{"assets":[],"channel":"stable","download_availability":{"evidence":{"checked_at":"2026-10-26T07:35:28.717541+00:00","historical_archive":{"checked_at":"2026-10-26T07:35:28.717541+00:00","newer_released_at":"2026-10-25T16:41:03.251Z","newer_source_commit":"eaf885551c5834f4bee56ea48be7b9eff768c66d","newer_stable_tag":"v0.12.8"},"original_attached_assets":0,"package_states":[{"exact_version_matches":0,"status":"default"},{"exact_version_matches":0,"status":"hidden"},{"exact_version_matches":0,"status":"processing"},{"exact_version_matches":0,"status":"error"},{"exact_version_matches":0,"status":"pending_destruction"},{"exact_version_matches":0,"status":"deprecated"}],"pipelines":[{"id":2557530819,"jobs":[{"artifact_archive_size":2098,"id":14573933200,"name":"create-release","status":"success"},{"artifact_archive_size":0,"id":14573933201,"name":"build-release","status":"skipped"},{"artifact_archive_size":0,"id":14573933205,"name":"publish-packages","status":"skipped"}],"ref":"v0.3.5","sha":"1d014bb9f6033e0f5aec459d559a3e03a6a7d0f9","status":"failed"}],"project_id":77676505,"schema":"sonny-historical-release-gap/v1","source_commit":"1d014bb9f6033e0f5aec459d559a3e03a6a7d0f9","tag":"v0.3.5"},"scope":"No downloads were recovered from the original release attachments or visible generic packages in the six recorded states. The recorded source/tag-bound pipelines failed; their release builds failed or were skipped and package publishing was skipped. This is not proof of absence from deleted, unrelated or container storage, and does not qualify historical runtime behavior.","status":"unrecovered_historical"},"notes_markdown":"v0.3.5 — Mesh authn/authz program + client mTLS flags\n\nThis release delivers the full mesh authn/authz program (7 sub-projects)\nplus the client-side mTLS CLI flags that make it usable end-to-end:\n\n  * mesh/identity foundation: Principal model, SPIFFE-style URIs,\n    per-type trust policy (node = cert-only, user = cert + getpwnam_r,\n    svc = cert + YAML allowlist), audit-log field standard.\n\n  * mesh/mtls: gRPC server credentials with mtls.Reloader for atomic\n    SIGHUP-driven cert hot-reload; unary + stream server interceptors\n    that extract the SPIFFE-ID from the peer cert and attach the\n    resolved Principal to every RPC ctx; client credentials helper;\n    PKCS#11 key loading via RFC 7512 pkcs11: URIs (ThalesGroup/crypto11)\n    for HSM-backed server keys.\n\n  * mesh/identity/sshkeys: OpenSSH authorized_keys parser + signature\n    verifier with username extraction from a structured comment\n    marker; v1 primitive for a future enrollment service.\n\n  * mesh/identity/pam: cgo-backed pam_acct_mgmt + pam_open_session\n    via msteinert/pam/v2; optional PAMChecker field on\n    store.TrustPolicyEngine.\n\n  * mesh/privsep: Supervisor.Spawn forks per-user workers via\n    os/exec.Cmd with SysProcAttr.Credential, optionally holding a\n    PAM session open for the worker's lifetime; SIGTERM → 5s grace →\n    SIGKILL stop; socketpair fd available for future IPC.\n\n  * mesh/authz: YAML policy file + default-deny RBAC engine with\n    built-in node / svc-readonly roles; gRPC unary + stream\n    interceptors returning codes.PermissionDenied; SIGHUP reload that\n    preserves prior state on parse failure.\n\n  * packaging/systemd: hardened sonny-mesh.service unit (User=sonny,\n    CAP_SETUID/CAP_SETGID only, full Protect*/syscall-allowlist\n    hardening; systemd-analyze security score 2.3 OK); Debian and RPM\n    packaging that creates the sonny system user and lays out\n    /etc/sonny/mesh/{,principals.d,authorized_keys.d} with correct\n    ownership.\n\n  * cmd/sonny/cli: new persistent --client-cert / --client-key /\n    --client-ca / --client-key-pin / --server-name flags on the mesh\n    parent command so 'sonny mesh nodes/sessions/push/attach/...' can\n    talk to mTLS-protected mesh nodes end-to-end.\n\nVerified live on lothiriel: server with self-signed SPIFFE cert,\nclient with full --client-* flag set, mesh nodes RPC returns the\nlive node list through the full interceptor chain. Insecure clients\ncorrectly rejected at TLS handshake.\n\nDeferred to follow-up releases:\n  * 3b: SSH-key enrollment RPC + 'sonny mesh login' CLI\n  * 5b: privsep wiring into actual session routing + 'sonny mesh\n    worker' subcommand\n\nSpec / plan / verification docs under docs/superpowers/{specs,plans}/.","product":"sonny","published_at":"2026-05-28T00:29:42.697Z","schema":"sonny-release/v1","source_commit":"1d014bb9f6033e0f5aec459d559a3e03a6a7d0f9","tag":"v0.3.5","verification":{"checksums_url":null,"historical_archive":{"checked_at":"2026-10-26T07:35:28.717541+00:00","newer_released_at":"2026-10-25T16:41:03.251Z","newer_source_commit":"eaf885551c5834f4bee56ea48be7b9eff768c66d","newer_stable_tag":"v0.12.8"},"scope":"No file hashes, download URLs or signature verification are claimed for this historical record.","signature_bundle_available":false,"signature_bundle_url":null,"signature_verified_by_importer":false,"source_notes":{"description_sha256":"d96e5027d184e2b00468dd5af1f66c6377c2821cf551f7bba72bcc3275171b84","extraction":"plain_release_description","scope":"Upstream description preserved in collector evidence; any SSH signature block is omitted from rendered prose and is not verified.","signature_verified_by_importer":false,"ssh_signature_block_sha256":"9a1f4ba806eafc62cbfa5bc6bb15da27ca613493944861b51d01df5647a7639a"}},"version":"0.3.5"}