v0.4.38

Sidebar navigation: grouped, icons, badges, foldable (#80)

The top bar had 14 links plus the account and wrapped at common widths. Navigation now sits in a left sidebar.

• Groups: Dashboard; Fleet (Hosts, Sites, Plans, Drift); Security (Anomalies, News, Surface); Network (IP addresses, Offenders, Bans, Cloudflare); Admin (Users, AI assistants). Links are shown by role exactly as before. A group with nothing the viewer can open is left out, e.g. Admin for an org viewer.
• Search box at the top submits to /search. In the rail it becomes a search icon.
• Icons: inline stroke SVGs, like the host page's facts. No icon library.
• Badges: Hosts shows how many hosts have known-exploited or critical/high fixable findings. Anomalies shows open anomalies, in alarm colors when any is high.
  • Efficient: they're computed once per user per minute and reused across page views (nav.go). Counting hosts builds the same counts-only fleet report the hosts page uses, so it runs at most once a minute per user, whatever they click.
  • Acknowledging or suppressing an anomaly drops that user's cached counts, so its badge updates at once.
• Foldable: the « button folds the sidebar to a 60px icon rail with tooltips. The choice is remembered in this browser (localStorage) and applied before the page draws (theme.js), so there's no flash. Without JavaScript the sidebar stays open.
• Phones (≤900px): a top bar with the existing Menu button (a checkbox, no script) opens the sidebar as a drawer.
• The account and theme button sit at the sidebar's foot, with an icon for Sign out so it stays reachable in the rail.
• Signed-out pages (sign-in) keep the plain top bar.

Checked in the dev hub: dark, light and phone; the rail persisting across a reload; the drawer opening. Tests cover role-based visibility (TestNavPerm) and the cache being dropped; the nav assertions were updated to the new markup. make check passes.

What's Changed

• Host page: where the findings that need attention are; shorter site lists by @chrisreedio in #79
• Sidebar navigation: grouped, icons, badges, foldable by @chrisreedio in #80

Full Changelog: v0.4.37...v0.4.38

---

Verifying this release

Every file is listed in SHA256SUMS, which is signed with Sigstore (keyless, from this repository's release workflow).

# 1. Check the signature on the checksum list
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/realmwatch/heimdall/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Check the files you downloaded against it
sha256sum -c --ignore-missing SHA256SUMS

# Optional: verify build provenance
gh attestation verify heimdall-linux-amd64 --repo realmwatch/heimdall

Binaries are reproducible: make reproducible at this tag builds the same bytes.

v0.4.37

Host page: copyable fix commands, old-collector step only when needed (#78)

• Privileged access card: the command that turns on the privilege watch is now on its own line in a copyable code box, like the pending-updates commands, instead of inline in a sentence. The "(a collector before 0.4.23 needs a plain upgrade first)" aside showed on every host. Now it appears only when the host's reported collector version is older than 0.4.23. In that case the box holds both commands in order, so one copy and paste does it.
• Failed logins card: its --watch-logins command gets the same copyable box.
• New TestPreSources covers old, new, unknown and non-matching versions. The host page tests check the new boxes.

What's Changed

• CI: skip repeat runs on main, cancel superseded PR runs by @chrisreedio in #77
• Host page: copyable fix commands, old-collector step only when needed by @chrisreedio in #78

Full Changelog: v0.4.36...v0.4.37

---

Verifying this release

Every file is listed in SHA256SUMS, which is signed with Sigstore (keyless, from this repository's release workflow).

# 1. Check the signature on the checksum list
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/realmwatch/heimdall/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Check the files you downloaded against it
sha256sum -c --ignore-missing SHA256SUMS

# Optional: verify build provenance
gh attestation verify heimdall-linux-amd64 --repo realmwatch/heimdall

Binaries are reproducible: make reproducible at this tag builds the same bytes.

v0.4.36

Collector 0.4.36 (#76)

Bumps the collector to 0.4.36 for the release of #75.

