Release Notes for v0.81.0

Highlights

🪪 Certificate Posture Checks

A new Certificate posture check requires peers to hold a device certificate issued by your own CA, and to prove they still have the private key by signing a challenge from management. A copied certificate without its key fails the check. Management repeats the challenge every 4 hours while the peer is connected, so a removed key or an expired certificate closes access within that window.

The client uses the operating system's own certificate stores: the Local Computer and user Personal stores on Windows (TPM-backed keys included), the System and login keychains on macOS (Secure Enclave keys included), and PEM files in /etc/netbird/certs, TSS2 key files, or a tpm2-pkcs11 token on Linux. Paste one or more root or intermediate CA certificates in the dashboard and attach the check to any access policy.

Requires management and client v0.81.0 or newer. The iOS and Android apps do not support certificate proofs and always fail this check.

📖 Requiring a device certificate · #7535, #8052, #7890, #8174, dashboard#798

🔗 nblink: forward into your network without root

nblink is a new standalone binary that forwards local ports into your NetBird network from an ordinary, unprivileged process. It runs the client in userspace mode, so there is no TUN device, no root, no installer, and /etc/resolv.conf is never touched. Names on the upstream side resolve inside the tunnel.

It is built for places the regular agent cannot run: managed laptops without admin rights, rootless containers on OpenShift and Podman, CI jobs, MCP servers and local AI agents that need an internal API, and sidecars for apps that hardcode an HTTP endpoint.

nblink --forward 'http://3000=https://tickets.internal' --forward 'http://8080=https://grafana.internal'

With no setup key, nblink opens the browser for login and always prints the login URL, so the same command works over SSH. The peer carries a real identity, so what it can reach is decided by your policies. This release forwards HTTP; raw TCP, UDP and SOCKS5 are planned with the same --forward syntax.

Binaries ship for Linux, macOS and Windows (nblink_<version><os><arch>) on this release page, and as the netbirdio/nblink and ghcr.io/netbirdio/nblink container images.

📖 nblink · #7955

📋 Duplicate Policies

Access Control and Agent Network policies now have a Duplicate action in the row menu. It opens the create wizard pre-filled with every setting of the source policy, named <name> (copy), and nothing is saved until you click Add Policy. Groups, posture checks, resources, providers and guardrails are reused rather than cloned.

📖 Managing Policies · dashboard#841

🛣️ Path-based access control for Reverse Proxy services

HTTP targets of a Reverse Proxy service can now override the service's authentication for their path. Under a target's Optional Settings, choose an Access action:

Action Behavior Use service authentication Apply the authentication configured on the service (default). Bypass authentication Skip SSO, password, PIN and header authentication for this path. CIDR, country and CrowdSec restrictions still apply. Block access Return 403 without contacting the backend.

A service can require SSO on /, bypass authentication for webhook receivers or health checks on /webhooks/ or /healthz, and block /admin/ or /metrics from the public domain entirely. Matching uses the longest case-sensitive literal prefix, and when any target uses an access action the proxy rejects ambiguous paths (.., //, encoded separators) with 400 before matching. Targets that override the default are marked in the services list.

Upgrade every proxy in the cluster before using these actions; older proxies ignore them and keep applying the service authentication. Bypass authentication is unavailable for NetBird-Only services and Agent Network targets.

📖 Per-target access actions · #8114, #8115, #8116, #8117, dashboard#823

Deprecation: MySQL store

MySQL support for the Management store is deprecated and will be removed in an upcoming release. If your self-hosted deployment runs on MySQL, migrate to PostgreSQL before then. SQLite and PostgreSQL remain fully supported.

This release adds netbird-mysql-migrate, a tool that moves your deployment's data into PostgreSQL. See the migration guide: https://docs.netbird.io/selfhosted/migration/mysql-to-postgresql

What's New

🔒 Security and Access Control

• Added the Certificate posture check, with a hardened client, fresh challenge nonces, recovery from stuck proof collections, and fixes for remaining edge cases. #7535, #8052, #7890, #8174
• Used single-use codes for the OIDC session handoff between management and the proxy, and renamed the session code query parameter. #7635, #7981
• Enforced strict base64url decoding for JWT validation in management and the proxy. #7554
• Refactored the PKCE verifier store into a reusable single-use store. #7634
• Added a revocation guard hook to the proxy token API. #7732
• Returned a permission-denied error when a setup key is expired or invalid, instead of a generic failure. #8086

🖥️ Client Improvements

• Added nblink, an unprivileged forwarder into the network. #7955
• Replaced the eBPF WireGuard proxy with loopback endpoint addressing, removing the eBPF dependency for kernel-mode relayed connections. #7316
• Stopped one unreachable relay from churning connections on the others, and stopped offering to every peer when the relay transport drops. #8098, #7092
• Kept the advertised ICE session ID when following a remote restart, avoiding unnecessary reconnects. #7814
• Cached the box shared key per remote peer in the Signal client, and cached the interface check shared by ICE agents. #7807, #8001
• Configured the userspace device through its typed API and reused one wgctrl client in the kernel configurer. #7937, #7912
• Discovered interfaces lazily in stdnet instead of at construction. #7346
• Forced interactive login when extending the auth session, evaluated the session deadline against the wall clock, and dropped the pending login flow when a login switches profile. #7216, #7959, #7882
• Kept the updater silent until management decides the update mode. #7455
• Gated settings updates on value, not on field presence. #7398
• Added debug cpu start and stop commands for CPU profiling. #7749
• Classified Windows local accounts by NetBIOS name. #7628
• Fixed the Windows UI exiting on first launch, and closed the UI before InstallValidate in the MSI. #8138, #7395
• Fixed the browser login popup shown from the daemon, and kept the delete-profile dialog open until the delete finishes. #7408, #7752
• Added RTL layout support and Galician (gl) localization to the desktop UI, warned on missing translations, and only offered locales listed in _index.json. #8076, #7041, #8090, #8091

