v0.1.2

Token and HMAC secrets now have a minimum length, and hookgate gains a Docker Compose install.

Important

Token and HMAC secrets must be at least 16 bytes. A shorter secret, optional or not, takes its source offline exactly like a missing one: the source answers 503 and forwards nothing, hookgate_source_ready is 0, and hookgate validate exits 1 with an error naming the reference (env:NAME or file:PATH), never the value. Run hookgate validate against your configuration before upgrading, and replace short secrets with random ones such as openssl rand -hex 32. set_headers values are not affected.

• Docker Compose install: examples/compose runs the pinned image with a health check, a restart policy, a read-only filesystem, and the webhook and admin ports on loopback behind your reverse proxy.
• OpenTelemetry Collector example: its ClickHouse variant now uses ClickHouse 26.9.11.2.
• Quick start: uses a secret that meets the new minimum.

Container image: ghcr.io/mrrobertkent/hookgate:0.1.2

Digest: sha256:42a83e40387977d24a1f8e1ca8908cc9fec1a7fcf04fad2ace9ddf30185c976e

What's Changed

• examples: OpenTelemetry Collector with durable per-source queues by @mrrobertkent in #3
• README: light and dark header banner by @mrrobertkent in #4
• build(deps): bump clickhouse/clickhouse-server from 26.8.20.9 to 26.9.10.4 in /examples/otel-collector by @dependabot[bot] in #5
• Social preview: render for upload, stop committing the PNG by @mrrobertkent in #6
• README: drop the typed tagline under the banner by @mrrobertkent in #7
• examples: Docker Compose install by @mrrobertkent in #8
• ci: golangci-lint by @mrrobertkent in #12
• Scorecard workflow: least-privilege permissions by @mrrobertkent in #10
• Reject token and HMAC secrets shorter than 16 bytes by @mrrobertkent in #11
• SonarQube Cloud: CI-based analysis with Go coverage by @mrrobertkent in #13
• CodeRabbit: repository review configuration by @mrrobertkent in #9
• Socket: repository configuration by @mrrobertkent in #15
• build(deps): bump clickhouse/clickhouse-server from 26.9.10.4 to 26.9.11.2 in /examples/otel-collector by @dependabot[bot] in #14

Full Changelog: v0.1.1...v0.1.2

v0.1.1

Release signing. hookgate itself is unchanged from 0.1.0.

• checksums.txt is signed with cosign (checksums.txt.sigstore.json), and the image is signed by digest; both signatures are keyless and issued to the release workflow.
• The release workflow attaches the archives' SLSA build provenance as hookgate_0.1.1.intoto.jsonl.
• The README's "Verify a release" section lists the gh attestation verify and cosign verify commands.

Container image: ghcr.io/mrrobertkent/hookgate:0.1.1

Digest: sha256:e4169366c91182963595b759cafd74a9c7f8f03365121e3d4b97e834cbfed59e

What's Changed

• release: attach SLSA provenance and sign checksums and image by @mrrobertkent in #1
• Add social preview image by @mrrobertkent in #2

Full Changelog: v0.1.0...v0.1.1

v0.1.0

First release of hookgate, a webhook gateway that verifies each request against its sender's token or HMAC signature and forwards only authentic requests, byte for byte, to any HTTP upstream.

• Verification per source: static tokens and HMAC-SHA1/256/512 over the raw body, hex, base64 or base64url, with prefixes, multi-signature headers and overlapping secrets for rotation. Every check of a source must pass.
• Fails closed: a missing secret takes only its own source offline (503); unknown configuration keys stop startup; query strings and compressed bodies are refused unless allowed.
• Forwarding: the verified bytes plus an allowlist of headers and the upstream's own credentials; retries on transport errors and 5xx, across every instance behind a name with resolve_all.
• Operations: /healthz, /readyz and Prometheus /metrics on a separate admin port, graceful drain on SIGTERM, JSON request logs without secrets or bodies, hookgate validate for CI.
• Distribution: static binaries for Linux and macOS (amd64, arm64) with checksums and SLSA build provenance, and a distroless multi-arch image on GHCR.

Container image: ghcr.io/mrrobertkent/hookgate:0.1.0

Digest: sha256:adcd5590c3547350c881223209c9e434e0ed5d16e5f998befca4430254318adc

Full Changelog: https://github.com/mrrobertkent/hookgate/commits/v0.1.0