-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 15 Mar 2026 12:32:37 +0100 Source: klutshnik Architecture: source Version: 0.4.1-1 Distribution: unstable Urgency: medium Maintainer: Joost van Baal-Ilić <[email protected]> Changed-By: Joost van Baal-Ilić <[email protected]> Changes: klutshnik (0.4.1-1) unstable; urgency=medium . * New upstream, released 2026-01-23 (missed 0.3.0, released 2025-09-22). git commit log for both releases follows: . [ contributions by Enjeck C. aka patrathewhiz ] . [doc] Improve consistency [doc] Use consistent capitalization and formatting [doc] Improve docs . [ changes by Stefan Marsiske ] . [doc] reviewed and updated enjecks awesome contribution to all docs [doc] sadly funding ended [mod] new keys for rpi image seccomp rule test config due to hkdf->hash migration [mod] don't ignore failures during tests when generating seccomp rules [mod] use blake2 instead of hkdf to derive ltsig/noise keys from the client master key [fix] unit and e2e tests [mod] gh action uses zig v0.15.2 [mod] rpi img klutshnik-rev doesn't need to be in git [mod] removed commented out trace msg in client [doc] added todo handling cheaters in client [mod] new keys for test clients [mod] test config was one dir deeper [mod] moved sleep to a more sane location in start-servers [mod] changed the rpi image test keys due to the new client master key mechanism [mod] increased default timeout in rpi image to 15 sec [enh] use more generic rpi image test.sh without hardcoded keys [mod] server config moved to klutshnikd [mod] rpi image test/start-servers don't debug and handle SIGQUIT [fix] need to install zstd in docker rpi image builder [doc] comment why not use alpine v3.23 in build.env [doc] rpi image is zstd compressed [fix] read authorized_keys file correctly (as per zig v0.15.2) in server [mod] zig writergate cont'd, fixed other file.reader calls [fix] test/otherclient/klutshnik.cfg had a server stanza commented out [enh] test also full init, with completely new key values [mod] changed test setups to support clientkey instead of ltsig/noisekey [fix] truncate adduser pubkey if it is the long version [doc] document noise and ltsig key in whitepaper [doc] document init op change on website [mod] tail last 50 log lines in start server if ORACLE_TAIL is set [doc] document clientkey_path and init op in client manpages [enh] support new explicit add and del user ops in the server, in tls servers this is irrelevant [enh] modauth now distinguishes between add/del user, so that their noise key can be added/deleted from authorized_keys on klutshnik devices [enh] provisioning ble/usb devices has been streamlined [enh] init gets an extra parameter which automatically sets some values like ltsigpub [enh] ltsig and noise keys are derived from a master secret [fix] decrypt only needs t replies [mod] getcfg returns also the set of config files that contributed to the final cfg [mod] .gitignore update [mod] addes some checks for write return values in tuokms.c [fix] assert that pkid == req.id in toprf_update of server [enh] display url howto setup tls certs if none found [fix] make provision wait a bit longer for device to generate stuff [fix] don't abort during init/provision if servers cfg is incomplete [fix] name of usb device during provisioning [fix] init cmd in cli-ent [doc] added website sources [fix] got releasesafe working with bearssl [fix] building bearssl with ReleaseSafe [enh] add also seccomp profile as artifact [fix] path to seccomp dir [enh] added seccomp rule gen [mod] removed publishing debug server config/logs [fix] create missing keystores [mod] switched to Debug mode for zig for testing until bearssl ub is resolved [mod] added upload of test results even if fail [mod] make klutshnikd passable via environ arg to unittests [mod] increase timeouts for tests [fix] test dir name [mod] correct version attr in workflow [mod] use newer upload artifact [enh] added github action build-test-publish [fix] subshells don't play nice with the adding of child pids to env vars [fix] shellchecked easy-test and start-servers [fix] removed useless config vars from sbox.sh [mod] cc-runtime not needed anymore [mod] also clean strace log from test server [enh] added framework for generating seccomp bpf rulesets [enh] test.sh can do stracing of a server designated by ORACLE_STRACE and only tails log if ORACLE_TAIL points