📱 Mobile

• Coalesced peer list change notifications to the Android and iOS listener. #7546
• Generated the Android debug bundle to a file. #7528
• Resolved the Android network route peer by HA unique ID instead of scanning the full status. #7705
• Skipped late session warnings on desktop and scheduled them in the app on Android. #7548

⚙️ Management Improvements

• Exposed peer MAC addresses and made peers searchable by MAC. #6553
• Added an account setting to return an error on peer name collision during AddPeer. #8154
• Refreshed only affected peers on DNS zone, DNS record and IPv6 settings changes. #8050, #8051
• Emitted activity events for batch group operations. #8180
• Added a MySQL to PostgreSQL migration tool. #8095
• Made the Let's Encrypt challenge listener address configurable for management and signal. #7706
• Tore down only the peer session that owns the stream. #8057
• Updated proxy mappings on peer IP change and the reserved IP exclusion when generating peer IPs. #8139, #8144
• Expanded loaded snapshots in place, reducing allocations on network map computation. #8177
• Cleaned up Agent Network configuration on account deletion and added a disabled state to the managed Agent Network proxy API. #7812, #7744
• Switched to libopenapi for managing the OpenAPI-based API, and added the tenant delete endpoint to the spec. #8056, #8054
• Improved Base62 encoding and decoding performance and robustness. #3391
• Removed ingress ports. #8062
• Extracted a shared database connection and data repository, and handled connection close on error. #7649, #7740
• Fixed the login filter, created HttpConfig before applying TLS flag overrides, and moved the child-account check. #7739, #8168, #8195

🔀 Reverse Proxy

• Added per-target HTTP access actions (use service authentication, bypass, block), backed by middleware snapshot revisions and container E2E coverage. #8114, #8115, #8116, #8117
• Required a private proxy cluster for cluster and direct upstream targets. #7984
• Added an option to refuse private addresses on direct-upstream dials. #7913
• Fell back to the IdP for the proxy session email when the token does not carry one. #8112

📡 Signal and Relay

• Fixed a race in Relay server shutdown. #7607
• Stopped Signal with an error when a server fails, instead of continuing half-started. #8105

🏗️ Infrastructure and CI

• Added release-wired Red Hat UBI image variants for management, signal, relay and the combined server, sharing one license collection script. #8167, #7458, #7457, #7953, #8055
• Fixed Red Hat certification preflight artifact handling. #7947, #8111
• Fixed Traefik versioning and updated CrowdSec in the self-hosted setup. #8152
• Replaced the which dependency with command in configure.sh. #8007
• Added a Homebrew cask e2e test, moved the FreeBSD port test to 15.1, and reported both peers' state when the connect test times out. #7618, #7999, #7944
• Exempted Crowdin service PRs from title and docs checks. #7170
• Test fixes for the update message tests, peer IP allocation, and mysql-migrate container tests. #8000, #8173, #8121, #8128

📝 Misc

• Used ASCII hyphens in the LICENSE header and extended the copyright year to 2026. #8065, #8169

Dashboard (v2.95.0)

• Added the Certificate posture check with CA validation, SHA-256 fingerprints, and a mobile-unsupported warning. dashboard#798
• Added Duplicate to the Access Control and Agent Network policy row menus. dashboard#841
• Added per-target HTTP access controls for Reverse Proxy services, with access badges in target lists. dashboard#823
• Added a setting to fail on peer name collision. dashboard#851
• Added peer search by MAC address. dashboard#683
• Added OpenCode and Pi to Connect Agent with a provider and model picker, and showed which models "All Models" covers. dashboard#856, dashboard#816
• Streamlined Agent Network onboarding, adjusted it for existing empty accounts, and made sure it adds the user to Users. dashboard#822, dashboard#839, dashboard#840
• Drew the user view's agent policies from its peers. dashboard#820
• Prevented duplicate routing peers and fixed live routing peer creation in the Control Center. dashboard#836
• Showed enable and disable events for EDR and IdP sync integrations. dashboard#849
• Fixed searching group peers by owner and sortable column headers for Name, Metric and Domain. dashboard#818, dashboard#681
• Blocked search engines by default with robots.txt. dashboard#827
• Added a Red Hat UBI image variant (-ubi). dashboard#829
• Added Storybook with a visual regression check, and let the e2e suite run against a deployed dashboard. dashboard#843, dashboard#842
• Pointed bug reports and feature requests to Discussions, made Manage Plan a primary button, and updated announcements. dashboard#824, dashboard#828, dashboard#830, dashboard#848

