tui-cert v1.0.1

tui-cert 1.0.1

Release notes (1.0.1): a maintenance release on tui-kit v0.4.4. The export file picker opens with the suggested <ca>.crt in the home directory already in its path field, now through the kit's InitialPath option instead of a simulated paste; enter alone still accepts it. Every command runs without a controlling terminal, so anything that would prompt fails fast instead of waiting behind the TUI, and status-line errors are cleaned of escape codes. No key, flag or --check change: the stable contract is untouched.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• 3460548 Take tui-kit v0.4.4: the export picker opens with InitialPath (#27)

tui-cert v1.0.0

tui-cert 1.0.0: stable

tui-cert 1.0.0 is the second stable tool of the tui-tools family. Stable means a frozen contract under semver: the keys, the flags and the --check JSON only grow in minor releases, and anything removed or changed waits for a major release announced one minor ahead. It has run a local CA for real services, a self-hosted Headscale and a Keycloak single sign-on, installs from apt, dnf, pacman and a static binary, and ships signed checksums, SBOMs and build provenance. This release also carries what those runs asked for (#24): x prints the CA certificate as PEM, ready to copy, and w there writes it to a file you pick; X imports a CA on another host from a paste or a file, tolerant of lost line breaks and panel borders, refusing a private key, and installs it certificate-only; t/T report done (with the trust store's count when it prints one) and show the output only on failure, on every distribution; the issue form's Owner takes a numeric uid:gid for a service in a container, previewed as such and looked up nowhere; and in every form a prefilled value is selected on focus so typing replaces it, and ctrl+u clears a field. Built with tui-kit v0.4.3.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• 96a5ae3 Local CA in practice: export/import, trust status, numeric owners, ctrl+u (#24) (#25)
• 7ef7268 Promote tui-cert to stable: 1.0.0 (#26)

tui-cert v0.3.1

tui-cert 0.3.1: CA dialogs say what each field takes

The local CA dialogs now show each field's format while it is empty: the extra names take DNS names or IPs separated by commas or spaces, the validity is in days, an empty owner means root and an empty directory shows the path it stands for. The review lists the names the certificate will carry, common name first and duplicates dropped. An owner that does not exist on the machine, such as the account of a service whose package is not installed yet, is refused in the dialog instead of failing at chown, and every form refusal is now shown inside the dialog rather than only in the status line behind it.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• ddbfa6c CA dialogs: show each field's format, list the SANs, check the owner (#22) (#23)

tui-cert v0.3.0

tui-cert 0.3.0: a local CA from the terminal.

• New screen 5, CAs: N creates a CA (ECDSA P-256 or RSA 3072, CA:TRUE pathlen:0), e issues a server certificate from it with DNS and IP SANs and the owner of the service that reads it (fullchain.pem and privkey.pem under /etc/tui-cert/issued//), x exports it (path, SHA-256 fingerprint, copy command), t and T trust and untrust it on this host (Debian and Ubuntu, Fedora and RHEL, Arch).
• The inventory names the local CA that issued each certificate and flags an issuer this system does not trust; new findings for a CA key readable by others, an expiring CA and a leaf that outlives its CA.
• --check lists local CAs with fingerprint, expiry and whether this host trusts them.
• Issuing needs OpenSSL 3.0 or newer.
• tui-kit v0.4.0.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• e7a7541 Bump anchore/sbom-action/download-syft (#3)
• 9d8c414 Bump anchore/sbom-action/download-syft in the github-actions group (#16)
• 960cee8 Bump the github-actions group with 4 updates (#18)
• 148e059 Local CA: create, issue, export, trust (#19) (#20)
• e4eeaee README: link the tool's page on tui.tools (#15)
• 62395ad README: point the install snippet at the current release (#14)
• f28625a Release 0.3.0: local CA; tui-kit v0.4.0 (#21)

tui-cert v0.2.1

tui-kit v0.3.0: the dialogs wrap and scroll instead of clipping the
command preview, and the picker filters as you type.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• 2a36146 Bump tui-kit to v0.3.0 (#13)

tui-cert v0.2.0

Manage, not view (wave 3): create what does not exist, edit what does; lab-validated.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, checksums.txt carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

Changelog

• b02d639 A code of conduct that fits on one screen (#9)
• 6205a70 Add --report, and a bug form that asks for it (#10)
• e14e6b9 Carry the OpenSSF Best Practices badge (#7)
• 18a4a88 Fetch the tag annotation before releasing (#5)
• c373404 Keep the leak check off the two lines that never carry a node name (#11)
• 0b269a3 Obtain an ACME certificate and install it where the server looks (#12)
• b1cf7dd Pin what CI runs, fuzz the parsers, and say the releases are signed (#2)
• 0e5de36 Print the whole tag message, not only its body (#6)
• e48bbdf Say beta once (#4)
• 471f320 Take tui-kit v0.2.8: hashed pip install, provenance bundle on the release (#8)

Changelog

• 1274169 Drop cross-repo dispatch; the package repo and the site poll releases
• e3794b5 Gate the release on a security job, and sign what it publishes (#1)
• c3015a0 Stop telling readers the packages are unpublished

Changelog

• cd78c64 Assert the absent-ACME-client path, which is the one every guest runs
• c9837fe Packages are available from pkgs.tui.tools
• 07538e2 Re-pin the kit at v0.2.3
• 1a4b123 Ship the tool as a .deb, an .rpm and a pacman package

Changelog

• 0c8683d Initial commit
• aa4a3a5 Turn the template into tui-cert