v0.1.10

Installing

curl -fsSL https://hostseal.io/apt/hostseal-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/hostseal-archive-keyring.gpg > /dev/null
curl -fsSL https://hostseal.io/apt/hostseal.sources \
  | sudo tee /etc/apt/sources.list.d/hostseal.sources > /dev/null
sudo apt-get update && sudo apt-get install hostseal-agent

The agent installs with no keys in /etc/hostseal/trusted-signers and a policy that permits
security updates and nothing else. It will report on the host and keep it patched, and will
do nothing else until you say otherwise.

Windows Server

hostseal-agent-windows-amd64.zip is attached. Unpack it on the host and run
Install-HostSealAgent.ps1 from an elevated session; docs/INSTALL.md has the commands in
full, and Fleet -> Add a host prints them with this control plane's own address filled
in. There is no repository to subscribe to, so an upgrade is the same archive over the same
installer, which keeps policy.toml and trusted-signers as they are.

A Windows host is read-only: inventory, services, pending updates and reboot state. It
applies no updates and reboots nothing, by design rather than by omission -- see
docs/SECURITY.md section 12.

The operator's CLI

hostseal is the tool an operator runs on their own machine: it signs destructive jobs
and bootstrap templates with a key the control plane does not hold, and hostseal signer
answers the web interface over loopback so a YubiKey can be used from the browser.

hostseal-linux-amd64, hostseal-linux-arm64 and hostseal-windows-amd64.zip are
attached. It is not a service and installs nothing; hostseal signer --install registers it
to start at your next logon, in your own session, and --uninstall removes that again.
docs/INSTALL.md has the details.

The agent .deb and the Windows agent archive carry the same binary, because hostseal enroll runs on the host being enrolled. Installing either of those on a workstation in
order to get the CLI is the wrong way round -- it puts an agent on it.

Verifying the build

The binaries are built with -trimpath and a pinned SOURCE_DATE_EPOCH, so rebuilding this
tag reproduces them byte for byte. SHA256SUMS is attached.

apt-repository.tar.gz is the signed repository exactly as published. The pages workflow
unpacks it under /apt; it is attached so that the published tree can be verified against
this release rather than taken on trust.

What's Changed

• Fix sign-in rate limit by moving it to a dedicated router by @pascalgross in #105
• Publish the operator's CLI, and let the signer start at logon by @pascalgross in #106

Full Changelog: v0.1.9...v0.1.10