New Contributors

• @a-elkaim made their first contribution in #6553
• @redouan-rhazouani made their first contribution in #3391
• @janekhaertter made their first contribution in #8065
• @B1NAR10 made their first contribution in #7041
• @emrcbrn made their first contribution in #8138

Full Changelog: v0.80.0...v0.81.0

Original source

Changelog

8c70f9e [management] fix peer ip allocation test (#8173)

e4ddd9a [management] Add a release-wired UBI image variant (#8167)

763da1b [relay] Add a release-wired UBI image variant (#7457)

f0182dd [signal] Add a release-wired UBI image variant (#7458)

a6e154a [misc] Extend the copyright year to 2026 (#8169)

ef2292d [client] Fix Windows UI exiting on first launch (#8138)

f6cfa77 [management] setting to return error on name collision during AddPeer (#8154)

66a28fd [client] Add nblink, an unprivileged forwarder into the network (#7955)

fe78417 [management] Create HttpConfig before applying TLS flag overrides (#8168)

57722d3 [proxy] Exercise target access through container E2E (#8117)

88f1a30 [signal] Stop with an error when a server fails (#8105)

7006113 [management] update reserved IP exclusion when generating peer IP (#8144)

cd22a9d [management] Configure per-target HTTP access actions (#8116)

1161616 [proxy] Enforce per-target HTTP access actions (#8115)

a7a2575 [proxy] Add middleware snapshot revisions (#8114)

5c9c64e [client] Reuse one wgctrl client in the kernel configurer (#7912)

01185ba [client] Configure the userspace device through its typed API (#7937)

67c2041 [management] update proxy mappings on peer IP change (#8139)

008cf47 [client, management] Recover from stuck proof collections and keep re-tracked accounts on the challenge refresher (#7890)

f0a40e4 [client, management] Harden the certificate posture client and keep challenge nonces fresh (#8052)

53a1455 [client, management] implement certificate posture check (#7535)

a5834fd [management,signal] Make the Let's Encrypt challenge listener address configurable (#7706)

fe0e904 [client] Drop the pending login flow when a login switches the profile (#7882)

3934e7c [client] Evaluate the session deadline against the wall clock (#7959)

3e85e40 [client] Cache the WireGuard interface check shared by ICE agents (#8001)

01d828d [management] Fall back to the IdP for the proxy session email (#8112)

06c4c20 [management] Tear down only the peer session that owns the stream (#8057)

515a01d [client] Force interactive login when extending the auth session (#7216)

834b0f6 [misc] Exclude tools/mysql-migrate from docker tests (#8128)

cc51a3e [misc] Skip mysql-migrate container tests on Windows (#8121)

a8a67f5 [client] Keep the updater silent until management decides the mode (#7455)

e392c58 [relay] Fix race in Relay server shutdown (#7607)

24cb7b7 [management] switch to libopenapi for managing of openapi-based api (#8056)

192d3d0 [infrastructure] Find per-arch preflight results in the Red Hat certify check (#8111)

6a38217 [management] Add a MySQL to Postgres migration tool (#8095)

Original source

Only testable code based on ongoing development.

What's Changed

• [client] Add an optional --allow-group flag restricting the daemon sockets by @lixmal in #7478
• [client] Profile ownership migration by @theodorsm in #7508
• [client] Profile ownership console user tofu by @theodorsm in #7529
• [Client] Surface readable Authz errors and add profile claim command by @theodorsm in #7540
• [client] Improve error surfacing for restricted daemon sockets by @theodorsm in #7704

