From 4e6b6beff62a30fc720e8675a34832e586d88838 Mon Sep 17 00:00:00 2001 From: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> Date: Sun, 18 Oct 2026 12:32:19 +0200 Subject: [PATCH 1/3] Prepare 0.5.1: version and changelog Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> --- CHANGELOG.md | 35 ++++++++++++++++++++++++++++++++++- Cargo.lock | 6 +++--- Cargo.toml | 2 +- README.md | 28 ++++++++++++++-------------- docs/release-signing.md | 2 +- docs/verifying-releases.md | 24 ++++++++++++------------ 6 files changed, 65 insertions(+), 32 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5cd955e..5655bb4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,22 @@ commands, `--json` output and exit codes. Each release's notes start with its se ## [Unreleased] +## [0.5.1] - 2026-10-18 + +### Changed + +- When the system has no CA certificates, the error for a request that cannot start or reach the API + now suggests installing the system CA certificates package (for example `ca-certificates`). The + HTTP client reports that case only as "No CA certificates were loaded from the system". + ([#196](https://github.com/Hodeitek/hodeishield-cli/issues/196)) +- `--help` no longer prints the values of `HODEISHIELD_API_URL` and `HODEISHIELD_PROFILE` when they + are set in the environment. +- The `login` help, the session notice and the README name the screen where an app's access is + revoked "Account → Applications", as the web app does, and the README and `config set --help` + match the code on `login --no-browser` and the configuration keys. + ([#199](https://github.com/Hodeitek/hodeishield-cli/issues/199)) +- CI now runs the proxy and TLS inspection test on macOS and Windows as well as Linux. + ### Fixed - Usage errors no longer list `--api-url` or `--profile` in the `Usage:` line when only @@ -13,6 +29,22 @@ commands, `--json` output and exit codes. Each release's notes start with its se `--help` still names them. ([#201](https://github.com/Hodeitek/hodeishield-cli/issues/201)) +### Documentation + +- The README lists the Linux prerequisites to install and to verify a download, gives a checksum + command that BusyBox also runs, and has Windows steps to check a download and to get Scoop and + cosign. + ([#195](https://github.com/Hodeitek/hodeishield-cli/issues/195)) +- The README says how to uninstall the archive and `install.sh` installs, in which order (remove the + settings before the binary), what an uninstall leaves behind on Windows, how to remove the zip + and how to check the MSI. + ([#197](https://github.com/Hodeitek/hodeishield-cli/issues/197)) +- The Quick start points servers and CI from the interactive sign-in to the tenant API key. + ([#198](https://github.com/Hodeitek/hodeishield-cli/issues/198)) +- The README says that `login` and `logout` exit with code 1 when the system keychain cannot be + reached. + ([#200](https://github.com/Hodeitek/hodeishield-cli/issues/200)) + ## [0.5.0] - 2026-10-15 ### Added @@ -388,7 +420,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se - Profiles (`config`), shell completions, and release archives for Linux, macOS and Windows signed with Sigstore and with SLSA provenance. -[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.5.0...HEAD +[Unreleased]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.5.1...HEAD +[0.5.1]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.5.0...v0.5.1 [0.5.0]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.4...v0.5.0 [0.4.4]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.3...v0.4.4 [0.4.3]: https://github.com/Hodeitek/hodeishield-cli/compare/v0.4.2...v0.4.3 diff --git a/Cargo.lock b/Cargo.lock index bf518b6..41a39ba 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -970,7 +970,7 @@ dependencies = [ [[package]] name = "hodeishield-api" -version = "0.5.0" +version = "0.5.1" dependencies = [ "mockito", "reqwest", @@ -983,7 +983,7 @@ dependencies = [ [[package]] name = "hodeishield-cli" -version = "0.5.0" +version = "0.5.1" dependencies = [ "apple-native-keyring-store", "assert_cmd", @@ -3067,7 +3067,7 @@ checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc" [[package]] name = "xtask" -version = "0.5.0" +version = "0.5.1" dependencies = [ "clap", "clap_mangen", diff --git a/Cargo.toml b/Cargo.toml index 8ae10c8..b011531 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -5,7 +5,7 @@ default-members = ["crates/hodeishield-api", "crates/hodeishield-cli"] [workspace.package] authors = ["Hodeitek S.L. "] -version = "0.5.0" +version = "0.5.1" edition = "2024" rust-version = "1.98" license = "Apache-2.0" diff --git a/README.md b/README.md index 39ea8ad..31bebba 100644 --- a/README.md +++ b/README.md @@ -59,7 +59,7 @@ section), and put `hodeishield` (`hodeishield.exe` on