From 404b105506bbfec01bc631b6279d9c9cee90ca5c Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sun, 15 Nov 2026 10:09:42 +0100 Subject: [PATCH] agent v0.175.1: the changelog heading (released, not vouched) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- CHANGELOG.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9ee5653..3fecd3b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,10 +1,14 @@ -## Unreleased (after v0.175.0, 2026-11-15) — root files older than the agent are not a trust problem +## v0.175.1 (2026-11-15) — root files older than the agent are not a trust problem — RELEASED 2026-11-15 (release-agent.sh from the clean working clone at `88d5d56`, CI run id 2678; agent sha256 38b1e2350de90a7940c16f8cd2a21d83fcd535410d1017a7df0fee14f0904612, bundle sha256 07ebf86362ed9d44776416bd5c2c4b6b629e44d34595a8120fd8fc3f4d9277ff); NOT vouched yet. 0.175.0 was released the same morning, reached Tester 1 only, and is NOT to be vouched - **`pvetrust.Ensure`: the wrapper's „unknown mode” refusal on a PINNED box names no problem.** Between the signed agent update and the signed root-files job, the box's wrapper does not know `pve-ca-copy`. 0.175.0 reported `ca_copy_unavailable` for those minutes and the hub mailed the operator (seen on Tester 1, 2026-11-15 10:04). The pin works, so nothing is wrong; the bundle install runs the move. An unpinned box, and every other refusal, still names the problem. Test `TestRootStepOlderThanTheAgent_IsNotATrustProblem`; 3 mutations seen red. +- **The quiet branch never hides a failed pin** (the commit's security review): it is taken only when the run was + not started by a failed call and no trust failure is recorded, and only for the wrapper's code R11. + `TestRootStepOlderThanTheAgent_NeverHidesAFailedPin`; 3 more mutations seen red (felhom.eu + `documentation/audits/release-2b-3-2026-11-15/part2/`). ## v0.175.0 (2026-11-15) — trust in Proxmox by a copy of the box's own root CA (R-1380, release 2b); the agent tells the hub its clock, a refused job, a give-up and what a clean-up did (release 3); a boot key a clock step cannot move (R-1395) — RELEASED 2026-11-15 (release-agent.sh from the clean working clone at `db01ae0`, CI run id 2671; agent sha256 d1a30ed51f6663d96369ad3e88c221194af92773addf4fbb48852ee58be4b19a, bundle sha256 3b4a8b78155fc4385148c98c229da2e61e7c6b02bad9ed9f1fdc4a9ea1370d95); NOT vouched yet