Skip to content

Hawser 0.3.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@zcsizmadia zcsizmadia released this 11 Sep 16:43
· 51 commits to main since this release
v0.3.1
42d3d8d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release predates the rename. The project was called Hawser until
after v0.3.1; it is now Skrog, under the wslkit org. The assets below
keep the names they were published with and still verify. The install
command has been corrected to the current URL — GitHub redirects repository
URLs after an org rename but not GitHub Pages URLs, so the original link no
longer resolves. See #1.

Releases are verifiable from this one onward. Every artifact now carries SLSA build provenance, and SHA256SUMS is signed with cosign keyless — two independent checks that v0.3.0 could not offer, because both landed two days after it was tagged.

# 1. Did GitHub Actions build this, from this repository, at a known commit?
gh attestation verify hawser_0.3.1_windows_amd64.zip --owner hawserhq

# 2. Is the checksum list itself authentic?
cosign verify-blob --bundle SHA256SUMS.cosign.bundle `
  --certificate-identity-regexp '^https://github.com/hawserhq/hawser/' `
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS

# 3. Does your download match the signed list?
sha256sum -c SHA256SUMS --ignore-missing

Binaries are still not Authenticode-signed, so SmartScreen will warn. That is tracked in #77.

Install

irm https://wslkit.github.io/skrog/install.ps1 | iex

New in this release: it downloads the newest release, verifies it against SHA256SUMS, unpacks it and adds it to your PATH. It deliberately stops there — hawser install provisions the engine, and that is not something a piped command should do unasked.

New

  • hawser policy — local admission control for the docker API. Refuse --privileged, capabilities, host namespaces, bind sources or registries this machine has ruled out, before the engine sees them. A guardrail against mistakes, not a boundary against a hostile local user, and it says so. (#120)
  • hawser upgrade — one answer to "am I current?" across the app, the engine and the bundled docker CLI, and it applies the two it owns. It also surfaces an ordering dependency nothing else showed: the engines hawser engine upgrade can reach are pinned in the binary you are running, so a newer engine can need a newer hawser first. (#191)
  • hawser restart --supervisor — the supervisor process could not be restarted at all before; the only way was to kill a PID by hand. (#202)
  • A documentation site at https://hawserhq.github.io/hawser/, generated from docs/, with a command reference generated from the binary's own --help so it cannot drift. (#197, #209)
  • Experimental AMD GPU support through the same hookless CDI spec as NVIDIA. Untested on real hardware — if you have a Radeon, #185 wants to hear from you.

Fixed

  • hawser config set audit on did nothing. The supervisor read the setting once at startup, and the help text told you to run hawser restart — which bounces the engine, not the supervisor holding the setting. The command exited 0, printed no error, and produced no audit log. Settings are now re-read live wherever they are consumed. (#202)
  • Corporate-network settings were captured at supervisor launch, so hawser config set network.proxy … followed by hawser restart re-applied whatever was set at logon. (#202)
  • hawser uninstall deleted the shared hawser docker context, breaking any other install on the machine — including the developer's own, after running the acceptance suite. It now hands the context back. (#217)
  • The recorded rootfs URL depended on a GitHub redirect that can lapse or be taken over. It is normalised to the project's current home. (#212)
  • hawser audit tail -n 5 was rejected, though that is the form the command's own usage line advertises.
  • The tray flashed a console window on every status poll, and spawned a process every four seconds to recompute state the supervisor already publishes. (#195, #192)
  • The engine rootfs shipped no licence text for the software inside it. It now ships all five components' licences. (#205)

Upgrading from 0.3.0

hawser upgrade does not exist in 0.3.0, so this one is a manual step — run the installer above, or download the zip and unpack it over your existing install. Stop the engine first (hawser stop, and quit the tray) so the binaries are not locked. From 0.3.1 onward, hawser upgrade reports and applies.

Your engine, images, containers and volumes are untouched by an app upgrade.

Assets 6
Loading