster that pins the
  machine's key reports its row as signed-by-another-key until the roster
  entry names the new key.
• A journal written by an earlier update given a URL with a password still
  holds that password on the machine. Support bundles strip it from now on;
  rotate such a token.
• With Compose 2.36 or later, the output of a task or a migration service no
  longer includes Compose's progress for the services it starts.

Statements gain signature_verified and key_id for an update's own check
and signature_verified_when_staged for every later one. doctor's
backup.attestations-pushed has a new description, and reports on a machine
with no backup target where it said nothing. A support bundle's journal count
includes URL passwords it removed, and installation rotate-signing-key has a
payload of its own. No existing field changed meaning.

Added

• installation rotate-signing-key replaces the key a machine signs its own statements with. Retiring a key suspected of being stolen meant rebuilding the machine with installation import. The command mints a new key, records the old one under signing.previous_keys and moves the new one into place, so everything the old key signed still verifies as a predecessor's signature and never as the current key's; it repairs nothing the old key signed, and a fleet roster naming the machine needs the new key.

Changed

• An attestation says where a release's signature was verified. Signatures are checked when a release is staged, and no statement said so, not even the update that did the checking. An update's statement now sets signature_verified and key_id, and every later statement about that release carries signature_verified_when_staged, naming the operation that verified it. The predicate type is now …/attestation/v2, validated by schemas/morzer-attestation-v2.json; v1 statements are still read. The installation schema moves to 13, so an older manager refuses the installation rather than rewriting the release record without the check.
• doctor says when a machine's attestations can never leave it. An installation with no backup target keeps what it writes on the machine, and doctor said nothing about it. It now reports how many statements are on the machine and that no target is configured to push them, as information shown by doctor --verbose and in --json rather than as a warning, since nothing records whether a machine is air-gapped on purpose. The check's description now reads "attestations have left this machine", or, with no target, "attestations: no backup target to push them to".

Fixed

• A rollback keeps where the release it returns to came from. The release record a rollback writes left out its source, so update --check on that machine afterwards had no reference to ask and needed one typed. The source the release was installed from is now carried back with it.
• A task's output no longer carries Compose's progress for the services it starts. task run printed lines such as Container erp-postgres-1 Healthy with the task's own stderr, and a failed migration service could quote them, because docker compose run writes them to the same stream. One-shot runs now set COMPOSE_PROGRESS=quiet, which Compose reads from 2.36; an older Compose ignores it and prints them as before.

Security

• A password in a bundle URL no longer reaches the journal or a support bundle. morzer update https://user:token@host/… recorded the reference as typed, so the token sat in the operation journal and travelled in any support bundle sent to a vendor. The journal now keeps the URL without its password, and a support bundle strips URL credentials from every journal record, including ones written before this release. Rotate a token that was used this way.

Installing this release

curl -fsSL https://morzecrew.github.io/morzer/install.sh | sh -s -- --version 0.9.0

The script verifies the checksum always and the signature whenever
minisign is present; --require-signature makes a missing minisign fatal,
which is what a production runbook sets. --print-only shows everything it
detected and would do, and changes nothing. install.sh is an asset of this
release and is covered by SHA256SUMS below.

Verifying this release by hand

ARCHIVE=morzer_0.9.0_linux_amd64.tar.zst   # the one you downloaded

curl -fsSLO https://raw.githubusercontent.com/morzecrew/morzer/main/morzer.pub
minisign -Vm SHA256SUMS -p morzer.pub
grep " ${ARCHIVE}$" SHA256SUMS | sha256sum -c -

SHA256SUMS covers every architecture, so checking it whole fails on the
archives you did not download — and --ignore-missing, the usual way
around that, reports OK when no archive is present at all. Pulling out
the line for the file you have fails when there is nothing to check.

The signing key is the same for every release. If you have verified a
morzer release before, use the copy you already have rather than fetching
it again — a key that changes between releases is the thing worth noticing.

Release bundles are a separate artifact with their own signature and their
own key; see
https://morzecrew.github.io/morzer/reference/release-commands/#verification