Full Changelog: v0.80.0...v0.81.0-canary.pr-7407.1

Original source

Changelog

88d8baa Time the lost-collection wait from the oldest collection still running
2f66426 Merge branch 'certificate-posture-client' into rm_certs_posture_chk
ab75020 Fix the pending checks comments
6f0dcfe Accept only whole-second challenge windows of at least 30 seconds
a990266 Start the certificate challenge refresher only once the account manager is built
e02c382 Keep an account tracked for certificate challenges when it is tracked again during its refresh
d9f1a94 Let a lost proof collection go after ten deadlines, sharing the slots across engine restarts
23a7809 Merge certificate-posture-client into rm_certs_posture_chk
3d629c5 Close a PKCS#11 module that loads but cannot be used
f603251 Share the proof collection single-flight across engine restarts
d70249a Report no lost certificate when the engine stops during a proof collection
4ad5c16 Keep the newest posture checks pending whatever made their meta sync fail
0dab171 [management] Keep the certificate challenge comments to what the history does not say
f1ed3a7 [management] Send challenge refreshes down the path the rest of management uses
7cc95f6 [management] Bound one account's challenge refresh so it cannot starve the rest
3269d81 [management] Let the challenge refresh loop stop with the manager that owns it
3d9def7 [management] Register for renewal on pushed updates, not only on connect
c62cda3 [management] Register an account for renewal where its nonce is issued
a0fa325 [management] Derive certificate challenge nonces from the stored encryption key
4e42ccb [management] Renew challenges only for the peers that answer one
689ab05 [management] Pin the property that makes per-peer nonce state unnecessary
c2d2f76 [management] Make the certificate challenge window one knob to turn
f490f09 [management] Renew certificate challenge nonces on quiet accounts
eaf6bec Drop the certificate store directory from certproof.Config, which only NB_CERT_STORE_DIR sets
4b31962 Name the post-install permission helper in snake case and shorten the sysconfig certificate block
db24bd3 Keep free functions out of the method lists of PKCS11Store, URI and Challenger
fb56c2d Hold off the keychain helper only after a completed or timed-out run, independent of CA order
c2fe712 Clear the lint findings in certificate posture
b2a99b6 Ask a macOS user's keychain again only after an hour when it proved nothing
3b67491 Let the certificate proof helper read the PKCS#11 token from the environment on Linux
c50545c Search only the System keychain in the macOS daemon and only the login keychain in the user helper
f311fd5 Restrict the service environment file to root on every package install
ffbd896 Give the full import command for a keychain key netbird may not use, and correct the package doc
63642bb Keep the file check results of the latest-started system info refresh
2017987 Name NB_CERT_PKCS11_URI in the PIN-without-token error
260c149 Move the certificate posture README into the package doc and the docs site
c1520fe Install the RPM sysconfig file readable by root only and show the certificate posture variables
a45cbec Read the certificate store directory and PKCS#11 URI from the daemon environment, not the profile config
ea63acb Collect certificate proofs on the posture watcher instead of under the sync lock
9c4da8d Hold off system info gathering only while a timed-out one is still running
c5f2f6a End sudo option parsing before the macOS certificate helper binary
d85f2e5 Kill the whole macOS certificate helper process group when it times out
441cf94 Explain a macOS keychain key whose access list does not allow netbird
60776de Send recollected certificate proofs to management only when the proven chains changed
5764ddd Log what a successful certificate proof helper wrote to stderr
8b38697 Guard the applied posture checks across goroutines and keep refreshing proofs while a pending update times out
4da7a2e Start no system info gathering while a timed-out one is still running
bff0ea0 Retry posture checks whose meta sync timed out instead of dropping them
0cdcc9d Merge commit '09b19595f' into certificate-posture-client
09b1959 Add the certificate fields to the network map golden data
a66b3e0 Merge main through poc/certificate-posture
ea5cf82 Merge main into poc/certificate-posture
c39047e Refuse a TPM PSS signature request for the maximum salt length
eb5a98c [management] add tenant delete endpoint to openapi (#8054)
2b52936 [client] Skip late session warnings on desktop and schedule them in the app on Android (#7548)
5c3cca2 Test that the PKCS#11 URI stays out of the debug bundle and run the wrong-PIN test only on a disposable token
597f198 Document the PIN sources on CertPKCS11URI and keep the README PIN example off the command line
6d9b8e6 Use no user certificate store when the active profile's owner cannot be read
4209a78 Use no Windows user store when a domainless owner matches accounts of several domains
5682247 Collect certificate proofs again when the meta sync carrying them failed
f175e40 [client] stop offering to every peer when the relay transport drops (#7092)
0e46d95 Share a PKCS#11 login between sessions and send each PIN at most once at a time
44312b4 Check the store directory before listing it, refuse group-writable files, and reject a URI with two PIN sources
dc3101a Count the certificates field in the peer meta store test
53108c7 Accept the TSS2 emptyAuth boolean OpenSSL writes and persistent parents on 32-bit builds
ad03081 [management] Refresh only affected peers on IPv6 settings changes (#8051)
bc44cdc [client] Fix browser login popup show from go (#7408)
26fe2c5 [client] Clear the lint findings only the macOS and Windows runners see
cc12110 [client] Drop go.step.sm/crypto and the repo-wide upgrades it imposed
8d9e125 [client] Read TSS2 key files on go-tpm, checked against the library it replaces
6b3cfba [client] Resolve the Android network route peer by HA unique ID instead of scanning the full status (#7705)
1c7d87d [client,android] Generate debug bundle to file (#7528)
13ce674 Keep the certificate stores and TPM library out of the WebAssembly build
19c54b8 [management] Refresh only affected peers on DNS zone and record changes (#8050)
