From b4721eee11afa56ba3a325b4cce5dd89092e97d5 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Fri, 23 Oct 2026 08:44:19 +0200 Subject: [PATCH] CHANGELOG: v0.163.0 released (D30, D4 root SSH by key only, R-1204) --- CHANGELOG.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index edffe89..7a93ca5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,8 @@ -## Unreleased (2026-10-22/23 night) — the tunnel heals itself after a clock that ran ahead (D30, R-1204) — COMMITTED, NOT RELEASED +## v0.163.0 — the tunnel heals itself after a clock that ran ahead (D30, R-1204); root SSH from the LAN by key only (D4, R-982) (2026-10-23) — RELEASED on the operator's yes (day brief); the vouch is the operator's + +Binary sha256 `561b5316cd511de9fa9d8b8be4553da7add684f715d3bea533ca330ff7f3763c`; config bundle sha256 `3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8`. Built from `1109092` (CI 2246 green). Both sections below are in it. + +### The tunnel re-key (D30) and the D4 bundle drop-in - **D30 (operator 2026-10-22: the agent makes a new key and registers it on the existing peer path).** When the latest handshake stays stamped in the future for 15 minutes (the R-1204 sign: ep0 keeps the future timestamp and refuses @@ -32,9 +36,9 @@ - **Known gap, unchanged (filed):** after a reboot the kernel forgets the future stamp (latest handshake 0), so neither this re-key nor the hub's alarm sees a box whose clock was corrected and which then restarted (R-1223). -## Unreleased (2026-10-22 night) — the tunnel's future-stamped handshake is reported (R-1204) — COMMITTED, NOT RELEASED (no agent release tonight); root SSH by key only (R-982, D4) is a READY PATCH, not on main +### The future-stamped handshake is reported (R-1204) — first written on the 2026-10-22 night -- **R-982 / D4 — a ready patch, NOT on main.** Built and proven the same night (felhom.eu +- **R-982 / D4 — a ready patch on that night; on `main` since `1109092` and released in v0.163.0 (see above).** Built and proven the same night (felhom.eu `audits/night-2026-10-22/P2-D4/`): a bundle drop-in `/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf` (`PermitRootLogin prohibit-password`), a `sshd` content check (exactly `prohibit-password`; `sshd -t -f`), and after an install that wrote it `sshd -t` + `systemctl reload ssh`; tests `RootKeyOnly` (3), red-proved. Live on a fresh