Skip to content

cfctl v1.3.0 — source release

Choose a tag to compare

View all tags
@rogu3bear rogu3bear released this 04 Sep 23:58
· 234 commits to main since this release
v1.3.0
23a7bb3

cfctl v1.3.0 — source-only release

cfctl v1.3.0 expands the governed Cloudflare control plane and strengthens the connection between a reviewed operation, the effect it attempts, and the evidence used to verify or recover it.

This is a source-only release. It includes no uploaded prebuilt executables, binary checksum sets, or installer manifests. GitHub-generated archives contain source. It is published with GitHub latest set to false, does not replace the latest binary release, and does not require Apple signing credentials to publish or build the accepted source locally.

Material changes since v1.2.1

  • Worker and Pages deployment workflows. Worker version upload, traffic promotion, and rollback have distinct governed lifecycles. Plans bind source, configuration, artifact inputs, account targets, and live preconditions; verification checks the intended version and traffic state. Pages coverage includes direct artifact deployment, Git-integrated project creation, and domain workflows. Provider effects retain their own capability-specific approval and verification requirements.
  • D1 operations with bounded recovery. Added and strengthened governed exports, schema inspection, exact-bookmark restore, reviewed migration imports, and workspace-owned migration and evidence operations. Import execution records boundary stages and supports reconciliation after an uncertain response without replaying a consumed operation. Workspace declarations bind their repository, configuration, database, and compiler-owned behavior rather than accepting arbitrary caller SQL.
  • Body-free Maildesk and private-object evidence. Workspace D1 projections expose approved policy, schema, audit, route-health, inbound-acceptance, and reply-admission facts. R2 digest reads return bounded object identity and digest information without returning private object bodies. Independent policy and provider observations remain separate evidence; database counters alone do not establish inbox receipt or an outward reply.
  • Email Routing and Access contracts. Email Routing reads use typed, privacy-preserving projections and account for documented pagination and response variants. Governed reply-subdomain ingress and catch-all operations bind their owning zone and Worker. Specialized Access application updates and operator-group policy operations preserve owned state and verify the intended result; generic mutation paths remain subject to their existing blockers.
  • Evidence authentication and recovery. Qualifying local evidence is bound to its state root and authenticated with generation-specific keys. Legacy unauthenticated rows remain historical observations rather than becoming current proof. Evidence-key initialization and managed recovery have explicit interruption handling. Valid-registry adoption remains held until an authenticated installed-identity receipt can support it.
  • Credential and delegated-operation reliability. Native macOS Keychain access, managed credential journals, deterministic fallback reads, scoped analytics-profile renewal, and bounded delegated process handling replace several fragile recovery paths. Post-boundary failures retain attempted/performed state and recovery context instead of reporting that nothing happened. Eligible reversible operations can explicitly report unattested effects when authority is unavailable; destructive, identity, communication, spend, and unknown-risk operations retain their stricter gates.
  • CLI discovery, telemetry, and local proof. The parser-generated command map, deterministic resolution, capability guides, and generated agent integration make the supported command surface discoverable. Governed telemetry workflows distinguish previews, component reads, mutation authority, and operational proof. Local verification covers Rust, the edge site, supporting tooling, dependencies, and source contracts.

Reliability and operability improvements

The final committed source also includes:

  • A narrowly bounded create operation for an owned whole-host self-hosted Access application, with an empty initial policy set, ownership-absence checks, returned-ID verification, and separate operator-group policy creation.
  • Noninteractive macOS Keychain operations in terminal and unattended sessions. Failure to suppress interaction stops credential access; process-wide interaction state is serialized and preserved.
  • Explicit private-preview, private-activate, and private-history commands for a fresh private-file runtime when platform custody cannot provide routine access. Activation preserves the old runtime, carries eligible scoped credentials privately, and selects the new location only after preparation and source-drift checks. It does not inherit old plans, standing grants, approvals, or authenticated proof. Existing restrictive admission rules are shown for explicit re-admission with a fresh approval. The new authority claims no cryptographic continuity with the old one. Other software running as the same OS user can access the private-file credentials and signing authority.
  • Site asset fingerprints derived from final JavaScript bytes after the WASM-reference rewrite. Local and live checks verify actual asset bytes, manifest filenames, and the JavaScript-to-WASM reference. Site-relative reproducibility hashes remain distinct from cfctl's repository-relative deployment artifact digest.
  • SSR response policies admit the exact framework nonce alongside the hydration-script hash, and live verification checks every emitted inline script.
  • Site SSR scripts are admitted by the exact response nonce, while non-SSR responses retain the strict hash-based fallback. HTML verification checks each executable inline script against its actual admitted bytes or response nonce; it rejects wrong nonces, changed hash-bound bodies, and additional unadmitted scripts.
  • A documented source-only publication lane that leaves the signed prebuilt release requirements intact.

The exact source below passed the complete native verification gate and independent review. Local browser checks covered Chrome and WebKit interactions and the site’s emitted HTML and security headers. These checks do not establish installation or live Cloudflare deployment.

Installation and compatibility

Use a clean Git checkout of the exact accepted release tag and follow the repository prerequisites in CONTRIBUTING.md. The repository pins the Rust toolchain and supporting proof tools.

./bootstrap.sh
cfctl version --json
cfctl doctor --json
cfctl agents doctor --json

Bootstrap runs the canonical local verification gate before installing from source, checks that the installed binary reports the checkout's exact commit, and synchronizes the managed agent integration unless explicitly skipped. It does not sign or notarize a public binary. A source archive alone does not satisfy bootstrap's Git-checkout identity requirement.

This release uses the cfctl v2 CLI contract, which is a clean break from the archived shell runtime. Use cfctl commands, cfctl <command> --help, cfctl resolve, and cfctl guide to discover supported commands. Structured output uses ResultEnvelopeV2. Backend scripts and the archived runtime are not supported public fallbacks.

Credentials remain account-pinned and enter through the supported protected import paths. A Cloudflare write still requires its governed call/plan/approval/run/status lifecycle. Installing source, activating a local runtime, or publishing these notes does not deploy a Worker, register a domain, enable public OAuth, or prove delivery of mail.

Prebuilt binaries remain a separate release lane

cargo xtask assemble produces unsigned local qualification artifacts. Public prebuilt v1.3.0 artifacts retain the requirements for reviewed trust roots, reproducible build provenance, SBOM and checksum verification, cosign verification, and Developer ID signing and Apple notarization of the macOS binaries. cargo xtask release and cargo xtask publish retain those checks. Nothing in this source-only release authorizes publishing unsigned binaries or substituting local build success for signed-artifact verification.

Source: exact commit 23a7bb3e4067. Changes: v1.2.1 to this exact source.

Assets 2
Loading