What's Changed

• Host page: put the tailnet, privilege and login cards side by side by @chrisreedio in #75
• Collector 0.4.36 by @chrisreedio in #76

Full Changelog: v0.4.35...v0.4.36

---

Verifying this release

Every file is listed in SHA256SUMS, which is signed with Sigstore (keyless, from this repository's release workflow).

# 1. Check the signature on the checksum list
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/realmwatch/heimdall/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Check the files you downloaded against it
sha256sum -c --ignore-missing SHA256SUMS

# Optional: verify build provenance
gh attestation verify heimdall-linux-amd64 --repo realmwatch/heimdall

Binaries are reproducible: make reproducible at this tag builds the same bytes.

v0.4.35

Collector 0.4.35 (#74)

Bumps the collector to 0.4.35 for the release of #71, #72 and #73. It also puts a bare loopback URL in getting-started.md in backticks, so the docs site's link checker accepts it.

What's Changed

• Don't count deploy-service sessions as privileged access by @chrisreedio in #71
• Cloudflare web offenders: per-IP blocked and challenged events by @chrisreedio in #72
• Threat list API: attacker addresses over REST and MCP by @chrisreedio in #73
• Collector 0.4.35 by @chrisreedio in #74

Full Changelog: v0.4.34...v0.4.35

---

Verifying this release

Every file is listed in SHA256SUMS, which is signed with Sigstore (keyless, from this repository's release workflow).

# 1. Check the signature on the checksum list
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/realmwatch/heimdall/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Check the files you downloaded against it
sha256sum -c --ignore-missing SHA256SUMS

# Optional: verify build provenance
gh attestation verify heimdall-linux-amd64 --repo realmwatch/heimdall

Binaries are reproducible: make reproducible at this tag builds the same bytes.

v0.4.34

Collector 0.4.34 (#70)

Collector 0.4.34. Fixes false flags on the surface map (#69).

• CNAME takeover flags. A target with no addresses but other records (DKIM keys at Amazon SES, SendGrid or Microsoft 365, which hold only TXT records) is no longer counted as missing. A missing target is a takeover (high) only when it's on a hosting service anyone can claim a name on, or when its domain isn't registered. Otherwise it gets the new dead-cname (info) flag.
• Dangling flags. Cloudflare's placeholder addresses for names with no server behind them (192.0.2.x, 100::, used by redirect rules and Workers) no longer count as dangling.
• Migration 0027 clears the cached CNAME answers. The next zone sync refills them, or run sudo heimdall cloudflare sync to do it now.

Upgrade the hub first (sudo heimdall upgrade), then the collectors (sudo heimdall-collect upgrade).

What's Changed

• Surface map: fewer false takeover and dangling flags by @chrisreedio in #69
• Collector 0.4.34 by @chrisreedio in #70

Full Changelog: v0.4.33...v0.4.34

---

Verifying this release

Every file is listed in SHA256SUMS, which is signed with Sigstore (keyless, from this repository's release workflow).

# 1. Check the signature on the checksum list
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/realmwatch/heimdall/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Check the files you downloaded against it
sha256sum -c --ignore-missing SHA256SUMS

# Optional: verify build provenance
gh attestation verify heimdall-linux-amd64 --repo realmwatch/heimdall

Binaries are reproducible: make reproducible at this tag builds the same bytes.

v0.4.33

Collector 0.4.33 (#68)

Collector 0.4.33. Releases must now pass their signature check to install (#67).

Every installer and upgrade checks the Sigstore signature on SHA256SUMS before installing anything: install-hub.sh, install.sh, install-windows.ps1, heimdall upgrade and heimdall-collect upgrade. Before, that check was skipped whenever cosign wasn't installed. The check uses a pinned cosign build, fetched once (about 140 MB) into /usr/local/lib/heimdall (C:\ProgramData\Heimdall on Windows) and checked against its pinned hash every time it's used. Hosts need outbound HTTPS to GitHub and to tuf-repo-cdn.sigstore.dev.

--skip-signature-check (-SkipSignatureCheck on Windows) installs with checksums only, for hosts where cosign can't run, and warns every time. On Windows, download SHA256SUMS.sigstore.json next to SHA256SUMS too. See the new "Release signatures" section in docs/deployment.md.

