Skip to content

v0.3.0

Latest
Latest

Choose a tag to compare

View all tags
@prampec prampec released this 02 Oct 19:44
v0.3.0
4819e1d

TrustMate v0.3.0: AI-agent friendly

This release makes TrustMate easier to use from AI assistants and scripts. It adds an OpenAPI spec, llms.txt, structured errors, a dry-run issuance mode, a richer MCP server and a Claude Code plugin.

⚠️ Breaking changes

  • Error responses are now RFC 9457 application/problem+json. The old {"error": "..."} body is replaced by type, title, status and detail. Branch on type (urn:trustmate:problem:*) instead of matching message text. Some errors add fields that say how to fix the request: available_profiles, missing_fields, allowed_values and required_role. ACME routes keep their RFC 8555 error types.
  • A wrong Content-Type on POST /v1/ocsp and POST /v1/tsa now returns 415 instead of 400.
  • A SHA-1 timestamp request now returns urn:trustmate:problem:unsupported-timestamp-request instead of the generic invalid-request error.
  • Operator CLI exit codes changed. trustmate-admin and trustmate-management now exit with 1 (local or connection error), 2 (bad command line, including missing required flags, which used to exit 1), 3 (server rejected the request, 4xx) or 4 (server error, 5xx). For 3 and 4, stderr is the server's problem document as one JSON object instead of a prefixed message.

✨ New

API discovery (new discovery module, TRUSTMATE_ENABLE_DISCOVERY, on by default)

  • GET /v1/openapi.yaml: an OpenAPI 3.1 description of the whole REST API. Each operation lists the role it needs (x-required-role), and the spec includes the full error catalogue. A test keeps it in sync with the router.
  • GET /llms.txt: a summary of this instance for AI agents (llmstxt.org), listing its public PKI URLs and enabled modules. It leaves out profiles, clients and the server version.
  • A project-level llms.txt is now at the repository root.

Dry-run issuance

  • POST /v1/certificates?dry_run=true runs the same role, profile and CSR checks, then returns the subject, issuer, validity, key usages and AIA/OCSP/CRL URLs the certificate would have. Nothing is signed, stored or audited.
  • Also available as trustmate-management certificates issue --dry-run.

trustmate-mcp

  • New preview_certificate tool. It is read-only, so it's also available in --read-only mode.
  • Resources: trustmate://ca/root.pem, trustmate://ca/intermediate.pem, trustmate://profiles, trustmate://openapi.yaml and trustmate://certificates/{serial}.
  • Prompts: certificate-status, issue-certificate and revoke-certificate. The issue and revoke prompts preview or inspect first and ask the user to confirm. Only certificate-status is offered in read-only mode.
  • Errors now pass through the server's problem document, so the assistant can see what to fix.

Claude Code plugin

  • The repository is now a plugin marketplace. The trustmate plugin configures trustmate-mcp and adds a skill for TrustMate's workflows: choosing profiles, previewing before issuing, confirming destructive actions, handling keys, and reading errors. It starts in read-only mode. 
    claude plugin marketplace add prampec/trustmate
claude plugin install trustmate@trustmate
    Requires trustmate-mcp on your PATH; it's included in the release archives.

🔧 Upgrade notes

  • New unauthenticated routes are on by default. /v1/openapi.yaml and /llms.txt need no client certificate. They expose only what's already public in this repository, plus the instance's public base URL and which modules are enabled. Set TRUSTMATE_ENABLE_DISCOVERY=false to turn them off.
  • Update clients and scripts that read the old error format. Anything that reads .error from error responses, or checks the CLIs' exit status, needs updating. The bundled Bruno collection now checks res.body.type.
  • No database migrations and no configuration changes are required.

🔒 Security review

Certificate-template building was moved unchanged from pki.IssueLeaf into a new pki.LeafTemplate function, which IssueLeaf now calls. Key sizes, signature algorithms, serial generation and extension policy are unchanged. A dry-run preview never contains a serial or PEM, and the ephemeral key preview_certificate generates never leaves memory.

Full Changelog: v0.2.0...v0.3.0

Assets 8
Loading