Skip to content

Release 26.09_5

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Sep 17:17
· 1 commit to main since this release
26.09_5
8a01a5e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Zentinel 26.09_5

Cargo version: 0.6.42

What's Changed

If you install agents with zentinel bundle install, upgrade. It could not
succeed for a non-root user on a standard Unix system.

Fixed

  • zentinel bundle install <agent> failed for every non-root user, which is
    the documented first step for installing any agent:

    Install path:   /usr/local/bin
Mode:           system-wide (requires root)
Error: Failed to create installation directories
Caused by: Permission denied: /etc/zentinel/agents

    The writability check asked the wrong question. It used
    Permissions::readonly(), which on Unix is mode & 0o222 == 0 — "can anyone
    write here?"    , not "can I?". /usr/local/bin is root:wheel drwxr-xr-x on a
    standard install, so the owner's write bit made it look writable to every user
    on the machine. The installer therefore chose a system-wide install for
    everyone and then failed creating /etc/zentinel/agents, and the user-local
    fallback beneath it was unreachable.

    It now uses access(2), and checks every directory the install creates rather
    than only the binary one — a check narrower than the operation it guards is a
    check that passes and then fails.

    A user-local install places the binary in ~/.local/bin and its configuration
    in ~/.config/zentinel/agents/. Use --prefix to choose somewhere else, or
    run as root for the system-wide install.

    Reported by @alanorth at
    registry.zentinelproxy.io#3,
    who also spotted that the registry pages named a path — ~/.zentinel/agents/ —
    that the installer has never used. All 23 agent pages have been corrected.

Installation

From crates.io

cargo install zentinel-proxy

From binary

Download the appropriate archive for your platform and extract:

tar -xzf zentinel-26.09_5-linux-amd64.tar.gz
sudo mv zentinel /usr/local/bin/

Docker

docker pull ghcr.io/zentinelproxy/zentinel:26.09_5

Supply Chain Security

All release archives are signed with Sigstore cosign using keyless signing tied to GitHub Actions OIDC identity. SLSA v1.0 provenance is attached to this release.

Verify a binary

cosign verify-blob --bundle zentinel-26.09_5-linux-amd64.tar.gz.bundle \
  --certificate-identity-regexp "github.com/zentinelproxy/zentinel" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  zentinel-26.09_5-linux-amd64.tar.gz

Verify the container image

cosign verify ghcr.io/zentinelproxy/zentinel:26.09_5 \
  --certificate-identity-regexp "github.com/zentinelproxy/zentinel" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

Checksums

Verify downloads with the .sha256 files.

Software Bill of Materials

CycloneDX 1.5 and SPDX 2.3 SBOMs are attached as release assets.

Assets 18
Loading