0cd27ca [management] Improve Base62 encoding/decoding performance and robustness (#3391)
8f138c0 Match the Windows profile owner by name instead of resolving it through the domain controller
86c5ca0 Use platform absolute module paths in tests and add a real owner session test for Windows
6262325 Explain a Windows certificate whose key only a legacy CryptoAPI provider holds
a12f19c Trust certificate and key files only when no other user can write or redirect them
7b8fa29 [self-hosted] Replace "which" dependency by "command" from configure.sh script (#8007)
0892712 Refuse PKCS#11 URIs that this client cannot honour instead of widening the match
249793d Document where an inline PKCS#11 PIN is stored and how it is protected
88b26bb [infrastructure] Create the preflight artifacts directory before submitting (#7947)
3c4358d [management] Require a private proxy cluster for cluster and direct upstream targets (#7984)
e89acf5 [client] Take the caller's context and the lock when collecting proofs
58142f3 [client] Let a wedged proof collection go, instead of disabling proofs for good
73655fb [client] Clear the lint findings only the macOS and Windows runners see
278f2f3 [management] Derive certificate challenge nonces from the stored encryption key
8d22607 [client] Drop go.step.sm/crypto and the repo-wide upgrades it imposed
a7f183c [client] Read TSS2 key files on go-tpm, checked against the library it replaces
dc4d0e0 [management] Renew challenges only for the peers that answer one
dee68fa [management] Pin the property that makes per-peer nonce state unnecessary
0e38fcf [management] Make the certificate challenge window one knob to turn
7ad4a0d [management] Renew certificate challenge nonces on quiet accounts
3e360eb [client] Drop the unreachable helper timeout from certificate proof collection
ec48a92 [client] Cover the cert proof helper path the deadline actually cuts short
8224e0f [client] Bound the wait on a certificate proof helper that outlives its launcher
9f8ddc7 [client] Discover interfaces lazily in stdnet instead of at construction (#7346)
1b89880 [misc] Move the FreeBSD port test to release 15.1 (#7999)
e2678d4 [management] expose peer MAC addresses and make peers searchable by MAC (#6553)
0712a5a [management,proxy] Rename the OIDC session code query parameter (#7981)
0ed3eb6 Test the PKCS#11 build against SoftHSM in CI and warn once where the build has no driver
07cf082 Collect certificate proofs again when the owner's session changes and report lost proofs
a91fe94 Read user certificates only from the session of the active profile's owner
e0b6a38 Require a token label whenever a PKCS#11 PIN is set
f400f4b [proxy] Optionally refuse private addresses on direct-upstream dials (#7913)
5ceca6e [client] Report both peers' state when the connect test times out (#7944)
3906295 [client] Add Homebrew cask e2e test (#7618)
6425b04 [client] Only treat LocalSystem as a privileged identity by SID on Windows (#7889)
3cfff34 Find a chain to each challenge's CAs through every intermediate the store holds
21be442 Keep the macOS keychain code out of iOS and the PKCS#11 driver out of Android
06bc8bf Never pass NULL to CFRelease and skip unreadable keychain identities
b364af9 Bound PKCS#11 driver sizes, pin template values, and log out only a login the session owns
59aeeb1 Skip certificate files whose key belongs to another certificate
5af909b Sign only nonces and peer keys of the size management issues
0129b90 Log certificate posture details at debug level
a230d39 Stop retrying a PKCS#11 PIN the token rejected
83e7bf8 Bound certificate proof collection so a stuck token or keychain cannot hold the sync loop
ab2f897 Read the PKCS#11 token PIN from NB_TPM_PIN instead of the profile config
0641f0d Isolate the cert proof helper from the service environment and cap its output
82e5428 [management] Let usage_viewer read Agent Network access logs (#7750)
fd1a020 [management] Clean up after account deletion (#7812)
6c453a0 [client] Add debug cpu start and stop commands (#7749)
0dc729c [client] Cache the box shared key per remote peer in the Signal client (#7807)
e72be66 [client] Keep the advertised ICE session ID when following a remote restart (#7814)
39de33c [management] handle db conn close on errpr (#7740)
96bfcc3 [client] Classify Windows local accounts by NetBIOS name (#7628)
8ab34fc [proxy] Apply the upstream HTTP version before cloning transports (#7806)
8edc120 [client] Replace the eBPF WireGuard proxy with loopback endpoint addressing (#7316)
574c299 add unsupported flag for mobile devices
30dd076 [management,proxy] Use single-use codes for OIDC session handoff (#7635)
7ff709f [client] Keep the delete-profile dialog open until the delete finishes (#7752)
10a04fc [management] Add a disabled state to the managed Agent Network proxy API (#7744)
93cb226 [management] fix login filter (#7739)
082aca1 [management] Refactor PKCE verifier store into a reusable single-use store (#7634)
a2919e2 [management, proxy] Enforce strict base64url decoding for JWT validation (#7554)
e830903 [management] Add a revocation guard hook to the proxy token API (#7732)
782c943 [management] extract shared db conn + data repository (#7649)
002755c [infrastructure] Fix flow auth secret for external Relay migrations (#7731)
164d92e [client] Stop dumping the whole device to clear one peer endpoint (#7632)
7fbde60 split cert and key location and allow key lookup on tpm
d04aef6 add tpm pin to netbird config
d3c5b67 Merge branch 'main' into poc/certificate-posture
af7b475 go mod tidy
a2e66a7 Merge branch 'main' into poc/certificate-posture
47318da update goreleaser
92d76ac split goreleaser to support pkcs11 and exclude on docker
25078c4 Merge branch 'main' into poc/certificate-posture
24f5f2a start TPM support
d89e9c8 Merge remote-tracking branch 'origin/main' into poc/certificate-posture
e0ede59 read the signed-in user's certificate store on Windows
422912e read the console user's keychain through a user session helper
068f218 add keychain and cert store support
6c910ed Merge branch 'main' into poc/certificate-posture
aea3f4f log signal address
8c5cf86 Merge remote-tracking branch 'origin/main' into poc/certificate-posture
84d83fa implement certificate posture check

