v1.9.5 — stop prompting for location during registration (auto-derive from timezone)

Highlights

• Stop prompting for location during registration — the installer now auto-derives the carbon-reporting zone from the system timezone (OS zone.tab, no network) and, when none is detectable, provisions with no location rather than asking. Location is never prompted. (#354, #355, #356)
• Fix: rejected-zone failure hint now names the real source (TRACEBLOC_CLIENT_LOCATION override vs. timezone auto-derivation) instead of always blaming the timezone. (#357)
• Chart: bump client 1.9.4 → 1.9.5 (version + appVersion). (#359)

Also includes the earlier installer hardening sweep (bounded probes, tty handoffs, fail-closed guards) already on main.

Tracks #358.

What's Changed

• feat(installer): stop prompting for location during register — auto-derive from timezone (#354) by @saadqbal in #355
• fix(installer): attribute rejected-zone hint to its real source (Bugbot #356) by @saadqbal in #357
• main -> Stop prompting for location during registration, auto-derive from timezone by @saadqbal in #356
• chore(chart): bump client 1.9.4 → 1.9.5 (version + appVersion) by @saadqbal in #359
• main -> Release v1.9.5: location-drop + installer hardening by @saadqbal in #360

Full Changelog: v1.9.4...v1.9.5

v1.9.4 — installer hardening + prod ingestor digest pin + NO_PROXY metadata IP

Chart 1.9.4 — installer reliability/UX overhaul, prod-reproducible ingestor pin, and a proactive hardening sweep of the install path (bash + PowerShell).

• Installer run-through — restructured install-k8s.sh into steps a–f (CLI earlier, register before Helm), roadmap copy, spinners, honest N-of-M service-pull bar; assess.sh read-only stop-and-check gate short-circuits a healthy re-run to tracebloc; install.sh early-bailout when tracebloc doctor passes. (#341)
• Prod reproducibility (backend#1028) — client/values-prod.yaml pins images.ingestor to a verified multi-arch digest; base values.yaml keeps an empty digest for dev/staging; scripts/resolve-ingestor-digest.sh resolves/patches the pin.
• NO_PROXY default extended with 169.254.169.254 (cloud/link-local metadata) across Helm tracebloc.proxyEnv, cluster/k3d helpers, and Windows parity.
• Windows one-client guard (#200) reads clientId via ConvertFrom-Json (not YAML regex), so an unquoted id can't bypass it.
• Hardening sweep (#347–#353) — installer guards now:
  • never hang: --request-timeout on every kubectl poll/gate/diagnostic call; --connect-timeout/--max-time/stall-abort on downloads.
  • fail closed: one-client + #303 ownership guards (bash and PowerShell) refuse rather than overwrite when helm list/get values can't be read.
  • hand off cleanly under curl|bash: interactive CLI/prompts use /dev/tty (or /dev/null), never the install pipe.
  • plus bash-3.2-safe spinners and a PS 5.1 WSL-path fix.

Publishes to gh-pages via release-helm-chart.yaml → fleet auto-upgrade rolls prod.

Full Changelog: v1.9.3...v1.9.4

What's Changed

• test(provision): unit-test _account_owns_namespace / #303 preflight contract (refs cli#141) by @LukasWodka in #335
• fix(proxy): NO_PROXY covers the cloud metadata IP (chart + both installers) by @LukasWodka in #337
• feat(installer): stop-and-check gate — recognize an existing install by @LukasWodka in #339
• fix(installer): run the helm client install behind a spinner (no more silent ~10-15s) by @LukasWodka in #333
• chore(chart): prod-only ingestor digest pin (#1028 item 1) by @LukasWodka in #334
• docs(security): update §8.3 — backend tokens now bounded + revocable (#302) by @aptracebloc in #342
• fix(installer): Windows one-client guard reads clientId via ConvertFrom-Json (#200) by @LukasWodka in #340
• docs(supply-chain): document the Windows bootstrap (install.ps1) by @LukasWodka in #336
• feat(installer): first-time install run-through (1. Downloading / 2. Installing a–f) + healthy re-run bailout by @LukasWodka in #341
• test(drift): pin the CLI-assumed chart contract in check-drift.sh by @LukasWodka in #344
• test(e2e-proxy): deflake §4 — retry the squid Service-readiness race by @LukasWodka in #346
• fix(installer): resolve Bugbot findings on #345 (tty handoff, pinned-ref reinstall, jq split) by @saadqbal in #347
• fix(installer): healthy-machine hand-off gets a real terminal on stdout/stderr by @saadqbal in #348
• fix(installer): assess gate checks cluster is running before the Helm probe by @saadqbal in #349
• fix(installer): fail-closed one-client guard + bash 3.2 bootstrap spinner by @saadqbal in #350
• fix(installer): bound services progress-bar kubectl with --request-timeout by @saadqbal in #351
• fix(installer): proactive hardening sweep (bounded probes, tty handoffs, fail-closed guards) by @saadqbal in #352
• fix(installer): bash guard fails closed on unreadable client values (PS parity) by @saadqbal in #353
• main -> Enhance installer with pre-flight checks, user feedback, and digest pinning by @saadqbal in #345

