v0.3.0-rc.9

Changelog

• 7dd1fad: feat(web): the console on @openlinkos/ui 0.7.0 with the Beacon brand; the docs site on the theme 0.7.0; README header image; v0.3.0-rc.9 (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/beacon:v0.3.0-rc.9 \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/beacon:v0.3.0-rc.9 -R openlinkos/beacon

v0.3.0-rc.8

Changelog

• 2f91779: fix(serve): take SIGHUP from the first instant, so a reload during start-up does not end the service; v0.3.0-rc.8 (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/beacon:v0.3.0-rc.8 \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/beacon:v0.3.0-rc.8 -R openlinkos/beacon

v0.3.0-rc.7

Changelog

• 146c0fc: Merge the console (Beacon's web workbench on the family design system), with token revocation over REST and MCP; v0.3.0-rc.7 (@best)
• b8f1a25: Merge the docs site (beacon.openlinkos.com) and the open-source scaffolding (@best)
• ed2d747: build(site): the site image, nginx-unprivileged on port 8080 (@best)
• f20e68d: build(web): vendor @openlinkos/ui 0.6.1, refreshed by scripts/update-ui.sh (@best)
• 4d7d137: feat(agents): heartbeats name their machine, the evidence looks back before the alert, the resolved call waits (@best)
• d2ae2bc: feat(web): an alert's timeline says in words when a shell ran a command and a heartbeat last succeeded (@best)
• 9b6fc6d: feat(web): the console, Beacon's own workbench on the design system (@best)
• 07d3479: fix(web): a sign-in's next refuses spaces and control characters (@best)
• b992b8a: fix(web): the provisional Beacon accent and mark as the design system's source draws them (@best)
• 43abdd3: fix(web): the silence buttons say what they do, and titles end as Origin's (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/beacon:v0.3.0-rc.7 \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/beacon:v0.3.0-rc.7 -R openlinkos/beacon

v0.3.0-rc.6

Changelog

• fd59d83: fix(store): tokens are 56 characters again; v0.3.0-rc.6 (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/beacon:v0.3.0-rc.6 \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/beacon:v0.3.0-rc.6 -R openlinkos/beacon

v0.3.0-rc.5

Changelog

• 0a718f8: feat(store): tokens are 32 characters (17 random bytes), so bot platforms' secret fields keep them whole; v0.3.0-rc.5 (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/beacon:v0.3.0-rc.5 \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/beacon:v0.3.0-rc.5 -R openlinkos/beacon

v0.3.0-rc.4

Changelog

• dfb60f8: feat(agents): webhook hooks take headers_file for receivers that check a secret of their own; v0.3.0-rc.4 (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/beacon:v0.3.0-rc.4 \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/beacon:v0.3.0-rc.4 -R openlinkos/beacon

v0.3.0-rc.3

Changelog

• 6d3f51a: Merge machines behind NAT (the connector) with tokens that renew themselves and safe configuration (@best)
• f320610: Merge people's pages (alert and session pages, signed links, replay) with the other tracks (@best)
• 3bababf: Merge probing on demand (probe_now) with the agent on call, the connector, token renewal and safe configuration (@best)
• df447c6: Merge the agent on call (linkos-oncall) with the connector, token renewal and safe configuration (@best)
• bf3b5b5: Merge the reference deployment, install guide, contributing and security policy, and the silence CLI (@best)
• acf20ab: feat(cli): silence create, list and expire through the admin socket (@best)
• 8238142: feat(config): if_version on changes, and a per-token limit on change events (@best)
• 6a71a28: feat(deploy): reference deployment with Compose, generic rules, runbooks and installers (@best)
• 37df336: feat(oncall): linkos-oncall, the reference harness that runs an agent when Beacon wakes it (@best)
• b70cd62: feat(probe): module files are read from the secrets directory only (@best)
• 5848da5: feat(probe-now): probing on demand, from the API and MCP to every location (@best)
• 53c71e1: feat(sshgate): machines behind NAT connect out to the channel with ssh -R (@best)
• df8d308: feat(tokens): tokens renew themselves, and whoami (@best)
• 47652a3: feat(web): people's pages: the alert's timeline and each session's replay, opened by signed links (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/beacon:v0.3.0-rc.3 \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/beacon:v0.3.0-rc.3 -R openlinkos/beacon

v0.3.0-rc.15

Changelog

• 8b89971: Merge people's accounts, their agents and MCP OAuth into the rewritten guides (@best)
• 764dcdf: feat: people's accounts, their agents, and MCP OAuth (@best)
• 199162f: fix: SSH refusals speak of the agent, not the token; the token sign-in suggests an agent; v0.3.0-rc.15 (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/beacon:v0.3.0-rc.15 \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/beacon:v0.3.0-rc.15 -R openlinkos/beacon

v0.3.0-rc.14

Changelog

• bd00111: fix(deploy): install the current release, restart Beacon when its configuration changed; docs: goals reflect built-in accounts, no hard-coded release in the install guide (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/beacon:v0.3.0-rc.14 \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/beacon:v0.3.0-rc.14 -R openlinkos/beacon

v0.3.0-rc.13

Changelog

• ec8b1ea: Merge branch 'worktree-agent-a91f0b9e818bf9607' (@best)
• 77c85ae: Merge the public root, the console under /console, and links to the project; v0.3.0-rc.13 (@best)
• eaa2f82: feat(web): the root is public, the console moves to /console, Beacon says it is open source (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/beacon:v0.3.0-rc.13 \
  --certificate-identity-regexp '^https://github.com/openlinkos/beacon/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/beacon:v0.3.0-rc.13 -R openlinkos/beacon