Skip to content

cfctl v1.0.0

Choose a tag to compare

View all tags
@rogu3bear rogu3bear released this 18 Jul 23:06
· 710 commits to main since this release
v1.0.0
b8c4a11
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First packaged release of cfctl — the governed, local-first Cloudflare control plane.

Highlights

  • Catalog-driven capabilities ingested from Cloudflare's official OpenAPI schema; cfctl resolve turns natural-language intent into a deterministic capability match.
  • Every mutation is a hash-bound plan: call → plans approve --yes → plans run, with operation-specific verification, durable journals, and redacted evidence.
  • Scoped token workflows (keys permissions|mint|rotate|revoke|policy), standing authorities with bounded TTL/rate ceilings, and fail-closed secret sinks (--value-out, mode 0600).
  • Reproducible builds: each platform built twice and hash-compared; SPDX SBOMs via cargo-auditable + Syft; provenance.json binds the exact git commit and tree.

Platforms

cfctl-aarch64-apple-darwin, cfctl-x86_64-apple-darwin, cfctl-aarch64-unknown-linux-musl, cfctl-x86_64-unknown-linux-musl, plus the Homebrew formula (cfctl.rb).

Integrity

Artifacts are unsigned — this is an open-source CLI released with checksum-based integrity: verify downloads against SHA256SUMS, and reproduce any binary from the tagged source (cargo xtask assemble double-builds and hash-compares). SPDX SBOMs enumerate the full dependency graph. The identity-verifying Linux installer is intentionally not shipped for this release; install by direct download + checksum, Homebrew formula, or cargo install --path crates/cfctl-cli --locked from source.

Assets 13
Loading