-
v1.2.16
StableSome checks failedSecret Scan / gitleaks (push) Successful in 56slint / lint (push) Successful in 47sGolang Tests / test-go (push) Successful in 1m11sRust Tests / test-rust (rust/consumers/zen, cargo) (push) Successful in 3m46sRust Tests / test-rust (//rust/rperf-server:rperf, rust/rperf-server, bazel) (push) Successful in 4m24sPublish Release Artifacts / publish (push) Successful in 10m54sRust Tests / test-rust (rust/log-collector, cargo) (push) Successful in 3m53sRust Tests / test-rust (rust/rperf-client, cargo) (push) Successful in 3m49sRust Tests / test-rust (rust/srql, cargo) (push) Successful in 5m57sRust Tests / test-rust (rust/trapd, cargo) (push) Successful in 3m33sImage Security Scan / image-security (push) Has been cancelledSource Security Scan / source-security (push) Has been cancelledmfreeman451 released this
2026-04-16 19:40:55 +00:00 | 1779 commits to staging since this releaseServiceRadar v1.2.16
Package-managed agent release trust hardening, embedded verification-key delivery, and rollout safety fixes that remove local environment override chains from managed self-update.
Whats New
1.2.16
- Hardened package-managed agent releases so manifest verification now trusts only the build-time embedded release public key instead of
SERVICERADAR_AGENT_RELEASE_PUBLIC_KEYfrom local environment overrides. - Removed package-managed override support for updater path, runtime root, and seed binary path, and now validate the package-owned updater binary before activation to block unsafe local replacements.
- Stopped package-managed edge onboarding from distributing the managed release verification key through
agent-env-overrides.env, and ignore those protected keys if older bundles still carry them. - Embedded the release verification key into packaged agent builds and release runtimes so future managed rollouts do not depend on stale host-local trust-anchor state.
- Updated the managed agent release runbook and OpenSpec requirements to document the hardened package-owned trust boundary and the one-time migration expectation for older hosts.
Downloads
-
Source code (ZIP)
1 download
-
Source code (TAR.GZ)
1 download
- Hardened package-managed agent releases so manifest verification now trusts only the build-time embedded release public key instead of