Original source

What's Changed

• [client] Stop dumping the whole device to clear one peer endpoint by @riccardomanfrin in #7632
• [infrastructure] Fix flow auth secret for external Relay migrations by @bcmmbaga in #7731
• [management] extract shared db conn + data repository by @pascal-fischer in #7649
• [management] Add a revocation guard hook to the proxy token API by @bison in #7732
• [management, proxy] Enforce strict base64url decoding for JWT validation by @bcmmbaga in #7554
• [management] Refactor PKCE verifier store into a reusable single-use store by @bcmmbaga in #7634
• [management] fix login filter by @pascal-fischer in #7739
• [management] Add a disabled state to the managed Agent Network proxy API by @bison in #7744
• [client] Keep the delete-profile dialog open until the delete finishes by @heisbrot in #7752
• [management,proxy] Use single-use codes for OIDC session handoff by @bcmmbaga in #7635
• [client] Replace the eBPF WireGuard proxy with loopback endpoint addressing by @lixmal in #7316
• [proxy] Apply the upstream HTTP version before cloning transports by @bison in #7806
• [client] Classify Windows local accounts by NetBIOS name by @thomashacker in #7628
• [management] handle db conn close on error by @pascal-fischer in #7740
• [client] Keep the advertised ICE session ID when following a remote restart by @mlsmaycon in #7814
• [client] Cache the box shared key per remote peer in the Signal client by @lixmal in #7807
• [client] Add debug cpu start and stop commands by @lixmal in #7749
• [management] Add account deletion hooks and delete agent network configuration with the account by @bison in #7812
• [management] Let usage_viewer read Agent Network access logs by @jnfrati in #7750
• [client] Only treat LocalSystem as a privileged identity by SID on Windows by @lixmal in #7889
• [client] Add Homebrew cask e2e test by @pappz in #7618
• [client] Report both peers' state when the connect test times out by @pappz in #7944
• [proxy] Optionally refuse private addresses on direct-upstream dials by @bison in #7913
• [management,proxy] Rename the OIDC session code query parameter by @bcmmbaga in #7981
• [management] expose peer MAC addresses and make peers searchable by MAC by @a-elkaim in #6553
• [misc] Move the FreeBSD port test to release 15.1 by @pappz in #7999
• [client] Discover interfaces lazily in stdnet instead of at construction by @riccardomanfrin in #7346
• [management] Require a private proxy cluster for cluster and direct upstream targets by @mlsmaycon in #7984
• [infrastructure] Create the preflight artifacts directory before submitting by @jnfrati in #7947
• [self-hosted] Replace "which" dependency by "command" from configure.sh script by @PizzaLovingNerd in #8007
• [management] Improve Base62 encoding/decoding performance and robustness by @redouan-rhazouani in #3391
• [management] Refresh only affected peers on DNS zone and record changes by @mlsmaycon in #8050
• [client,android] Generate debug bundle to file by @pappz in #7528
• [client] Resolve the Android network route peer by HA unique ID instead of scanning the full status by @pappz in #7705
• [client] Fix browser login popup show from go by @pappz in #7408
• [management] Refresh only affected peers on IPv6 settings changes by @mlsmaycon in #8051
• [client] stop offering to every peer when the relay transport drops by @riccardomanfrin in #7092
• [client] Skip late session warnings on desktop and schedule them in the app on Android by @pappz in #7548
• [management] add tenant delete endpoint to openapi by @pascal-fischer in #8054
• [self-hosted] Add a UBI image variant for the combined server by @jnfrati in #7953
• [misc] Share one license collection script across the UBI images by @jnfrati in #8055
• [misc] Use ASCII hyphens in the LICENSE header by @janekhaertter in #8065
• [client] Gate settings updates on value, not on field presence by @riccardomanfrin in #7398
• [client] Add RTL layout support to the desktop UI by @heisbrot in #8076
• [management] fix the concurrency handling within the update message tests by @pascal-fischer in #8000
• [client] feat(i18n): Add Galician (gl) localization for desktop client by @B1NAR10 in #7041
• [client, android, ios] Coalesce peer list change notifications to the mobile listener by @pappz in #7546
• [management] remove ingress ports by @pascal-fischer in #8062
• [client] Warn on missing translations and check placeholders by @thomashacker in #8090
• [client] Only offer locales listed in _index.json by @thomashacker in #8091
• [client] Close the UI before InstallValidate in the MSI by @pappz in #7395

New Contributors

• @a-elkaim made their first contribution in #6553
• @redouan-rhazouani made their first contribution in #3391
• @janekhaertter made their first contribution in #8065
• @B1NAR10 made their first contribution in #7041

Full Changelog: v0.80.0-rc.1...v0.81.0-canary.pr-7395.1

Original source

Release Notes for v0.80.0

What's New

🔒 Security and Access Control

Refused to pin an agent network gateway onto another account's host, adding cross-account validation for gateway assignments. #7519

Validated proxy cluster on Agent Network bootstrap, preventing an agent network from bootstrapping onto another account's proxy cluster. #7402

Refused HTTP redirects on IdP clients, preventing open redirect attacks against identity provider integrations. #7579

Revoked local Dex session on embedded IdP password change, ensuring sessions are properly invalidated when credentials are updated. #7556

Added upload URL signing and rate limiting for file upload endpoints. #7502

🖥️ Client Improvements

Staged install script downloads in a private temp directory, preventing other processes from tampering with downloaded files before installation. #7534

Enforced HTTPS on install script downloads, ensuring all client downloads use secure connections. #7545

Fixed peers not being notified when the relay connection drops, which could leave stale peer state after a relay disconnect. #7490

Fixed session deadline read under the status read lock, preventing a potential race condition. #7550

Removed the empty GPO DNS policy store on Windows teardown, cleaning up leftover DNS policy entries when the client shuts down. #7563

