Releases: intelligentwolf/WolfStack
Release list
WolfStack v25.18.0
v25.18.0: a container's DNS survives a restart, and you can pin it per container
WolfStack rewrote every LXC container's DNS to 1.1.1.1/8.8.8.8 each time it
started it, so an operator's own resolver reverted on every restart from the UI.
It now keeps whatever the container already resolves with, and Settings ->
Network gains Nameservers / Search Domains to pin resolvers explicitly.
Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com
Verifying this release
Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.
Verify the cosign signature:
cosign verify-blob \
--bundle wolfstack-x86_64.cosign.bundle \
--certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
wolfstack-x86_64
Verify the build provenance:
gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack
Verify the SHA-256 checksum:
sha256sum -c SHA256SUMS
Artifacts
wolfstack-x86_64/wolfstack-aarch64/wolfstack-armv7— static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).wolfstack-<arch>.cosign.bundle— cosign signature bundle (cert + signature + Rekor entry).SHA256SUMS— checksums for both binaries.
For per-version history see CHANGELOG.md.
WolfStack v25.17.0
v25.17.0: a trailing slash on an S3 endpoint no longer breaks every S3 call, and a backup asks before it copies a 20 TB mount
Two reports from klas.
An S3 remote whose endpoint was entered as https://s3.example.com/ failed
every connection test and every health probe with 400 Bad request — Your browser sent an invalid request, an HTML page from the endpoint's own front-end
proxy rather than anything S3-shaped, while the same endpoint mounted perfectly
under s3fs. The trailing slash was the whole bug. Region::host() in
aws-region returns EVERYTHING after :// (aws-region-0.25.5
src/region.rs:300-308) and rust-s3 sends that verbatim as the Host header
(rust-s3-0.35.1 src/request/request_trait.rs:197, inserted at :536), so the
request went out with Host: s3.example.com/ — a malformed Host header that a
compliant proxy can only reject. s3fs was untouched because it derives its Host
header from the parsed URL, which is exactly why a working mount sat next to a
failing probe on the same credentials. Confirmed at the wire against the
reported endpoint: Host: s3.hexabyte.se answers 200, the same request with
the slash returns that error page byte for byte.
endpoint_url now normalises the endpoint to scheme plus host[:port], and
build_s3_region returns Result so the compiler proves every rust-s3 call
site reports an unusable endpoint instead of sending a doomed request. The
three hand-rolled Region::Custom sites behind the S3 backup destination —
upload, retrieve, delete — carried the same latent fault and now share one
normaliser with the mount, sync and bucket paths. An endpoint carrying a path
prefix can never work through rust-s3 for the same Host-header reason, so it is
refused by name up front rather than becoming another unexplained 400; s3fs and
rclone parse the URL themselves, so a prefixed endpoint that works for them is
left alone. An error body that turns out to be HTML now says so — something
other than the S3 API answered — on every S3 surface at once.
The health card's "error x 405" in that report was 405 consecutive probe
failures, not an HTTP status: one endpoint typo, five weeks of them.
Second: a container can be two gigabytes of application and twenty terabytes of
bind-mounted array, and nothing said so until the backup was already running.
Backup Now and saving a schedule now both check what the backup would actually
archive, and any included mount past 50 GB raises a dialog naming it — exclude
them, include them anyway, or cancel. Exclusions already set are never
re-asked. A "back up everything" schedule resolves its targets at each run and
so has nowhere to store a per-container exclusion; it says that plainly instead
of offering a button that could not work.
Measuring had to stop being unbounded to make this safe: du on a 20 TB array
would have held the mount inventory open for minutes. A source that is itself a
filesystem root is read from df instantly; anything else gets du with a
five-second deadline; past that the honest answer is "size unknown, up to
", which is itself worth knowing before it enters an
archive. Every figure now carries how it was arrived at, so nothing downstream
mistakes a bound for a measurement — and the staging-space guard keeps taking
the exact slow walk, because it refuses backups and must not work from a bound.
