mirror of
https://github.com/rkivalin/certforge.git
synced 2026-10-30 00:06:21 +00:00
Roman KivalinandClaude Opus 4.6
c717da348a
Support key_mode, key_owner, key_group and cert_mode, cert_owner, cert_group per certificate. Mode is an octal string (e.g. "0640"), owner/group are resolved by name via getpwnam/getgrnam. Permissions are checked before applying — system calls are only made when the current state differs from the desired state, and changes are logged. Runs on every renew for existing files, not just when certificates are renewed. Defaults: key 0600, cert 0644, owner/group unchanged. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
61 lines
2.2 KiB
Plaintext
61 lines
2.2 KiB
Plaintext
certforge (0.7.0-1) unstable; urgency=low
|
|
|
|
* Custom file permissions for key and certificate files
|
|
|
|
-- Roman Kivalin <roman@shl.dev> Mon, 14 Apr 2026 00:00:00 +0000
|
|
|
|
certforge (0.6.0-1) unstable; urgency=low
|
|
|
|
* Named hooks with per-certificate reference and cross-cert dedup
|
|
* Multiple listen addresses for HTTP-01 and TLS-ALPN-01 solvers
|
|
* Fix inline hooks ignoring --dry-run flag
|
|
* Improve config validation
|
|
* dane-check verifies published TLSA records against expected values
|
|
* Configurable DNS propagation delay per solver
|
|
|
|
-- Roman Kivalin <roman@shl.dev> Mon, 14 Apr 2026 00:00:00 +0000
|
|
|
|
certforge (0.5.0-1) unstable; urgency=low
|
|
|
|
* Support multiple zones per DNS client with automatic zone matching
|
|
* Config validation for domain/DANE zone matching
|
|
* Don't bind systemd-creds to a specific credential name
|
|
* Fix wildcard certificate DNS-01 challenges
|
|
|
|
-- Roman Kivalin <roman@shl.dev> Sun, 13 Apr 2026 22:00:00 +0000
|
|
|
|
certforge (0.4.0-1) unstable; urgency=low
|
|
|
|
* Breaking: configuration format overhauled (named DNS clients, solvers, per-domain solver assignment)
|
|
* Support for HTTP-01 and TLS-ALPN-01 challenge solvers
|
|
* IP address certificates (IPv4 and IPv6)
|
|
|
|
-- Roman Kivalin <roman@shl.dev> Sat, 12 Apr 2026 23:00:00 +0000
|
|
|
|
certforge (0.3.0-1) unstable; urgency=low
|
|
|
|
* Add DNS propagation delay before ACME challenge validation
|
|
|
|
-- Roman Kivalin <roman@shl.dev> Sat, 12 Apr 2026 22:30:00 +0000
|
|
|
|
certforge (0.2.0-1) unstable; urgency=low
|
|
|
|
* Build on Ubuntu 22.04 for glibc 2.35 compatibility (Debian 12+)
|
|
|
|
-- Roman Kivalin <roman@shl.dev> Sat, 12 Apr 2026 22:00:00 +0000
|
|
|
|
certforge (0.1.0-1) unstable; urgency=low
|
|
|
|
* Initial release.
|
|
* ACME certificate issuance and renewal via DNS-01 challenges (RFC 8555)
|
|
* RFC 2136 dynamic DNS updates with TSIG authentication
|
|
* DANE TLSA record publication (RFC 6698/7671/7672)
|
|
* Key rotation with DANE pre-publication protocol
|
|
* ECDSA P-256 and P-384 key generation
|
|
* systemd credential integration (systemd-creds encrypt/decrypt)
|
|
* systemd unit reload/restart hooks via D-Bus
|
|
* TOML configuration with per-zone DNS overrides
|
|
* Systemd service and timer units included
|
|
|
|
-- Roman Kivalin <roman@shl.dev> Sat, 12 Apr 2026 18:00:00 +0000
|