v0.1.9

Installing

curl -fsSL https://hostseal.io/apt/hostseal-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/hostseal-archive-keyring.gpg > /dev/null
curl -fsSL https://hostseal.io/apt/hostseal.sources \
  | sudo tee /etc/apt/sources.list.d/hostseal.sources > /dev/null
sudo apt-get update && sudo apt-get install hostseal-agent

The agent installs with no keys in /etc/hostseal/trusted-signers and a policy that permits
security updates and nothing else. It will report on the host and keep it patched, and will
do nothing else until you say otherwise.

Windows Server

hostseal-agent-windows-amd64.zip is attached. Unpack it on the host and run
Install-HostSealAgent.ps1 from an elevated session; docs/INSTALL.md has the commands in
full, and Fleet -> Add a host prints them with this control plane's own address filled
in. There is no repository to subscribe to, so an upgrade is the same archive over the same
installer, which keeps policy.toml and trusted-signers as they are.

A Windows host is read-only: inventory, services, pending updates and reboot state. It
applies no updates and reboots nothing, by design rather than by omission -- see
docs/SECURITY.md section 12.

Verifying the build

The binaries are built with -trimpath and a pinned SOURCE_DATE_EPOCH, so rebuilding this
tag reproduces them byte for byte. SHA256SUMS is attached.

apt-repository.tar.gz is the signed repository exactly as published. The pages workflow
unpacks it under /apt; it is attached so that the published tree can be verified against
this release rather than taken on trust.

What's Changed

• Publish the Windows agent, and say how to install it by @pascalgross in #101
• Stop the layout cropping icons, and give each page one content edge by @pascalgross in #102
• Add template archival: retire names without deleting versions by @pascalgross in #103
• Sign from the browser with a YubiKey, on Windows as well as Linux by @pascalgross in #104

Full Changelog: v0.1.8...v0.1.9