Two false positives found by running the check against live containers are gone
with it: a mount source that is not on the host, and a Proxmox storage-backed
mountpoint, no longer look like 20 TB arrays.
Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com
Verifying this release
Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.
Verify the cosign signature:
cosign verify-blob \
--bundle wolfstack-x86_64.cosign.bundle \
--certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
wolfstack-x86_64
Verify the build provenance:
gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack
Verify the SHA-256 checksum:
sha256sum -c SHA256SUMS
Artifacts
wolfstack-x86_64/wolfstack-aarch64/wolfstack-armv7— static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).wolfstack-<arch>.cosign.bundle— cosign signature bundle (cert + signature + Rekor entry).SHA256SUMS— checksums for both binaries.
For per-version history see CHANGELOG.md.
WolfStack v25.16.1
v25.16.1: installs stop leaving an open portmapper, and a backup can no longer fill the system disk
Three reports, one CERT notice.
WolfStack installs nfs-common (it mounts NFS shares), which pulls in rpcbind as a
dependency whose socket unit binds 0.0.0.0:111 — tcp AND udp. Any host with a
public IP and no firewall therefore answered portmapper queries from the whole
internet: a 7-28x UDP amplification reflector (CERT TA14-017A) that national
CERTs scan for and report to the hosting provider's abuse desk rather than to the
operator. That is how ours was found — a BSI notice forwarded by Hetzner, four
days after the host was built, for a port nothing on that host was using. The
analyzer had flagged it since it shipped; nothing could act on the finding.
setup.sh now runs wolfstack --secure-rpcbind after the package step, and the
Predictive Inbox's rpcbind finding gets a "Switch rpcbind off" button behind
POST /api/proposals/{id}/apply. Both go through one implementation that first
checks whether the host actually uses RPC — registrations other than the
portmapper, NFS mounts, exports (including /etc/exports.d, where WolfStack's own
share publishing writes), a running NFS server — and refuses, saying which of
those it found, rather than breaking a working NFS setup to close a port. It then
stops and masks BOTH units (the socket unit is what holds 111) and verifies the
port is unbound instead of trusting systemctl's exit status. Publishing an NFS
share unmasks it again, so the two halves cannot leave a host unable to serve
NFS. The endpoint executes a fixed compiled-in sequence chosen by finding type;
no other finding, and nothing from a request body, can reach it.
Image update checks looked broken on nodes that had just been switched on
(RutgerDiehard). The watcher loop is phase-locked to a stagger slot with the
interval floored at six hours and only re-reads enabled when it wakes, so
enabling it — by hand, by a settings push, or when a node adopts the cluster's
settings after being offline — produced nothing at all until that slot came
round; editing a setting to "kick off a cycle" never scheduled anything. All
three paths now wake the loop, there is a "Check for updates now" action (panel
button and inline in the containers-page notice), and a node with checks on but
no results yet says so instead of showing an empty page. The settings push also
reports the peers it deliberately did NOT ask — offline, or in another cluster —
so "pushed to 5 of my 6 nodes" names the sixth and why.
A large Docker container's backup filled a system drive, failed, and left its
partial archive in staging (klas). Backups now measure the target first — image
plus volumes and binds, a container or folder tree, a VM's disk images, minus any
mounts excluded for that target — and refuse before writing a byte if the staging
filesystem cannot hold it, naming both figures and the three ways to fix it.
Sizes are compared uncompressed with a 1 GiB reserve: media and encrypted volumes
compress by nothing, and a refused backup is recoverable where a filled root
filesystem is not.
Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com
Verifying this release
Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.
Verify the cosign signature:
cosign verify-blob \
--bundle wolfstack-x86_64.cosign.bundle \
--certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
wolfstack-x86_64
Verify the build provenance:
gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack
Verify the SHA-256 checksum:
sha256sum -c SHA256SUMS
Artifacts
wolfstack-x86_64/wolfstack-aarch64/wolfstack-armv7— static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).wolfstack-<arch>.cosign.bundle— cosign signature bundle (cert + signature + Rekor entry).SHA256SUMS— checksums for both binaries.