Upgrade the hub first (sudo heimdall upgrade), then the collectors (sudo heimdall-collect upgrade).

What's Changed

• Require a valid release signature to install or upgrade by @chrisreedio in #67
• Collector 0.4.33 by @chrisreedio in #68

Full Changelog: v0.4.32...v0.4.33

---

Verifying this release

Every file is listed in SHA256SUMS, which is signed with Sigstore (keyless, from this repository's release workflow).

# 1. Check the signature on the checksum list
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/realmwatch/heimdall/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Check the files you downloaded against it
sha256sum -c --ignore-missing SHA256SUMS

# Optional: verify build provenance
gh attestation verify heimdall-linux-amd64 --repo realmwatch/heimdall

Binaries are reproducible: make reproducible at this tag builds the same bytes.

v0.4.32

Collector 0.4.32 (#66)

Collector 0.4.32. This is the first release built from the repo's new home, realmwatch/heimdall.

• Installers, upgrades and the update check now fetch from github.com/realmwatch/heimdall. GitHub redirects the old URLs, so existing installs keep working.
• The Go module path is now github.com/realmwatch/heimdall.
• To check provenance, run gh attestation verify <file> --repo realmwatch/heimdall.

Upgrade the hub first, then the collectors (sudo heimdall-collect upgrade). On a hub running v0.4.31 or older, name the version: sudo heimdall upgrade --version v0.4.32. Older hubs only trust releases from the old repo name, so a plain heimdall upgrade reports "no usable latest release" and the hub's update banner won't offer this release. Later upgrades work as usual.

What's Changed

• Move to realmwatch/heimdall by @chrisreedio in #65
• Collector 0.4.32 by @chrisreedio in #66

Full Changelog: v0.4.31...v0.4.32

---

Verifying this release

Every file is listed in SHA256SUMS, which is signed with Sigstore (keyless, from this repository's release workflow).

# 1. Check the signature on the checksum list
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/realmwatch/heimdall/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Check the files you downloaded against it
sha256sum -c --ignore-missing SHA256SUMS

# Optional: verify build provenance
gh attestation verify heimdall-linux-amd64 --repo realmwatch/heimdall

Binaries are reproducible: make reproducible at this tag builds the same bytes.

v0.4.31

Collector 0.4.31 (#64)

Preparation for moving the repo to a GitHub organization, and one fix.

Changed

• Installers accept release signatures from realmwatch/heimdall as well as chrisreedio/heimdall (#63). The repo will move to the realmwatch organization. Upgrades always run the new release's own scripts, so they are unaffected either way. This covers running this release's install.sh or install-hub.sh with --version pointed at a release built in the new repo.

Fixed

• sudo heimdall notify send (#62) can read a stored webhook URL again. Every CLI command is now tested to run as the right user under sudo, and an installed hub and collector are smoke-tested in CI on each change.

Upgrading

• Hub: sudo heimdall upgrade.
• Servers: then sudo heimdall-collect upgrade on each.

Collector 0.4.31.

What's Changed

• CI: smoke-test an installed hub and collector; guard sudo for every command by @chrisreedio in #62
• Installers: accept release signatures from realmwatch/heimdall too by @chrisreedio in #63
• Collector 0.4.31 by @chrisreedio in #64

Full Changelog: v0.4.30...v0.4.31

---

Verifying this release

Every file is listed in SHA256SUMS, which is signed with Sigstore (keyless, from this repository's release workflow).

# 1. Check the signature on the checksum list
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/chrisreedio/heimdall/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Check the files you downloaded against it
sha256sum -c --ignore-missing SHA256SUMS

# Optional: verify build provenance
gh attestation verify heimdall-linux-amd64 --repo chrisreedio/heimdall

Binaries are reproducible: make reproducible at this tag builds the same bytes.

v0.4.30

Collector 0.4.30 (#61)

Fixes the login watch on servers with no failed logins yet.

Fixed

• Login watch (#60). On a server with no failed SSH logins in the window, which includes the first run on a quiet server, heimdall-login-watch failed with mv: cannot stat .../users.new and never counted anything. It now runs normally.