Resolved the shared socket source address through a connected UDP probe socket, fixing source address resolution for shared socket mode. #7633

Validated saved service parameters and pinned the netsh lookup on Windows, hardening the service configuration path. #7584

Used POSIX-style file read/write of JSON on Windows, improving cross-platform config file handling. #7631

Raised the daemon IPC receive limit to 16 MB, matching gRPC's default and preventing truncation of large messages. #7676

Skipped route firewall rule computation when no firewall is configured, avoiding unnecessary work. #7624

Fixed device dump clearing all peer endpoints instead of just the target one, which could disrupt connections to other peers. #7632

Fixed Windows IPC privilege check to only treat LocalSystem as a privileged identity by SID. Local Service and Network Service now go through the same checks as any other caller. #7889

Bumped Wails to v3.0.0-beta.25 for the desktop UI. #7640

⚙️ Management Improvements

Sped up test store setup and summarized unit test runs, improving CI performance. #7518

Read X-Real-IP when extracting the peer connection IP, supporting deployments behind reverse proxies. #7561

Handled empty trusted peer to avoid errors when no trusted peer is configured. #7589

Named the account owner in the pending approval error, making it clear who to contact for account approval. #7533

Fixed group resource validation for proper enforcement. #7608

Added store support to filter by public ID. #7208

Recorded proxy version on connect for tracking and debugging. #7630

Split store by table for improved database performance and organization. #7646

Prevented deleting custom domains used by services, protecting active proxy configurations from accidental removal. #7515

Moved rate limiter to shared package for reuse across services. #7727

Let usage_viewer read Agent Network access logs, so users reviewing cost can now see the requests behind usage metrics. #7750

🔀 Reverse Proxy

Closed the client connection on private service denials instead of leaving it hanging. #7590

Added proxy rate limiter to protect against abuse. #7568

Added proxy credentials limiter on management to throttle authentication attempts. #7569

Fixed upstream HTTP version applied before cloning transports. #7806

Added release-wired UBI image variant for the proxy. #7464

Fixed flow auth secret for external Relay migrations. #7731

🏗️ Infrastructure and CI

Certified the rootless UBI client image on release for Red Hat ecosystem compliance. #7525

Fixed RPM metadata for Red Hat software certification (two rounds of fixes). #7562, #7614

Added proxy support to enterprise setup. #7651

Built the upload server from source, nonroot on Chainguard for a hardened container image. #7663

Built and linted mobile Go code in CI for Android. #7641

Bumped workflow actions off the retired Node 20 runtime. #7644

Added Pyroscope profiling to management, signal, and proxy services. #7536

Pointed the agent-config e2e providers at the mock upstream. #7542

Used the Silo image for the S3 upload test. #7619

📝 Misc

Pointed bug reports at Discussions and added SUPPORT.md. #7647

Added cloud API spec to the public OpenAPI definition with REST client. #7222

Loaded AGENTS.md every session and refused attribution trailers. #7544

What's Changed

[management] Speed up test store setup and summarize the unit test run by @mlsmaycon in #7518

[management] Refuse to pin an agent network gateway onto another account's host by @mlsmaycon in #7519

[management] Validate the proxy cluster an agent network bootstraps onto by @mlsmaycon in #7402

[management] Point the agent-config e2e providers at the mock upstream by @mlsmaycon in #7542

[client] Stage install script downloads in a private temp directory by @riccardomanfrin in #7534

[client] Read the session deadline under the status read lock by @pappz in #7550

[client] Enforce HTTPS on install script downloads by @riccardomanfrin in #7545

[misc] Load AGENTS.md every session and refuse attribution trailers by @mlsmaycon in #7544

[client] Fix - Add RPM metadata required for Red Hat software certification by @braginini in #7562

[management] Read X-Real-IP when extracting the peer connection IP by @bcmmbaga in #7561

[management] Handle empty trusted peer by @bcmmbaga in #7589

[proxy] Close the client connection on private service denials by @mlsmaycon in #7590

[management] Name the account owner in the pending approval error by @heisbrot in #7533

[proxy] add proxy rate limiter by @pascal-fischer in #7568

[management] Add proxy credentials limiter on management by @pascal-fischer in #7569

[client] Fix peers not being notified when the relay connection drops by @pappz in #7490

[management] fix group resource validation by @pascal-fischer in #7608

[client] Remove the empty GPO DNS policy store on Windows teardown by @lixmal in #7563

[management] add store support to filter by public id by @pascal-fischer in #7208

[client,management] Skip route firewall rule computation when no firewall by @riccardomanfrin in #7624

[management] record proxy version on connect by @pascal-fischer in #7630

[management,signal,proxy] add pyroscope profiling by @pascal-fischer in #7536

[client] Validate the saved service parameters and pin the netsh lookup by @riccardomanfrin in #7584

[client] Use POSIX style file read/write of json for windows by @theodorsm in #7631

[client] Fix RPM metadata for Red Hat certification by @braginini in #7614

[misc] Bump workflow actions off the retired Node 20 runtime by @heisbrot in #7644

[misc] Add upload URL signing and rate limiting by @bcmmbaga in #7502

[misc] Use the Silo image for the S3 upload test by @Silex in #7619

[management] split store by table by @pascal-fischer in #7646

[management] Refuse HTTP redirects on IdP clients by @bcmmbaga in #7579

[management] Revoke local Dex session on embedded IdP password change by @bcmmbaga in #7556

