Skip to content

WolfStack v25.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jul 09:33
v25.6.0
5c00646

v25.6.0: manage root SSH keys from the UI, and send PBS backups to different datastores

Two operator-facing additions plus the tamper-detection fix that
prompted the first.

Authorised Keys (Apps & Tools → Authorised Keys)
Root SSH keys can now be added or removed on one server or across
the fleet from the UI. Every mutation re-anchors the tamper-detection
baseline in the same operation, so a key added through WolfStack is
never reported as drift — which is what lets tamper detection go on
treating every OTHER authorized_keys edit as suspicious.

Guards: removing the last key while PasswordAuthentication is off is
refused (a fleet-wide remove would otherwise lock you out of every
node at once); unreachable nodes are named before you act and
partial results are never reported as success; key material is
rebuilt from parsed fields on every write so nothing pasted can
smuggle in a second entry.

"What is an SSH public key" is now defined once and shared by the
host manager, the hosting portal and the tamper detector, instead of
three copies that would drift apart.

Tamper detection no longer fights the operator
Auto-restore of a baselined file was firing every 5-minute tick, so
an operator adding an SSH key had it silently deleted, repeatedly,
with no signal. Auto-restore is now one-shot per baseline anchor:
the first drift is reverted, a second is detected and alerted but
left alone, and reseeding re-arms it. Pure key ADDITIONS to
authorized_keys are alerted rather than reverted, naming each new
key by fingerprint. Removals, blob substitutions and options-carrying
lines still revert. Proposal text now matches what was actually done
instead of always claiming a restore.

PBS: additional datastores (klasSponsor 2026-07-28)
PBS 4 can back a datastore with external S3 as well as local/NAS, so
backups can now target a named PBS destination per backup or
schedule — the important things to an S3-backed datastore, the bulk
to the NAS-backed one. Blank fields on a destination inherit from the
primary connection, so a second datastore on the same server needs
only a name and a datastore name.

A destination that has been deleted fails the backup loudly rather
than silently falling back to the primary datastore, and a
destination still referenced by a schedule cannot be deleted. There
is a Test button because proxmox-backup-client has no command that
lists datastores — the name is verified against the real server
rather than guessed at.

Existing configs are untouched: pbs_target_id defaults to empty, which
is the primary connection, so PBS behaviour is byte-identical until a
destination is chosen.

Not runtime-tested: no browser or live-endpoint exercise of either new
screen. Unit tests cover key parsing/validation, the authorized_keys
add/remove content rules, the one-shot latch, and the PBS destination
inheritance order.

Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

  • wolfstack-x86_64 / wolfstack-aarch64 / wolfstack-armv7 — static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).
  • wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
  • SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.

Assets 9
Loading