v0.1.11

Installing

curl -fsSL https://hostseal.io/apt/hostseal-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/hostseal-archive-keyring.gpg > /dev/null
curl -fsSL https://hostseal.io/apt/hostseal.sources \
  | sudo tee /etc/apt/sources.list.d/hostseal.sources > /dev/null
sudo apt-get update && sudo apt-get install hostseal-agent

The agent installs with no keys in /etc/hostseal/trusted-signers and a policy that permits
security updates and nothing else. It will report on the host and keep it patched, and will
do nothing else until you say otherwise.

Windows Server

hostseal-agent-windows-amd64.zip is attached. Unpack it on the host and run
Install-HostSealAgent.ps1 from an elevated session; docs/INSTALL.md has the commands in
full, and Fleet -> Add a host prints them with this control plane's own address filled
in. There is no repository to subscribe to, so an upgrade is the same archive over the same
installer, which keeps policy.toml and trusted-signers as they are.

A Windows host is read-only: inventory, services, pending updates and reboot state. It
applies no updates and reboots nothing, by design rather than by omission -- see
docs/SECURITY.md section 12.

The operator's CLI

hostseal is the tool an operator runs on their own machine: it signs destructive jobs
and bootstrap templates with a key the control plane does not hold, and hostseal signer
answers the web interface over loopback so a YubiKey can be used from the browser.

hostseal-linux-amd64, hostseal-linux-arm64 and hostseal-windows-amd64.zip are
attached. It is not a service and installs nothing; hostseal signer --install registers it
to start at your next logon, in your own session, and --uninstall removes that again.
docs/INSTALL.md has the details.

The agent .deb and the Windows agent archive carry the same binary, because hostseal enroll runs on the host being enrolled. Installing either of those on a workstation in
order to get the CLI is the wrong way round -- it puts an agent on it.

Verifying the build

The binaries are built with -trimpath and a pinned SOURCE_DATE_EPOCH, so rebuilding this
tag reproduces them byte for byte. SHA256SUMS is attached.

apt-repository.tar.gz is the signed repository exactly as published. The pages workflow
unpacks it under /apt; it is attached so that the published tree can be verified against
this release rather than taken on trust.

What's Changed

• Mint template tokens from the fleet page, list tokens, and sign a template from a terminal by @pascalgross in #107

Full Changelog: v0.1.10...v0.1.11

v0.1.10

Installing

curl -fsSL https://hostseal.io/apt/hostseal-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/hostseal-archive-keyring.gpg > /dev/null
curl -fsSL https://hostseal.io/apt/hostseal.sources \
  | sudo tee /etc/apt/sources.list.d/hostseal.sources > /dev/null
sudo apt-get update && sudo apt-get install hostseal-agent

The agent installs with no keys in /etc/hostseal/trusted-signers and a policy that permits
security updates and nothing else. It will report on the host and keep it patched, and will
do nothing else until you say otherwise.

Windows Server

hostseal-agent-windows-amd64.zip is attached. Unpack it on the host and run
Install-HostSealAgent.ps1 from an elevated session; docs/INSTALL.md has the commands in
full, and Fleet -> Add a host prints them with this control plane's own address filled
in. There is no repository to subscribe to, so an upgrade is the same archive over the same
installer, which keeps policy.toml and trusted-signers as they are.

A Windows host is read-only: inventory, services, pending updates and reboot state. It
applies no updates and reboots nothing, by design rather than by omission -- see
docs/SECURITY.md section 12.

The operator's CLI

hostseal is the tool an operator runs on their own machine: it signs destructive jobs
and bootstrap templates with a key the control plane does not hold, and hostseal signer
answers the web interface over loopback so a YubiKey can be used from the browser.

hostseal-linux-amd64, hostseal-linux-arm64 and hostseal-windows-amd64.zip are
attached. It is not a service and installs nothing; hostseal signer --install registers it
to start at your next logon, in your own session, and --uninstall removes that again.
docs/INSTALL.md has the details.

The agent .deb and the Windows agent archive carry the same binary, because hostseal enroll runs on the host being enrolled. Installing either of those on a workstation in
order to get the CLI is the wrong way round -- it puts an agent on it.

Verifying the build

The binaries are built with -trimpath and a pinned SOURCE_DATE_EPOCH, so rebuilding this
tag reproduces them byte for byte. SHA256SUMS is attached.

apt-repository.tar.gz is the signed repository exactly as published. The pages workflow
unpacks it under /apt; it is attached so that the published tree can be verified against
this release rather than taken on trust.

