v0.8.0

Release blogpost

Changelog

Best effort list of major changes and bugfixes

0.8.0

• feat: most materia packages are now public. This will be stabilized and documented better in 0.8 or 0.9.
• feat: git repos can reset on corrupted HEAD
• feat: git source supports git.auth_token for Bearer: <token> HTTP auth
• refactor: rewrote file management backend
  • Files are now installed with consistent permissions and using os.Root to prevent symlink/path escapping
  • You may notice an initial wave of Update actions as materia fixes installed file permissions. Note that changing permissions does count as a normal update action, so all triggered effects (container restarts,etc) will still occur
• feat/refactor: The materia container image is now built from podman/stable instead of tumbleweed/bci:latest
• ci: release tarballs and images are now signed via cosign. Public key for validation is in the repo and the main primamateria.systems website
• feat/rework: Redid facts generation. Facts are now denoted in dotted-path format.
  • Existing facts and their new versions:
    • hostname -> materia.hostname
    • interface -> host.interfaces
  • New facts
    • host.hostname: hostname as the OS sees its
    • materia.roles: Assigned roles
    • materia.assigned_components: Assigned components
    • materia.installed_components: Installed components
• feat: generate a $OUTPUTDIR/lastrun.toml file on materia update or materia server update. Up to five last-plan and last-run files are stored.
  • If you have existing lastrun.toml files, you need to remove them before running materia facts.
• feat: facts materia now shows last applied revision and timestamp and whether it was successful:
  • New facts:
    • materia.last_revision
    • materia.last_run
    • materia.last_run_succesful
• feat: server mode supports new server.token for Bearer: token style authentication:
  • example:

  curl -v -X GET localhost:6284/facts \                                                                                                                                                                                                                                        12:17:19 AM
       -H "Authorization: Bearer secret" \
       -H "Accept: application/json"

  • this replaces the now deprecated server.update_secret.
• feat: other server config changes:
  • server.url: replaces server.update_url
  • server.update_webhook requires server.update_secret or server.token
  • update_secret or token checks are disabled by setting server.url to localhost*
• feat: new /facts endpoint for server mode. Enable with server.facts_endpoint Requires server.token to be enabled.
• feat: new /health endpoint, automatically enabled when any other webhook is enabled or if server.health is true.
  • returns:

      {
          "health":"ok",
          "timestamp":"current time"
      }

• bugfix: lastplan/lastrun files can no longer include un-redacted podman secrets. Thanks shirome on Matrix!
  • The planner no longer contains Podman secrets contents at all, even in memory, so this should not happen again
• feat: server and cli use same internal commands. Server now supports rollback
• chore: upgrade to Go 1.27.3. This is the latest Go version that includes certificate revocations for the eMudhra CA leak.
• feat/chore: rework materia validate to use new facts system

Deprecations

• The file source has been renamed to local to prevent settings collisions with the file attributes engine. Setting the SOURCE_KIND to file will work until after 0.8 is released. This is a straight rename; no other settings to be adjusted besides replacing file with local.
• The following server settings are deprecated:
  • server.update_url: replaced with server.url
  • server.update_secret: replaced with Bearer token auth with server.token
• The following facts are deprecated:
  • hostname: replaced with host.hostname
  • interface: replaced with host.interfaces