Full Changelog: v1.9.3...v1.9.4

v1.9.3 — roll spawned ingestor to 0.7 (data-ingestors 0.7.0)

Chart 1.9.3 rolls the spawned ingestor to the 0.7 line (data-ingestors 0.7.0).

• images.ingestor.tag 0.6 → 0.7 (+ jobs-manager default fallback + helm-unittest golden) — #331
• Ingests: tabular schema-inference rules (data-ingestors#349), semseg mask_id contract (#358), minimum-image-size floor (#348). TSC #359 deferred.
• :0.7 is multi-arch (amd64+arm64); images.ingestor.digest stays floating → ingestion Jobs auto-resolve the current image (imagePullPolicy=Always).

Publishes to gh-pages via release-helm-chart.yaml → fleet auto-upgrade rolls prod.

What's Changed

• chore(chart): roll ingestor tag 0.6 → 0.7, bump chart 1.9.2 → 1.9.3 by @saadqbal in #331
• Sync develop → main for v1.9.3 chart release (ingestor 0.7) by @saadqbal in #332

Full Changelog: v1.9.2...v1.9.3

v1.9.2 — installer credential-leak fix (CWE-214) + curl|bash survival

Patch release of the tracebloc client Helm chart. Publishes everything unreleased since v1.9.0.

Security

• Stop leaking the client password on curl's argv (CWE-214) — #325. The installer no longer passes the credential as a command-line argument where it could be observed via the process table.

Fixes

• Survive curl|bash — #326 (customer-reported). Retries the name prompt, reads credentials from the terminal, and guards the package-index refresh so the piped-installer path no longer aborts.
• Ingestor default tag → 0.6 — #323 (previously landed as the unreleased 1.9.1).

Rollout

Publishing flips fleet-wide auto-upgrade — auto-upgrade-ON clients converge to 1.9.2 at their next :23 cronjob.

Tracked in #328.

What's Changed

• chore(chart): roll ingestor tag 0.5 → 0.6, bump chart 1.9.0 → 1.9.1 by @saadqbal in #323
• Sync develop → main for v1.9.1 chart release (ingestor 0.6) by @saadqbal in #324
• fix(installer): stop leaking the client password on curl's argv (CWE-214) by @LukasWodka in #325
• fix(installer): survive curl|bash — retry name prompt (customer-reported), read creds from terminal, guard pkg-index refresh by @LukasWodka in #326
• chore(chart): bump client 1.9.1 → 1.9.2 by @saadqbal in #329
• Sync develop → main for v1.9.2 chart release (installer cred-leak fix + curl|bash survival) by @saadqbal in #327

Full Changelog: v1.9.0...v1.9.2

v1.9.0 — installer first-run UX + ingestor default 0.5 + fixes

Client chart v1.9.0 (version + appVersion bumped in lockstep from 1.8.5).

