v0.3.0-rc2

A release candidate for v0.3.0, cut from main at fb2a2cd, for the acceptance run of the box channel: the box's Caddyfile lives in a private repository and reaches the box only as signed commits its own binary validates (hotserve init, hotserve box …, box_webhook).

It does not include v0.3.0-rc1's backups. That candidate was cut from the backup branch, which is on hold (#179); nothing from it is in main.

Until #220 merges, the docs for this candidate are on its branch: docs/first-deploy.md. A prerelease leaves the template repositories alone, so copy examples/box from that branch, and set the box repository's Actions variable HOTSERVE_VERSION to 0.3.0-rc2. This candidate's .deb is named hotserve_0.3.0.rc2_<arch>.deb.

The behaviour changes since v0.2.1 will be written up for v0.3.0.

What's Changed

• docs: the artifact byte cap is for the whole archive, not for each file in it by @earthlingdavey in #126
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 in /penaltybox by @dependabot[bot] in #127
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.43.0 to 1.45.0 in /penaltybox by @dependabot[bot] in #130
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 in /liveswap by @dependabot[bot] in #132
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.43.0 to 1.45.0 by @dependabot[bot] in #134
• build(deps): bump github.com/darkweak/storages/otter/caddy from 0.0.19 to 0.0.20 in the go-deps group across 1 directory by @dependabot[bot] in #142
• liveswap: an archive's symlinks cannot take extraction outside the release by @earthlingdavey in #148
• liveswap: a failed artifact fetch does not print the hop's query string by @earthlingdavey in #149
• liveswap: review follow-ups whose fix needed no decision (F-4, F-5, F-9, F-12, F-16 + three low) by @earthlingdavey in #150
• build(deps): bump the go-deps group across 2 directories with 2 updates by @dependabot[bot] in #157
• ci(vulncheck): accept unreachable GO-2026-6508 via pin-watch alert_dismissals by @earthlingdavey in #158
• build(deps): bump caddy to v2.11.6 by @earthlingdavey in #163
• build(deps): bump golangci/golangci-lint from v2.13.2 to v2.14.0 in the compose-images group by @dependabot[bot] in #164
• build(deps): bump the dockerfiles group across 2 directories with 1 update by @dependabot[bot] in #156
• ci(pin-watch): drop the GHSA-w34q and GHSA-gcjh alert dismissals by @earthlingdavey in #165
• fix(liveswap): a failed deploy's log tail keeps the lines journald could not name a unit on (PR 7, liveswap half) by @earthlingdavey in #167
• build(deps): bump golang.org/x/net to v0.60.0 (fixes govulncheck gate) by @earthlingdavey in #181
• docs: introduce hotserve as a standalone product by @earthlingdavey in #180
• build(make): package clears the stale .deb before building (#151) by @earthlingdavey in #184
• ci(fuzz): fuzztime reaches go test as data, not shell (#151) by @earthlingdavey in #183
• fix(packaging): prerm deconfigure no longer tears down the box (#151) by @earthlingdavey in #182
• feat(liveswap): the deploy record names the sha256 a deploy was pinned to (#145) by @earthlingdavey in #185
• fix(examples): deploy.sh refuses a non-https HOTSERVE_URL before minting (#151) by @earthlingdavey in #186
• fix(packaging): postinstall says when the upgrade restart failed (#151) by @earthlingdavey in #187
• docs(box): the config channel's design, and its place in the threat model (PR 0) by @earthlingdavey in #178
• feat(liveswap): an env_file open to every account is warned about, at load and at launch (#106) by @earthlingdavey in #191
• docs(threat-model): env_file values are unit state in the hotserve user's manager (#106) by @earthlingdavey in #192
• feat(liveswap): config load warns about a deploy_trust block wider than it reads (#106) by @earthlingdavey in #189
• feat(box): the proof core and the reading of the signed file (PR 1) by @earthlingdavey in #190
• refactor(liveswap): deploy auth becomes the leaf package deploytrust, for both webhooks (box PR 2a) by @earthlingdavey in #188
• build(deps): bump the go-deps group across 4 directories with 1 update by @dependabot[bot] in #193
• test(sandbox): the cgroupfs probe tells read-only from absent and denied (#151) by @earthlingdavey in #195
• fix(penaltybox): key IPv6 clients by /64 and seed the shard hash (#151) by @earthlingdavey in #194
• fix(examples): deploy.sh refuses a dirty tree's default version and validates VERSION (#151) by @earthlingdavey in #197
• fix(penaltybox): warn when max_keys leaves one slot per shard, and document the per-shard split and empty-key fail-open (#151) by @earthlingdavey in #196
• ci(lint): lint and format-check integration-tagged files too by @earthlingdavey in #198
• fix(penaltybox): strip the hint header on the empty-key path too (#151) by @earthlingdavey in #199
• feat(box): the box option, box_webhook's GET / and hotserve box webhook (box PR 2b) by @earthlingdavey in #200
• docs(penaltybox): the design doc describes the shipped module, counting is stated correctly, and the directive goes first in a route (#151) by @earthlingdavey in #201
• ci: a go mod tidy -diff gate per module, grouped gomod security updates (#151) by @earthlingdavey in #202
• fix(liveswap): state.json is written and read without following links, like the deploy records (#151) by @earthlingdavey in #203
• feat(box): the applier core (box PR 3a) by @earthlingdavey in #205
• feat(box): the applier's units and packaging (box PR 3b) by @earthlingdavey in #204
• feat(box): box_webhook admits pushes and answers result polls (box PR 3c) by @earthlingdavey in #206
• test(liveswap): the deploy-record test reads version fields, not the whole body by @earthlingdavey in #207
• fix(box): a refusal names its commits unmasked by @earthlingdavey in #208
• test(e2e): the box channel end to end (box PR 3d) by @earthlingdavey in #209
• fix(box): the applier's follow-ups — left-on-disk line, own rollback words, SIGTERM by @earthlingdavey in #210
• feat(box): hotserve init and hotserve box baseline (box PR 4) by @earthlingdavey in #216
• test(e2e): compose names the e2e images per project by @earthlingdavey in #215
• fix(box): the fast path asks every step that needs no signature by @earthlingdavey in #214
• feat(box): step 6 reads the adaptation for reachability (box PR 3c-r) by @earthlingdavey in #211
• fix(liveswap): a retired JWKS client closes its idle connections by @earthlingdavey in #217
• feat(box): the template applies by signed push (box PR 5) by @earthlingdavey in #213
• docs(box): "Why 202 and a poll" gives the reasons that hold by @earthlingdavey in #218
• fix(examples): bin/apply asks after a push a CDN could not answer (Cloudflare 520-524, 530) by @earthlingdavey in #219
• feat(box): a push is waited for 30 minutes, past root's worst case by @earthlingdavey in #222

Full Changelog: v0.2.1...v0.3.0-rc2