For per-version history see CHANGELOG.md.
WolfStack v25.16.0
v25.16.0: weekly/monthly backups pick their run day, and "back up everything" stops discarding cold-backup ticks
Three reports from Discord.
Ticking "stop container for cold backup" and saving a schedule lost the tick
(JJ). Not a display bug: selecting every item on the Backups page auto-enables
"back up everything", which posts targets: [], so every per-target
stop_for_backup flag was thrown away — and the nightly run resolved its targets
live with the flag defaulting false, so the cold backup never happened at all.
Schedules now carry a schedule-level stop_containers flag that backup_all()
applies to each Docker/LXC target, the per-container ticks grey out with an
explanation while "everything" is on, and a tick made on the page carries into
the new flag instead of being dropped.
Weekly and monthly schedules offered a time but no day (JJ). They now take a
weekday (Mon-Sun) or a day of the month (1st-31st, clamped to the month's last
day so the 31st backs up on 28/29 February rather than skipping the month), in
both the schedule modal and the Cluster Backups page, and the Schedules table
shows it — "weekly (Wed)", "monthly (15th)". Schedules saved before this keep
their exact previous behaviour; pinning also stops the old drift where a run
starting a minute late pushed the next one a day later, every week.
On a bastion managing two clusters, Docker image-update settings could only ever
be read, saved and pushed for the UI host's own cluster (RutgerDiehard):
selectView() clears the page scope, so every Settings page talks to the local
node. Settings -> Alerts -> Docker Updates now has a "Settings for" picker
listing nodes grouped by cluster, and load/save/"Push to all nodes" all route to
the chosen node so the fan-out lands in its cluster. The "disabled on this node"
notice and the Docker-page links carry the node they were shown on, and a failed
read from a remote node says so instead of leaving the previous node's values on
screen.
Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com
Verifying this release
Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.
Verify the cosign signature:
cosign verify-blob \
--bundle wolfstack-x86_64.cosign.bundle \
--certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
wolfstack-x86_64
Verify the build provenance:
gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack
Verify the SHA-256 checksum:
sha256sum -c SHA256SUMS
Artifacts
wolfstack-x86_64/wolfstack-aarch64/wolfstack-armv7— static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).wolfstack-<arch>.cosign.bundle— cosign signature bundle (cert + signature + Rekor entry).SHA256SUMS— checksums for both binaries.
For per-version history see CHANGELOG.md.
WolfStack v25.15.4
v25.15.4: image-watcher settings now converge on every cluster node
Docker image update notifications were silently absent on nodes that
were offline, being rebuilt, or joined the cluster after the operator
enabled the watcher: settings only ever propagated at the instant of a
save, to peers reachable at that moment, and a disabled watcher renders
as no badges and no errors (RutgerDiehard's Docker-29/Debian-13 hosts —
the Docker version was a red herring; the check pipeline is verified
working on Docker 29's containerd image store).
- ImageWatcherConfig gains cluster_rev, bumped on operator saves that
change a cluster-wide field. Propagation is rev-gated (stale pushes
ignored; legacy rev-0 senders keep the old always-apply behaviour so
mixed-version clusters still converge). - New GET /api/image-watcher/cluster-settings serves the cluster-wide
slice (host-local policies/history stripped); every node pulls its
same-cluster peers every 10 minutes (first pass 3 minutes after boot)
and adopts a strictly newer rev. - get_local_digest reads {{json .RepoDigests}} and picks the entry
matching the image's own repository, instead of {{index .RepoDigests
0}} which hard-errors on an empty list and can hand back a different
repo's digest on multi-tagged images. - The containers view now says outright when image update checks are
disabled on the node, with a link to the settings, instead of
rendering silent nothing.