Highlights

• feat(installer): first-run UX — interim slice of the v2 spec (copy, naming, location fix, clearer errors) (#307)
• fix(chart): default ingestor tag 0.3 → 0.5 (#314); inject proxyEnv into the resource-monitor DaemonSet (#312)
• fix(installer): configurable training size at install (#308); harden provision location + client-detect guards (#315)

Fixes & CI

• fix(tests): e2e-journey guards actually fail + CI timeouts/label trigger (#311); create_cluster in timeout-able bash (#316); path-persist red/green signal (#313); Step-4 uses offline data validate (#318)
• test: cross-repo fresh-shell last-mile E2E harness (install → CLI → cluster info → push) (#214)
• ci(helm): drop redundant schema job; rename colliding Lint/Unit test jobs (#280)

Full changelog: v1.8.5...v1.9.0

Tracked by #319.

What's Changed

• fix(#304): don't claim "verified on your PATH" when the current shell can't find tracebloc by @saadqbal in #305
• fix(#303): refuse a second client before minting, so we don't orphan one by @saadqbal in #306
• ci(helm): drop redundant schema job + fix Lint/Unit tests name collision by @LukasWodka in #280
• feat(installer): first-run UX — interim slice of the v2 spec (copy, naming, location fix, clearer errors) by @LukasWodka in #307
• fix(installer): make the training size configurable at install (TRACEBLOC_TRAINING_RESOURCES) by @LukasWodka in #308
• test: cross-repo fresh-shell last-mile E2E harness (install -> CLI -> cluster info -> push) by @LukasWodka in #214
• fix(tests): install-journey guard() asserted nothing + CI-config gaps (#310) by @saadqbal in #311
• fix(chart): inject proxyEnv into the resource-monitor DaemonSet by @LukasWodka in #312
• fix(tests): give path-persist a real red/green signal (off-PATH prefix + interactive per-shell) (#310) by @saadqbal in #313
• fix(chart): bump default ingestor tag 0.3 → 0.5 by @divyasinghds in #314
• fix(installer): harden provision location + client-detect guards (#309 bugbot) by @divyasinghds in #315
• fix(tests): run create_cluster in a timeout-able bash in e2e-journey by @saadqbal in #316
• fix(tests): e2e-journey Step 4 uses offline data validate instead of push --dry-run by @saadqbal in #318
• main: Fix installer issues and enhance first-run user experience by @saadqbal in #309
• chore(chart): bump client 1.8.5 → 1.9.0 (version + appVersion) by @saadqbal in #320
• Sync develop → main for v1.9.0 chart release (installer first-run UX + ingestor default 0.5 + fixes) by @saadqbal in #321

Full Changelog: v1.8.5...v1.9.0

v1.8.5 — R8 signed installer for Windows (install.ps1) + trust-root hardening

What's Changed

• security(R8): CODEOWNERS trust root + SHA-pin signing actions (client#282) by @saadqbal in #287
• R8 for the Windows installer: pin + cosign-verify install.ps1 (#283) by @saadqbal in #299
• chore(chart): bump client 1.8.4 → 1.8.5 (version + appVersion) by @saadqbal in #300
• chore(release): promote develop → main — R8 Windows installer + trust-root hardening (v1.8.5) by @saadqbal in #301

Full Changelog: v1.8.4...v1.8.5

What's Changed

• security(R8): CODEOWNERS trust root + SHA-pin signing actions (client#282) by @saadqbal in #287
• R8 for the Windows installer: pin + cosign-verify install.ps1 (#283) by @saadqbal in #299
• chore(chart): bump client 1.8.4 → 1.8.5 (version + appVersion) by @saadqbal in #300
• chore(release): promote develop → main — R8 Windows installer + trust-root hardening (v1.8.5) by @saadqbal in #301

Full Changelog: v1.8.4...v1.8.5

v1.8.4 — restore Step-5 verify canary + adopt-reconcile (RFC-0001 credential fix)

The client-side half of the RFC-0001 credential-handoff fix — companion to CLI v0.5.1 and the backend's synchronous Service Bus provisioning. Together they fix the bug where a freshly-provisioned client authenticated with the wrong identity and crash-looped; clients now connect on the first try.