Upgrading

• Servers with --watch-logins: sudo heimdall-collect upgrade keeps the login watch on and installs the fixed script.
• Hub: sudo heimdall upgrade. The hub itself has no changes beyond the version.

Collector 0.4.30.

What's Changed

• Login watch: fix the first run on a server with no failed logins by @chrisreedio in #60
• Collector 0.4.30 by @chrisreedio in #61

Full Changelog: v0.4.29...v0.4.30

---

Verifying this release

Every file is listed in SHA256SUMS, which is signed with Sigstore (keyless, from this repository's release workflow).

# 1. Check the signature on the checksum list
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/chrisreedio/heimdall/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Check the files you downloaded against it
sha256sum -c --ignore-missing SHA256SUMS

# Optional: verify build provenance
gh attestation verify heimdall-linux-amd64 --repo chrisreedio/heimdall

Binaries are reproducible: make reproducible at this tag builds the same bytes.

v0.4.29

Collector 0.4.29 (#59)

Repeat offenders can now be challenged or blocked at Cloudflare's edge across every zone you opt in, starting in shadow mode. Three new alerts.

Added

• Bans (#54). Heimdall scores repeat offenders from failed logins:

  • servers hit, failures and usernames tried;
  • "failed, then succeeded";
  • days active;
  • networks: many quiet addresses in one /24 or /48 can become one network ban.

  It never bans anything IP awareness vouches for: staff, deploy services, your servers, the tailnet, private ranges, Cloudflare's edge or recent sign-ins.

  • Modes, in [bans] mode:
    • off: the default.
    • shadow: records what it would ban, with each candidate's score breakdown, and writes nothing to Cloudflare.
    • propose: Discord/Slack cards with full context and a Review link. Operators approve on /bans.
    • auto: bans without approval, within hourly and total caps.
  • Pause switch (/bans or heimdall bans pause) stops every write to Cloudflare.
  • Challenge by default, block for addresses that hit 3 or more servers or failed then succeeded. Bans last 7 days, doubling for repeat offenders, up to 90 days, and Heimdall removes them when they expire.
  • Opt in per zone. Each zone you opt in gets one Heimdall-owned custom rule, matching an account-level IP list.
  • A separate write token: sudo heimdall bans set-token. heimdall bans token-url pre-fills Zone WAF Edit; add Account Filter Lists Edit by hand.
  • Audit log of every write, and one-click unban.
  • CLI: heimdall bans status|list [--candidates]|approve|reject|unban|pause|resume|set-token|token-url.

• Alerts (#54):

  • login_then_succeeded (high): an unknown address failed and then logged in.
  • dns_unproxied (medium): a name leading to your server stopped being proxied.
  • cname_takeover (high): a possible subdomain takeover on a name that leads to your server or site.

Upgrading

• Hub: sudo heimdall upgrade. Migration 0026 runs on start and rebuilds the alerts table, keeping every existing rule. Then sudo heimdall config update adds [bans], off.
• To start, set [bans] mode = "shadow" and sudo heimdall restart. Shadow mode needs no write token. Watch /bans for a while before moving to propose.
• Servers: sudo heimdall-collect upgrade. The collector has no changes beyond the version. Bans use failed-login counts, so servers need --watch-logins.

The Cloudflare write calls (lists, items, custom rules) are built from Cloudflare's API docs and haven't run against a live account yet.

Collector 0.4.29.

What's Changed

• Bans: challenge or block repeat offenders at Cloudflare, starting in shadow mode by @chrisreedio in #54
• Collector 0.4.29 by @chrisreedio in #59

Full Changelog: v0.4.28...v0.4.29

---

Verifying this release

Every file is listed in SHA256SUMS, which is signed with Sigstore (keyless, from this repository's release workflow).

# 1. Check the signature on the checksum list
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/chrisreedio/heimdall/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Check the files you downloaded against it
sha256sum -c --ignore-missing SHA256SUMS

# Optional: verify build provenance
gh attestation verify heimdall-linux-amd64 --repo chrisreedio/heimdall

Binaries are reproducible: make reproducible at this tag builds the same bytes.