Windows) somewhere on your | Windows x86_64 | `hodeishield--x86_64-pc-windows-msvc.zip` | | Windows arm64 | `hodeishield--aarch64-pc-windows-msvc.zip` (from 0.4.0) | -`` has no leading `v`: release `v0.5.0` ships `hodeishield-0.5.0-…`. The Linux binaries are +`` has no leading `v`: release `v0.5.1` ships `hodeishield-0.5.1-…`. The Linux binaries are statically linked and run on any distribution. Homebrew and Scoop packages (next section) and a [container image](#container-image) are also available. @@ -74,7 +74,7 @@ neither is part of a distribution's default install. From source, with the Rust toolchain installed (pin the release tag you want): ```sh -cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.5.0 hodeishield-cli +cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.5.1 hodeishield-cli ``` ### Homebrew and Scoop @@ -220,7 +220,7 @@ exact version, or better its digest. The image carries no documentation: the 0.4.2, as `USER-INFORMATION.md` in its archives. ```sh -v=0.5.0 # the version you want +v=0.5.1 # the version you want docker pull ghcr.io/hodeitek/hodeishield-cli:$v docker run --rm -e HODEISHIELD_API_KEY ghcr.io/hodeitek/hodeishield-cli:$v vendors list ``` @@ -234,7 +234,7 @@ The image is signed by digest with cosign (keyless) and carries the release's Cy signed attestation. Verify both before you rely on the image: ```sh -v=0.5.0 +v=0.5.1 image=ghcr.io/hodeitek/hodeishield-cli:$v cosign verify $image \ --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/container-image.yml@refs/tags/v$v \ @@ -270,11 +270,11 @@ Each release has a `SHA256SUMS` file, a Sigstore bundle (`*.sigstore.json`) for `SHA256SUMS`, and SLSA provenance (`hodeishield.intoto.jsonl`). In short: ```sh -grep hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz SHA256SUMS | sha256sum -c - +grep hodeishield-0.5.1-x86_64-unknown-linux-musl.tar.gz SHA256SUMS | sha256sum -c - -cosign verify-blob hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz \ - --bundle hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.0 \ +cosign verify-blob hodeishield-0.5.1-x86_64-unknown-linux-musl.tar.gz \ + --bundle hodeishield-0.5.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.1 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push ``` @@ -285,12 +285,12 @@ On Windows, PowerShell has no `sha256sum`: compare the hash of the zip or MSI wi fail with a missing-source error), and the same `verify-blob` command works with Windows paths: ```powershell -(Get-FileHash .\hodeishield-0.5.0-x86_64-pc-windows-msvc.zip -Algorithm SHA256).Hash.ToLower() -Select-String hodeishield-0.5.0-x86_64-pc-windows-msvc.zip SHA256SUMS # the two hashes must match +(Get-FileHash .\hodeishield-0.5.1-x86_64-pc-windows-msvc.zip -Algorithm SHA256).Hash.ToLower() +Select-String hodeishield-0.5.1-x86_64-pc-windows-msvc.zip SHA256SUMS # the two hashes must match # the same two lines with .msi for the MSI -cosign verify-blob .\hodeishield-0.5.0-x86_64-pc-windows-msvc.zip ` - --bundle .\hodeishield-0.5.0-x86_64-pc-windows-msvc.zip.sigstore.json ` - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.0 ` +cosign verify-blob .\hodeishield-0.5.1-x86_64-pc-windows-msvc.zip ` + --bundle .\hodeishield-0.5.1-x86_64-pc-windows-msvc.zip.sigstore.json ` + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.1 ` --certificate-oidc-issuer https://token.actions.githubusercontent.com ` --certificate-github-workflow-trigger push ``` @@ -325,7 +325,7 @@ on the binary, so the block still applies. A download with `curl` does not set i place: ```sh -curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.5.0/hodeishield-0.5.0-universal-apple-darwin.tar.gz +curl -LO https://github.com/Hodeitek/hodeishield-cli/releases/download/v0.5.1/hodeishield-0.5.1-universal-apple-darwin.tar.gz ``` **Windows, before 0.2.0.** Unblock the archive before unpacking it, so the executable does not diff --git a/docs/release-signing.md b/docs/release-signing.md index e47d5a8..8b2e917 100644 --- a/docs/release-signing.md +++ b/docs/release-signing.md @@ -80,7 +80,7 @@ an RFC 3161 timestamp from `http://timestamp.acs.microsoft.com`. - **Switch.