Live-verified on Docker 29.7.2 + containerd image store (stale-tag
update correctly detected, repo-matched digest selection correct with
a second repo tag present). Runtime-unverified: the reconcile HTTP
round-trip (needs a two-node cluster) and the disabled-note rendering.
Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com
Claude-Session: https://claude.ai/code/session_011TNDGnAv8fJo9vX3nrFVK4
Verifying this release
Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.
Verify the cosign signature:
cosign verify-blob \
--bundle wolfstack-x86_64.cosign.bundle \
--certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
wolfstack-x86_64
Verify the build provenance:
gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack
Verify the SHA-256 checksum:
sha256sum -c SHA256SUMS
Artifacts
wolfstack-x86_64/wolfstack-aarch64/wolfstack-armv7— static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).wolfstack-<arch>.cosign.bundle— cosign signature bundle (cert + signature + Rekor entry).SHA256SUMS— checksums for both binaries.
For per-version history see CHANGELOG.md.
WolfStack v25.15.3
v25.15.3: AI chat works with newer Claude models that emit thinking blocks
call_claude read the reply as content[0].text, but newer Claude models
put a thinking block before the text block, so the parse failed and the
error path dumped the entire raw response JSON into the chat window
(Mancolt's Discord report). The parser now walks every content block,
joins the text blocks, and skips thinking/redacted_thinking/anything
else. When no text block exists at all (e.g. max_tokens exhausted
mid-thinking) the error reports stop_reason plus a short preview
instead of the full body. Fixes all four Claude call paths: chat loop,
health monitor, issue analysis, and simple_chat/test-connection.
The WolfAgents tool loop already handled block types correctly.
Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com
Claude-Session: https://claude.ai/code/session_011TNDGnAv8fJo9vX3nrFVK4
Verifying this release
Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.
Verify the cosign signature:
cosign verify-blob \
--bundle wolfstack-x86_64.cosign.bundle \
--certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
wolfstack-x86_64
Verify the build provenance:
gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack
Verify the SHA-256 checksum:
sha256sum -c SHA256SUMS
Artifacts
wolfstack-x86_64/wolfstack-aarch64/wolfstack-armv7— static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).wolfstack-<arch>.cosign.bundle— cosign signature bundle (cert + signature + Rekor entry).SHA256SUMS— checksums for both binaries.
For per-version history see CHANGELOG.md.
WolfStack v25.15.2
v25.15.2: 2.5GbE link speeds display as 2.5Gb/s, not 2Gb/s
Integer division in the sysfs speed formatter truncated 2500 Mb/s to
"2Gb/s". Fractional gigabit rates now render correctly.
Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com
Verifying this release
Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.
Verify the cosign signature:
cosign verify-blob \
--bundle wolfstack-x86_64.cosign.bundle \
--certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
wolfstack-x86_64
Verify the build provenance:
gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack
Verify the SHA-256 checksum:
sha256sum -c SHA256SUMS
Artifacts
wolfstack-x86_64/wolfstack-aarch64/wolfstack-armv7— static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).wolfstack-<arch>.cosign.bundle— cosign signature bundle (cert + signature + Rekor entry).SHA256SUMS— checksums for both binaries.
For per-version history see CHANGELOG.md.
WolfStack v25.15.1
v25.15.1: NIC boot persistence survives USB adapters that randomize their MAC
The v25.15.0 link-up record was keyed on the interface name; USB
adapters with no burned-in MAC get a new enx* name every boot, so the
record never matched again. Intents now also carry the USB device path
and permanent MAC, and boot re-matches a renamed adapter by hardware
identity.
Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com
Verifying this release
Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.
