Skip to content

v1.8.0 — first signed release

Choose a tag to compare

View all tags
@yo1t yo1t released this 06 Aug 13:43
· 552 commits to main since this release
v1.8.0
2763595
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

EgressView v1.8.0 is the first signed release.

Signed distribution

The portable distribution is signed with an AWS KMS Ed25519 key whose private half cannot be exported. Verification needs nothing but openssl and the published public key — no AWS account, no network access, no additional tooling.

Signing key fingerprint (egressview-release-2026, active):

SHA256:6288265bd746d230a3637e3a520e2335f48dc939a4d76d7b05c44ea5baf3eccc

The same fingerprint is published in SECURITY.md, both project site pages, both distribution guides, and a DNS TXT record. Compare against at least two before trusting an artifact.

Verify a download:

V=1.8.0
A=egressview-offline-$V.tar.gz
shasum -a 256 -c "$A.sha256"
openssl pkeyutl -verify -rawin -pubin -inkey "$A.pub.pem" -sigfile "$A.sig" -in "$A.sha256"

The signature covers the checksum file, and the checksum file covers the archive.

Highlights

  • Per-detection notification switches. Threat detection and new-node detection each gained independent Slack and history toggles. Previously both were raised unconditionally, the Slack send was gated only by the global Slack toggle, and the history callback sat outside that gate — so quietening new-node alerts meant turning Slack off for everything, and the in-app history could not be silenced at all.
  • AWS KMS release signing. npm run offline:bundle -- --kms-key-id … signs a build. The verifier is unchanged from previous releases.
  • better-sqlite3 13.0.3, SQLite 3.53.4. Lifts the pin placed in 1.7.0.
  • Install scripts disabled. Dependencies no longer run code at install time, and native modules come from bundled prebuilt binaries instead of compiling. See the upgrade note below.
  • Parser fuzzing and Node 26 in CI. A seeded fuzzing suite covers the 19 functions that parse router CLI output, syslog, and conntrack tables; CI runs unit tests on Node 22, 24, and 26.

Upgrading from 1.7.0

No schema change and no migration — a restart is enough.

One install-time change matters: because install scripts are now disabled, a platform without a bundled prebuilt binary for better-sqlite3 needs Python, a C++ toolchain, and npm ci --ignore-scripts=false. Prebuilds cover darwin, linux, linuxmusl, and win32 on arm64 and x64, which is every supported deployment target.

Full changelog: https://github.com/yo1t/egressview/blob/v1.8.0/CHANGELOG.md
Verification guide: https://github.com/yo1t/egressview/blob/v1.8.0/docs/offline-distribution.md

Assets 6
Loading