v0.6.0

0.6.0 (2026-11-10)

Features

• keep and check the history of the kms key policy, and verify production on a schedule (#28) (0409dcb)

v0.5.0

0.5.0 (2026-11-10)

Features

• enclave logs through the host, a production interception test and two proposals (#25) (5449314)

v0.4.0

0.4.0 (2026-11-10)

Features

• keep the tls key sealed across restarts and verify certificates outside the enclave (#23) (541166e)

Bug Fixes

• deploy: no wildcard certificates for the domain (#22) (b7eb1b3)

v0.3.0

0.3.0 (2026-11-10)

Features

• accept mail only over tls, enforce mta-sts and verify the mail transport (#20) (76354c2)
• publish the kms key policy over the attested tls key and verify it (#19) (c810486)

v0.2.0

0.2.0 (2026-11-10)

Features

• f1 inbox, receive and store mail encrypted inside the enclave (#14) (60b1835)

Bug Fixes

• enclave: dial the nitro parent instance on vsock cid 3 (#16) (0f4d298)

v0.1.1

0.1.1 (2026-11-09)

Bug Fixes

• site: read the release tag from the first redirect (#10) (dd4dae1)

v0.1.0

0.1.0 (2026-11-09)

Features

• add the enclave service, host proxy and attestation verifier (88ca87a)
• deploy: add opentofu infrastructure and deploy scripts (674fad4)
• deploy: host the public site on amplify with opentofu (#4) (fd299fc)
• site: strict csp, structured data, real release measurement, content and axe tests, amplify config (9358f39)
• verifiable nitro enclave foundation, web app and public site (#1) (553c945)

Bug Fixes

• deploy: use us-east-2, the region the aws project allows (5055864)
• keep the embedded web dist placeholder tracked (7b44d56)
• nix: build go binaries with the official toolchain for cross-arch reproducibility (20ba254)
• nix: build the web app inside the nix sandbox and pin the arm64 hash (38d03fb)
• pin the conventional commits preset and check release notes in ci (#7) (4ecbea4)
• pin the go toolchain and the arm64 web dependency hash (df4cda7)
• site: wrap docs code blocks so no scroll region is unreachable by keyboard (#3) (805c67c)