NockLock v0.16.0

v0.16.0 adds a standalone Linux installer that authenticates and activates the CLI and its matching filesystem interposer together, with explicit-tag upgrades and verified rollback. Its initial target is Ubuntu 24.04 amd64 with glibc 2.39. Python and Go are not installation dependencies.

Availability: the six signed Linux installer assets are now published after successful fresh-host, signed cross-version and broader-network acceptance. Prefer v0.16.1 for new installations: it includes macOS SecurityServer isolation and Linux ancestor-metadata compatibility. v0.16.0 remains the verified managed rollback target. These are the original signed artifacts from production run 40457208975, without rebuilding or replacing released bytes.

Upgrade notes: v0.16.0 is the first version eligible for managed release assets; there is no earlier managed release to upgrade from or roll back to, and v0.15.0 cannot be a managed rollback target. Migration from source or candidate installations is not supported by this installer. Use a fresh supported host for managed installation, or keep an existing source installation on the source-install workflow. For subsequent managed upgrades, stop running NockLock commands, authenticate the new release's installer and install its explicit tag. Optional kernel-egress access still needs host prerequisites and an explicit --egress-user grant. Rollback rechecks an already-installed release and never rewrites project config or audit state. Existing source-install and macOS workflows are unchanged; this release does not broaden Linux platform support or remove the documented Unix-socket limitation below Landlock ABI 9.

Added

• A standalone Go Linux installer for signed Ubuntu 24.04 amd64 release pairs, with explicit-tag upgrades and verified rollback. It authenticates root-staged assets with the pinned Cosign verifier, rejects unmanaged installations, retains prior releases, and atomically activates the CLI with its matching interposer. Optional --egress-user installs a generated constrained helper and validated sudoers grant. Managed CLI invocations hold a shared installation lock, so changes refuse while commands run and stale executable launches refuse after a switch. A tagged workflow builds and signs assets and checks installation on a fresh VM; publication remains an explicit release-owner step. This does not add assets to existing releases or broaden the Linux platform support matrix. See packaging/linux/RELEASE-INSTALL.md.

Fixed

• Linux installer staging reports writable-file close failures. Archive refusal tests check the intended rejection reason, and bootstrap instructions set the retained directory explicitly and clean unauthenticated staging on failure and HUP/INT/TERM.

Release source commit: 4b1b09f94ec91515d56a16ba76f35b964804faaa (promotion #282).

Release verification

• Main push CI passed. Back-sync merge 48be5373208b1076905dadf724616921b2a1e08e includes main as an ancestor and has an identical tree; back-sync CI passed. The release freeze is complete.
• Production tagged Linux build and fresh-VM acceptance passed. Both manifests verified against the exact v0.16.0 workflow identity, all hashes matched, and build-info names the release commit. Receipts show authentic signed audits plus filesystem allow/deny results in CONFINED and KERNEL modes. Doctor exit 3 is the documented below-ABI-9 Unix-socket limitation.
• Homebrew tap commit 7e1a6e09fbe5c36defc7ce0ea515646baa8debb6 updates NockLock to v0.16.0. Fresh macOS installs, brew tests, version, doctor/verify/wrap and closed signed SEATBELT audit smoke passed.
• Two independent source-tarball downloads matched SHA-256 dfa3fef9cf47b6992c3ecfbe7f03b2aed89e5afc794cfccc4e3eaf48793b0f80.
• Release evidence records commits, runs, hashes and acceptance summaries. This original source-release handoff is retained unchanged; the supplemental acceptance evidence below records the completed Linux publication gates.

Linux installer publication acceptance

The signed cross-version and network run passed for v0.16.0 and v0.16.1. It verified upgrade, repeat installation, normal downgrade refusal, explicit rollback, re-upgrade, stale-executable refusal, unchanged config/audit state and retained release bytes, and an AUTHENTIC closed audit after rollback. Both versions passed allowed and denied HTTP/HTTPS plus direct TCP/UDP probes on Ubuntu 24.04 amd64 and macOS 15.7.9 arm64. Linux required reachable unfenced controls, packet-drop counters at the unchanged default-drop policy and startup refusal after helper failure; macOS required denial errnos. No applicable acceptance job was skipped.

Support is Ubuntu 24.04 amd64 with glibc 2.39. Source/candidate installations cannot migrate through this installer. Linux CONFINED Unix-socket isolation remains unavailable below Landlock ABI 9; fresh-install doctor exit 3 was only that named limitation. AUTHENTIC verifies recorded audit integrity, not complete denial coverage. Python and Go are test/build tools, not installation dependencies.

Acceptance summary and asset hashes · Raw receipts, audit outputs and network observations · Authenticated installation guide. The guide’s publication prerequisites are now satisfied.