Verify the cosign signature:
cosign verify-blob \
--bundle wolfstack-x86_64.cosign.bundle \
--certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
wolfstack-x86_64
Verify the build provenance:
gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack
Verify the SHA-256 checksum:
sha256sum -c SHA256SUMS
Artifacts
wolfstack-x86_64/wolfstack-aarch64/wolfstack-armv7— static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).wolfstack-<arch>.cosign.bundle— cosign signature bundle (cert + signature + Rekor entry).SHA256SUMS— checksums for both binaries.
For per-version history see CHANGELOG.md.
WolfStack v25.15.0
v25.15.0: S3 remotes get health checks and bucket sync; USB NICs survive reboots; folder backup schedules are editable
New S3 suite on the Storage page: saved remotes with provider presets
and test-connection, 5-minute endpoint health probes that alert after
three misses, bucket create/delete, self-hosted Garage/MinIO/rclone
providers (Garage native one-click installer), and rclone-powered
bucket-sync jobs between any two remotes — copy-safe by default,
credentials injected per pass and never written to disk. rust-s3 now
fails on error statuses, fixing a latent backup bug where a 403 upload
"succeeded" storing nothing.
Also: a NIC brought up in the UI stays up across reboots (USB NICs
enumerate late and are retried), folder-based backup schedules can have
targets added and removed in the edit modal, the Bucket Sync card loads
on view entry, and deleted nodes no longer leave upgrade tasks spinning
"reconnecting" forever.
Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com
Verifying this release
Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.
Verify the cosign signature:
cosign verify-blob \
--bundle wolfstack-x86_64.cosign.bundle \
--certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
wolfstack-x86_64
Verify the build provenance:
gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack
Verify the SHA-256 checksum:
sha256sum -c SHA256SUMS
Artifacts
wolfstack-x86_64/wolfstack-aarch64/wolfstack-armv7— static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).wolfstack-<arch>.cosign.bundle— cosign signature bundle (cert + signature + Rekor entry).SHA256SUMS— checksums for both binaries.
For per-version history see CHANGELOG.md.
WolfStack v25.14.5
v25.14.5: packets for a node's own docker subnets no longer drop at the wolfnet edge
Follow-up to the v25.14.4 workload-subnet report (same reporter): the
sender now correctly creates 172.21.0.0/24 via the owner and encapsulates
to it, but the OWNER dropped the packet twice on the receive side.
-
wolfnetd's decap path only delivers to the TUN when the destination
matches an entry in subnet-routes.json pointing at the node's own
WolfNet IP — and the owner never had entries for its own subnets
(the file was {}). sync_subnet_routes_to_wolfnet now exports every
locally-owned workload CIDR mapped to the node's own WolfNet IP:
userspace entry only, never a kernel route (the connected bridge
route already covers it). Configured routes win on collision;
default bridge CIDRs stay excluded; v6 behind the existing gate.
No WolfNet change needed — its gw==self branch already delivers. -
dockerd's anti-direct-routing rule in the raw table
(-t raw PREROUTING -d ! -i docker0 -j DROP) discarded
the decapped packet before FORWARD/DOCKER-USER could accept it.
setup_wolfnet_forwarding now reconciles one scoped exception per
advertised workload subnet (-i wolfnet0 -d ACCEPT at head of
raw PREROUTING, marker-commented, stale ones swept), and the
gateway-route plumbing installs/removes the same exception for
operator-configured routes.
Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com
Claude-Session: https://claude.ai/code/session_019A7UsyWPgG9uoHKhStXWq2
Verifying this release
Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.
Verify the cosign signature:
cosign verify-blob \
--bundle wolfstack-x86_64.cosign.bundle \
--certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
wolfstack-x86_64
Verify the build provenance:
gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack
Verify the SHA-256 checksum:
sha256sum -c SHA256SUMS
Artifacts
wolfstack-x86_64/wolfstack-aarch64/wolfstack-armv7— static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).wolfstack-<arch>.cosign.bundle— cosign signature bundle (cert + signature + Rekor entry).SHA256SUMS— checksums for both binaries.
For per-version history see CHANGELOG.md.