What's Changed

• Fix sign-in rate limit by moving it to a dedicated router by @pascalgross in #105
• Publish the operator's CLI, and let the signer start at logon by @pascalgross in #106

Full Changelog: v0.1.9...v0.1.10

v0.1.9

Installing

curl -fsSL https://hostseal.io/apt/hostseal-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/hostseal-archive-keyring.gpg > /dev/null
curl -fsSL https://hostseal.io/apt/hostseal.sources \
  | sudo tee /etc/apt/sources.list.d/hostseal.sources > /dev/null
sudo apt-get update && sudo apt-get install hostseal-agent

The agent installs with no keys in /etc/hostseal/trusted-signers and a policy that permits
security updates and nothing else. It will report on the host and keep it patched, and will
do nothing else until you say otherwise.

Windows Server

hostseal-agent-windows-amd64.zip is attached. Unpack it on the host and run
Install-HostSealAgent.ps1 from an elevated session; docs/INSTALL.md has the commands in
full, and Fleet -> Add a host prints them with this control plane's own address filled
in. There is no repository to subscribe to, so an upgrade is the same archive over the same
installer, which keeps policy.toml and trusted-signers as they are.

A Windows host is read-only: inventory, services, pending updates and reboot state. It
applies no updates and reboots nothing, by design rather than by omission -- see
docs/SECURITY.md section 12.

Verifying the build

The binaries are built with -trimpath and a pinned SOURCE_DATE_EPOCH, so rebuilding this
tag reproduces them byte for byte. SHA256SUMS is attached.

apt-repository.tar.gz is the signed repository exactly as published. The pages workflow
unpacks it under /apt; it is attached so that the published tree can be verified against
this release rather than taken on trust.

What's Changed

• Publish the Windows agent, and say how to install it by @pascalgross in #101
• Stop the layout cropping icons, and give each page one content edge by @pascalgross in #102
• Add template archival: retire names without deleting versions by @pascalgross in #103
• Sign from the browser with a YubiKey, on Windows as well as Linux by @pascalgross in #104

Full Changelog: v0.1.8...v0.1.9

v0.1.8

Installing

curl -fsSL https://hostseal.io/apt/hostseal-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/hostseal-archive-keyring.gpg > /dev/null
curl -fsSL https://hostseal.io/apt/hostseal.sources \
  | sudo tee /etc/apt/sources.list.d/hostseal.sources > /dev/null
sudo apt-get update && sudo apt-get install hostseal-agent

The agent installs with no keys in /etc/hostseal/trusted-signers and a policy that permits
security updates and nothing else. It will report on the host and keep it patched, and will
do nothing else until you say otherwise.

Verifying the build

The binaries are built with -trimpath and a pinned SOURCE_DATE_EPOCH, so rebuilding this
tag reproduces them byte for byte. SHA256SUMS is attached.

apt-repository.tar.gz is the signed repository exactly as published. The pages workflow
unpacks it under /apt; it is attached so that the published tree can be verified against
this release rather than taken on trust.

What's Changed

• Say who holds the rights, and stop claiming a trademark that is not registered by @pascalgross in #78
• A Windows agent that reads, and cannot be asked to do anything else by @pascalgross in #82
• Rename the project to HostSeal, and press a seal where the shoe was by @pascalgross in #85
• Take the four Dependabot updates by hand, and fix what made them unmergeable by @pascalgross in #88
• Take this week's three Dependabot updates by hand, one of which was broken by @pascalgross in #92
• Report capacity and load, and let a host be found by its MAC address by @pascalgross in #98
• Say so when the published APT repository predates the rename by @pascalgross in #100
• Give a fleet a host limit and a suspension switch by @pascalgross in #93

Full Changelog: v0.1.7...v0.1.8

v0.1.7

Installing

curl -fsSL https://farrier.tools/apt/farrier-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/farrier-archive-keyring.gpg > /dev/null
curl -fsSL https://farrier.tools/apt/farrier.sources \
  | sudo tee /etc/apt/sources.list.d/farrier.sources > /dev/null
sudo apt-get update && sudo apt-get install farrier-agent

The agent installs with no keys in /etc/farrier/trusted-signers and a policy that permits
security updates and nothing else. It will report on the host and keep it patched, and will
do nothing else until you say otherwise.

Verifying the build

The binaries are built with -trimpath and a pinned SOURCE_DATE_EPOCH, so rebuilding this
tag reproduces them byte for byte. SHA256SUMS is attached.

apt-repository.tar.gz is the signed repository exactly as published. The pages workflow
unpacks it under /apt; it is attached so that the published tree can be verified against
this release rather than taken on trust.

What's Changed

• A screen for the room, and the link that puts it on a wall by @pascalgross in #77

Full Changelog: v0.1.6...v0.1.7

v0.1.6

Installing

curl -fsSL https://farrier.tools/apt/farrier-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/farrier-archive-keyring.gpg > /dev/null
curl -fsSL https://farrier.tools/apt/farrier.sources \
  | sudo tee /etc/apt/sources.list.d/farrier.sources > /dev/null
sudo apt-get update && sudo apt-get install farrier-agent

The agent installs with no keys in /etc/farrier/trusted-signers and a policy that permits
security updates and nothing else. It will report on the host and keep it patched, and will
do nothing else until you say otherwise.