at a server [mod] added man/*.html to .gitinore [enh] added python end2end unittests [mod] give error on log if record exist when creating in server [mod] added a todo and a bit more verbose exception in client [enh] added html version of manpages [mod] renamed klutshnik.cfg to klutshnikd.cfg for server [mod] added optional device deps to setup.py [fix] provide default for keystore config variable [mod] created minimal readme for the python package [mod] changed homepage in setup.py [doc] added acknowledments to readme [doc] added funding section to readme [doc] add provisioning command to man file [fix] handle all possible klutshnik cfg filenames in provisioning [mod] moved provision-ble from klutshnik-zephyr into client [mod] update zig-bearssl dep in build.zig.zon and minimum reqd zig version [fix] don't link explicitly zig_bearssl [fix] some ssl variables are zero-initialized [enh] updated to compile using zig v0.15.1 [doc] added some layperson parseable about section to whitepaper [mod] switch to zstd compression for rpi images [mod] bumped to v0.3.0 [enh] initial commit of raspi image builder [mod] added extra check in create() of python client [fix] trailing backslash in uninstall deps list [fix] add missing uninstall target [fix] aarch64 has no stack-protection=full in libklutshnik.so makefile [fix] libsodium module in server [mod] updated build.zig.zon so that it includes a fix for https://github.com/jedisct1/libsodium/issues/1477 [fix] enable liboprf debug only on debug builds if liboprf is not a system_lib [fix] klutshnik init when no authorized_keys file exists [fix] don't abort klutshnik init if there is no authorized_keys file [enh] fix build.zig so that we can cross-compile klutshnikd [fix] make server 32bit ready [fix] add rules for man install targets [mod] added DESTDIR prefix to all man/makefile install targets [fix] made makefile more useful for packaging [enh] added support for pyoprf/multiplexer USB serial connected peers in client . * d/control: refer to https://klutshnik.info/ in python3-klutshnik extended description. * d/libklutshnik-dev.install: do not install usr/lib/x86_64-linux-gnu/pkgconfig/libklutshnik.pc/libklutshnik.pc but install u/l/x/pkgconfig/libklutshnik.pc . * d/patches/{makefile.patch,series}: re-enable makefile.patch, makefile.patch is now a one-line patch on makefile: honor $(CPPFLAGS) in default build rule. this fixes the Debian blhc test. Checksums-Sha1: 6b6645d30de66a0a00961ec9fcc94f114185d98a 2253 klutshnik_0.4.1-1.dsc 144d359ae32ba421899c89c377ec88683c261901 258970 klutshnik_0.4.1.orig.tar.gz 0c09e93897b4f85c586c1d8c8dffbab2f0ce6403 8612 klutshnik_0.4.1-1.debian.tar.xz 72d5e57830c7ad6a4aa262988851862df5260bde 7082 klutshnik_0.4.1-1_source.buildinfo Checksums-Sha256: 939c1e8976d5a2d238009ec80185d05af689067cefc737d7b272c6b7612ed264 2253 klutshnik_0.4.1-1.dsc 25ecc73648a92ce68664efb71089c9313e3bfe0589028aed59484872d61cf204 258970 klutshnik_0.4.1.orig.tar.gz c481ec51a1882ff6b0c88de64dc134a7fcbc26ac50977b5d306e88a390bcd3a1 8612 klutshnik_0.4.1-1.debian.tar.xz 6e8b7813828a5bff302af9b9c03318e5959fef4f8ed272ecdebaa6cf2eb935b7 7082 klutshnik_0.4.1-1_source.buildinfo Files: e5704a9970fba6239ead020f08b3f310 2253 utils optional klutshnik_0.4.1-1.dsc cfa36b72651b4cb93c3073a07a868776 258970 utils optional klutshnik_0.4.1.orig.tar.gz 26db07e48ceb9ac9757823bcef8c6509 8612 utils optional klutshnik_0.4.1-1.debian.tar.xz 88121865fe48975444d9a7e9baa72bd7 7082 utils optional klutshnik_0.4.1-1_source.buildinfo
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEkqrZAbIbS8eaR6AwVPGmYxdIZxMFAmm2y+MACgkQVPGmYxdI ZxN76w/+OMF8qOiZjgyH9K9PUVbyOO0wJH7P455baFf60X9SYABHhtSXjyTEHwSu /sczplc5eWoxRBzX0PhJxZ85D/ivhQqmcOrU6NXgrE3RIPp4/NGgd9QRV/2iNHX2 xphgKojLVSEFJNlDupTGiYQ735bm1+rBQxJkar1ELuNC/E/cufWjxwzvn+5UWIbu +NLNHdLvAEUcOM5J6GyJ4uwiDEXff1MRNCicCNc6llfKtH+U2uOntoidOtbdb3+5 Wj5lNxU6D2gjwRJznAxH3jiQXvKpo/Nxj56y0vbH1HUh4oa69s5bTOIU2K1i37+3 5juj01n8lS4Vmdcn+vB//uRPY2N/ToeEyMotGqmZC9NnM1lkY8/kSCbGxFX60CgA 82t0DTP+31K+r8Qy7ugkv+pM5/VUpLZnHpJEjZ91+6TWgxMMSzdul9VCU4S3tmzK OXo6mebWecnrhL4ikU1VphEWTypjF7F/W7Rw4zsCis+2QZ7ZTl/WnxbFNRTGMUaQ V6o3WKugGhyZ6WkgY3L66e6QobJxYKPPJB6No6HZRex6/lCktZLZmPhBpksVjhmQ peQJEcsC65DQqK+3aNZqClc3/NYrvgPeZwpQYF1gA7AgQ64AQGTxx2pfdpi2cMNa buOSM4egfJKVTnkFdgFIGAYGXx/u4Cv4fSUic8bXSnua3E9o7uc= =8Ix9 -----END PGP SIGNATURE-----
pgpHI3llyHgQd.pgp
Description: PGP signature