** The repository variable `WINDOWS_SIGNING_ENABLED` turns the signing on, and only for a run started by a pushed `v*` tag. -The signatures of every signed release so far (0.2.0 to 0.5.0) carry: +The signatures of every signed release so far (0.2.0 to 0.5.1) carry: | Field | Value | |---|---| diff --git a/docs/verifying-releases.md b/docs/verifying-releases.md index 51c8516..38344ed 100644 --- a/docs/verifying-releases.md +++ b/docs/verifying-releases.md @@ -30,14 +30,14 @@ From 0.4.2, every archive, `.deb`, `.rpm` and MSI also contains `USER-INFORMATIO too. The `.deb` and `.rpm` install it in `/usr/share/doc/hodeishield/`, the MSI next to `hodeishield.exe`. -The steps below use `v0.5.0` and `hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz` +The steps below use `v0.5.1` and `hodeishield-0.5.1-x86_64-unknown-linux-musl.tar.gz` as examples — substitute the actual version and archive you downloaded. ## 1. Download the files From the release page, download: -- the archive you want (e.g. `hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz`) +- the archive you want (e.g. `hodeishield-0.5.1-x86_64-unknown-linux-musl.tar.gz`) - `SHA256SUMS` - the matching `.sigstore.json` - `SHA256SUMS.sigstore.json` @@ -46,7 +46,7 @@ From the release page, download: ## 2. Check the checksum ```sh -grep hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz SHA256SUMS | sha256sum -c - +grep hodeishield-0.5.1-x86_64-unknown-linux-musl.tar.gz SHA256SUMS | sha256sum -c - ``` Checking only the line of your archive works with GNU `sha256sum` and with the BusyBox one on @@ -65,7 +65,7 @@ in the format cosign v3 reads by default. Older cosign versions cannot read them ```sh cosign verify-blob \ --bundle SHA256SUMS.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.0 \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.1 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ SHA256SUMS @@ -75,11 +75,11 @@ Repeat for the archive itself, using its own `.sigstore.json`: ```sh cosign verify-blob \ - --bundle hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.0 \ + --bundle hodeishield-0.5.1-x86_64-unknown-linux-musl.tar.gz.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.1 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ - hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz + hodeishield-0.5.1-x86_64-unknown-linux-musl.tar.gz ``` A successful verification confirms the file was signed by the @@ -92,11 +92,11 @@ The SBOM is verified the same way, with its own bundle: ```sh cosign verify-blob \ - --bundle hodeishield-0.5.0-x86_64-unknown-linux-musl.cdx.json.sigstore.json \ - --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.0 \ + --bundle hodeishield-0.5.1-x86_64-unknown-linux-musl.cdx.json.sigstore.json \ + --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.1 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-github-workflow-trigger push \ - hodeishield-0.5.0-x86_64-unknown-linux-musl.cdx.json + hodeishield-0.5.1-x86_64-unknown-linux-musl.cdx.json ``` ## 4. Verify SLSA build provenance @@ -105,10 +105,10 @@ Requires [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier). ```sh slsa-verifier verify-artifact \ - hodeishield-0.5.0-x86_64-unknown-linux-musl.tar.gz \ + hodeishield-0.5.1-x86_64-unknown-linux-musl.tar.gz \ --provenance-path hodeishield.intoto.jsonl \ --source-uri github.com/Hodeitek/hodeishield-cli \ - --source-tag v0.5.0 + --source-tag v0.5.1 ``` `hodeishield.intoto.jsonl` is attached to the release and covers every From 3df4e7b4e5255cc4fb0f4f3db2c9bf3ea9ece0cc Mon Sep 17 00:00:00 2001 From: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> Date: Mon, 19 Oct 2026 09:13:26 +0200 Subject: [PATCH 2/3] Add the unblock-steps change to the 0.5.1 changelog Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5655bb4..730dabb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -44,6 +44,9 @@ commands, `--json` output and exit codes. Each release's notes start with its se - The README says that `login` and `logout` exit with code 1 when the system keychain cannot be reached. ([#200](https://github.com/Hodeitek/hodeishield-cli/issues/200)) +- The Install section links to the steps for a binary that macOS or Windows blocks, and the Windows + steps (`Unblock-File`, SmartScreen's "More info → Run anyway") apply to every version. + ([#16](https://github.com/Hodeitek/hodeishield-cli/issues/16)) ## [0.5.0] - 2026-10-15 From 44fba33fcb44d0910835786985a70c53c004cd27 Mon Sep 17 00:00:00 2001 From: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> Date: Mon, 19 Oct 2026 09:39:28 +0200 Subject: [PATCH 3/3] Add the shared sign-in note to the 0.5.1 changelog Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com> --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 730dabb..450f204 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -47,6 +47,8 @@ commands, `--json` output and exit codes. Each release's notes start with its se - The Install section links to the steps for a binary that macOS or Windows blocks, and the Windows steps (`Unblock-File`, SmartScreen's "More info → Run anyway") apply to every version. ([#16](https://github.com/Hodeitek/hodeishield-cli/issues/16)) +- The README says that two profiles signed in as the same user, to the same tenant, with the same + flow share one sign-in, so logging out of either one signs out both. ## [0.5.0] - 2026-10-15