[misc, android] Build and lint the mobile Go code in CI by @riccardomanfrin in #7641

[client] Raise the daemon IPC receive limit gRPC's to 16 MB by @riccardomanfrin in #7676

[misc] Build the upload server from source, nonroot on Chainguard by @bison in #7663

[infrastructure] Certify the rootless UBI client image on release by @braginini in #7525

[client] Resolve the shared socket source address through a connected UDP probe socket by @lixmal in #7633

[proxy] Add a release-wired UBI image variant by @jnfrati in #7464

[infrastructure] Add proxy support to enterprise setup by @bcmmbaga in #7651

[doc] Point bug reports at Discussions and add SUPPORT.md by @thomashacker in #7647

[management] Prevent deleting custom domains used by services by @mlsmaycon in #7515

[management] move rate limiter to shared package by @pascal-fischer in #7727

[client] Bump wails to v3.0.0-beta.25 by @pappz in #7640

[client] Stop dumping the whole device to clear one peer endpoint by @lixmal in #7632

[infrastructure] Fix flow auth secret for external Relay migrations by @braginini in #7731

[proxy] Apply the upstream HTTP version before cloning transports by @mlsmaycon in #7806

[management] Let usage_viewer read Agent Network access logs by @jnfrati in #7750

[client] Only treat LocalSystem as a privileged identity by SID on Windows by @lixmal in #7889

New Contributors

@thomashacker made their first contribution in #7647

Full Changelog: v0.79.0...v0.80.0

Original source

What's Changed

• [management] Speed up test store setup and summarize the unit test run by @mlsmaycon in #7518
• [management] Refuse to pin an agent network gateway onto another account's host by @mlsmaycon in #7519
• [management] Validate the proxy cluster an agent network bootstraps onto by @mlsmaycon in #7402
• [management] Point the agent-config e2e providers at the mock upstream by @mlsmaycon in #7542
• [client] Stage install script downloads in a private temp directory by @riccardomanfrin in #7534
• [client] Read the session deadline under the status read lock by @pappz in #7550
• [client] Enforce HTTPS on install script downloads by @riccardomanfrin in #7545
• [misc] Load AGENTS.md every session and refuse attribution trailers by @mlsmaycon in #7544
• [client] Fix - Add RPM metadata required for Red Hat software certification by @braginini in #7562
• [management] Read X-Real-IP when extracting the peer connection IP by @bcmmbaga in #7561
• [management] Handle empty trusted peer by @bcmmbaga in #7589
• [proxy] Close the client connection on private service denials by @mlsmaycon in #7590
• [management] Name the account owner in the pending approval error by @heisbrot in #7533
• [proxy] add proxy rate limiter by @pascal-fischer in #7568
• [management] Add proxy credentials limiter on management by @pascal-fischer in #7569
• [client] Fix peers not being notified when the relay connection drops by @pappz in #7490
• [management] fix group resource validation by @pascal-fischer in #7608
• [client] Remove the empty GPO DNS policy store on Windows teardown by @lixmal in #7563
• [management] add store support to filter by public id by @pascal-fischer in #7208
• [client,management] Skip route firewall rule computation when no firewall by @riccardomanfrin in #7624
• [management] record proxy version on connect by @pascal-fischer in #7630
• [management,signal,proxy] add pyroscope profiling by @pascal-fischer in #7536
• [client] Validate the saved service parameters and pin the netsh lookup by @riccardomanfrin in #7584
• [client] Use POSIX style file read/write of json for windows by @theodorsm in #7631
• [client] Fix RPM metadata for Red Hat certification by @braginini in #7614
• [misc] Bump workflow actions off the retired Node 20 runtime by @heisbrot in #7644
• [misc] Add upload URL signing and rate limiting by @bcmmbaga in #7502
• [misc] Use the Silo image for the S3 upload test by @Silex in #7619
• [management] split store by table by @pascal-fischer in #7646
• [management] Refuse HTTP redirects on IdP clients by @bcmmbaga in #7579
• [management] Revoke local Dex session on embedded IdP password change by @bcmmbaga in #7556
• [misc, android] Build and lint the mobile Go code in CI by @riccardomanfrin in #7641
• [client] Raise the daemon IPC receive limit gRPC's to 16 MB by @riccardomanfrin in #7676
• [misc] Build the upload server from source, nonroot on Chainguard by @bison in #7663
• [infrastructure] Certify the rootless UBI client image on release by @braginini in #7525
• [client] Resolve the shared socket source address through a connected UDP probe socket by @lixmal in #7633
• [proxy] Add a release-wired UBI image variant by @jnfrati in #7464
• [infrastructure] Add proxy support to enterprise setup by @bcmmbaga in #7651
• [doc] Point bug reports at Discussions and add SUPPORT.md by @thomashacker in #7647
• [management] Prevent deleting custom domains used by services by @mlsmaycon in #7515
• [management] move rate limiter to shared package by @pascal-fischer in #7727
• [client] Bump wails to v3.0.0-beta.25 by @pappz in #7640

New Contributors

• @thomashacker made their first contribution in #7647

Full Changelog: v0.79.0-rc.1...v0.80.0-rc.1

Original source