Verifying the build

The binaries are built with -trimpath and a pinned SOURCE_DATE_EPOCH, so rebuilding this
tag reproduces them byte for byte. SHA256SUMS is attached.

apt-repository.tar.gz is the signed repository exactly as published. The pages workflow
unpacks it under /apt; it is attached so that the published tree can be verified against
this release rather than taken on trust.

What's Changed

• Make enrolment work as documented: the CA, the ownership, and a way back by @pascalgross in #75

Full Changelog: v0.1.5...v0.1.6

v0.1.5

Installing

curl -fsSL https://farrier.tools/apt/farrier-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/farrier-archive-keyring.gpg > /dev/null
curl -fsSL https://farrier.tools/apt/farrier.sources \
  | sudo tee /etc/apt/sources.list.d/farrier.sources > /dev/null
sudo apt-get update && sudo apt-get install farrier-agent

The agent installs with no keys in /etc/farrier/trusted-signers and a policy that permits
security updates and nothing else. It will report on the host and keep it patched, and will
do nothing else until you say otherwise.

Verifying the build

The binaries are built with -trimpath and a pinned SOURCE_DATE_EPOCH, so rebuilding this
tag reproduces them byte for byte. SHA256SUMS is attached.

apt-repository.tar.gz is the signed repository exactly as published. The pages workflow
unpacks it under /apt; it is attached so that the published tree can be verified against
this release rather than taken on trust.

What's Changed

• Close the twenty-eight open issues: the audit findings, the CSS regressions, and the two missing screens by @pascalgross in #74

Full Changelog: v0.1.4...v0.1.5

v0.1.4

Installing

curl -fsSL https://farrier.tools/apt/farrier-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/farrier-archive-keyring.gpg > /dev/null
curl -fsSL https://farrier.tools/apt/farrier.sources \
  | sudo tee /etc/apt/sources.list.d/farrier.sources > /dev/null
sudo apt-get update && sudo apt-get install farrier-agent

The agent installs with no keys in /etc/farrier/trusted-signers and a policy that permits
security updates and nothing else. It will report on the host and keep it patched, and will
do nothing else until you say otherwise.

Verifying the build

The binaries are built with -trimpath and a pinned SOURCE_DATE_EPOCH, so rebuilding this
tag reproduces them byte for byte. SHA256SUMS is attached.

apt-repository.tar.gz is the signed repository exactly as published. The pages workflow
unpacks it under /apt; it is attached so that the published tree can be verified against
this release rather than taken on trust.

What's Changed

• Issue private server certificate for the agent hostname by @pascalgross in #71

Full Changelog: v0.1.3...v0.1.4

v0.1.3

Installing

curl -fsSL https://farrier.tools/apt/farrier-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/farrier-archive-keyring.gpg > /dev/null
curl -fsSL https://farrier.tools/apt/farrier.sources \
  | sudo tee /etc/apt/sources.list.d/farrier.sources > /dev/null
sudo apt-get update && sudo apt-get install farrier-agent

The agent installs with no keys in /etc/farrier/trusted-signers and a policy that permits
security updates and nothing else. It will report on the host and keep it patched, and will
do nothing else until you say otherwise.

Verifying the build

The binaries are built with -trimpath and a pinned SOURCE_DATE_EPOCH, so rebuilding this
tag reproduces them byte for byte. SHA256SUMS is attached.

apt-repository.tar.gz is the signed repository exactly as published. The pages workflow
unpacks it under /apt; it is attached so that the published tree can be verified against
this release rather than taken on trust.

What's Changed

• Add an independent security audit of the guarantee and its enforcement by @pascalgross in #64
• Operators are people, the shared token is gone, and the four ways the CSS was lying by @pascalgross in #70

Full Changelog: v0.1.2...v0.1.3

v0.1.2

Installing

curl -fsSL https://farrier.tools/apt/farrier-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/farrier-archive-keyring.gpg > /dev/null
curl -fsSL https://farrier.tools/apt/farrier.sources \
  | sudo tee /etc/apt/sources.list.d/farrier.sources > /dev/null
sudo apt-get update && sudo apt-get install farrier-agent

The agent installs with no keys in /etc/farrier/trusted-signers and a policy that permits
security updates and nothing else. It will report on the host and keep it patched, and will
do nothing else until you say otherwise.

Verifying the build

The binaries are built with -trimpath and a pinned SOURCE_DATE_EPOCH, so rebuilding this
tag reproduces them byte for byte. SHA256SUMS is attached.

apt-repository.tar.gz is the signed repository exactly as published. The pages workflow
unpacks it under /apt; it is attached so that the published tree can be verified against
this release rather than taken on trust.

What's Changed

• A cloud-init baseline, where signing keys come from, and a mark of our own by @pascalgross in #42

Full Changelog: v0.1.1...v0.1.2