v0.1.0

First release of hookgate, a webhook gateway that verifies each request against its sender's token or HMAC signature and forwards only authentic requests, byte for byte, to any HTTP upstream.

• Verification per source: static tokens and HMAC-SHA1/256/512 over the raw body, hex, base64 or base64url, with prefixes, multi-signature headers and overlapping secrets for rotation. Every check of a source must pass.
• Fails closed: a missing secret takes only its own source offline (503); unknown configuration keys stop startup; query strings and compressed bodies are refused unless allowed.
• Forwarding: the verified bytes plus an allowlist of headers and the upstream's own credentials; retries on transport errors and 5xx, across every instance behind a name with resolve_all.
• Operations: /healthz, /readyz and Prometheus /metrics on a separate admin port, graceful drain on SIGTERM, JSON request logs without secrets or bodies, hookgate validate for CI.
• Distribution: static binaries for Linux and macOS (amd64, arm64) with checksums and SLSA build provenance, and a distroless multi-arch image on GHCR.

Container image: ghcr.io/mrrobertkent/hookgate:0.1.0

Digest: sha256:adcd5590c3547350c881223209c9e434e0ed5d16e5f998befca4430254318adc

Full Changelog: https://github.com/mrrobertkent/hookgate/commits/v0.1.0