Fixes

• Restore the Step-5 credential verify canary (reverts v1.8.3's skip-for-minted). The real cause of the Step-5 failure was a CLI bug (numeric dashboard id written as the auth username instead of the UUID; fixed in cli v0.5.1), so verify_credentials is a correct canary again — a bad credential fails loudly at install instead of crash-looping the pod.
• Idempotent re-run — reconcile an already-connected client in place (RFC-0001 §7.2). Re-running the installer reconciles the live release (helm upgrade, reusing the stored credential) instead of prompting, and heals a stale clientId to the client's UUID username.

Upgrade impact

None for running pods — templates + values are identical to v1.8.2; only the version and installer scripts changed.

Chart client 1.8.4 (appVersion 1.8.4).

Install

curl -fsSL https://tracebloc.io/i.sh | bash

Promotion: #294 (from #295, #298). Companion to cli v0.5.1 + backend #940.

Full Changelog: v1.8.2...v1.8.4

What's Changed

• fix(installer): skip Step-5 pre-verify for freshly-minted credentials (→ v1.8.3) by @saadqbal in #293
• fix(installer): restore Step-5 credential verify for minted creds (revert #293 → v1.8.4) by @saadqbal in #295
• fix(installer): honor TRACEBLOC_CLIENT_ADOPTED — reconcile a connected client in place (RFC-0001 §7.2 / #838) by @saadqbal in #298
• chore(release): promote develop → main — restore verify canary + adopt-reconcile (v1.8.4) by @saadqbal in #294

Full Changelog: v1.8.2...v1.8.4

v1.8.2 — hotfix: R8 installer (unbreak stamped install.sh + provision --name)

Hotfix for the RFC-0001 R8 installer. v1.8.1's signed installer was broken end to end — v1.8.2 fixes it. tracebloc.io/i.sh and releases/latest/download/install.sh | bash now work.

Fixes

• No longer errors "This installer wasn't stamped" — the release stamper globally-replaced the __TRACEBLOC_RELEASE_REF__ placeholder, clobbering install.sh's fail-closed guard (== "__TRACEBLOC_RELEASE_REF__" → == "v1.8.1") so the correctly stamped installer refused to run, for everyone. It now stamps only the DEFAULT_REF= line, and a new self-test runs the stamped installer to prove it clears the guard.
• Browser-auth provisioning passes --name — provision_client's tracebloc client create output is redirected to the log, so the CLI can't prompt and requires --name; every curl | bash install failed at Step 3. provision.sh now supplies the machine name (+ location) via TRACEBLOC_CLIENT_NAME / TRACEBLOC_CLIENT_LOCATION env or a /dev/tty prompt.

Chart client 1.8.2 (appVersion 1.8.2). Supersedes v1.8.1 — do not use v1.8.1 (its installer is broken).

Install

curl -fsSL https://tracebloc.io/i.sh | bash

Promotion: #290 (from #289).

What's Changed

• fix(installer): two R8 curl|bash install P0s — stamper guard-clobber + provision --name (→ v1.8.2) by @saadqbal in #289
• chore(release): promote develop → main — R8 installer fixes (stamper + provision --name) → v1.8.2 by @saadqbal in #290

Full Changelog: v1.8.1...v1.8.2

v1.8.1 — RFC-0001 R8 signed installer + egress-enforcement helm-test fix

Chart client 1.8.1 (appVersion 1.8.1). This release carries two payloads: a chart fix (egress-enforcement helm test) and the RFC-0001 R8 signed installer — the first release to publish a cosign-signed install.sh + manifest as release assets, backing the tracebloc.io/i.sh verified-bootstrap entrypoint.

Installer — RFC-0001 R8 (supply-chain-hardened bootstrap)

• Verified bootstrap (#281): install.sh pins sub-script fetches to this immutable tag, downloads manifest.sha256, verifies it with cosign keyless, and checks every fetched script's digest before running the privileged install. Dev escape hatch: TRACEBLOC_ALLOW_UNVERIFIED=1.
• Signed release assets: the sign-installer-manifest job stamps this tag into the published install.sh and attaches install.sh, manifest.sha256, manifest.sha256.sig, and manifest.sha256.cert.
• Provision before Helm (#279, #838): CLI install, tracebloc login, and tracebloc client create now run before the Helm install, so the minted credential + derived namespace feed the chart.
• Fixes: install the CLI on the stale-bootstrap path (#285); enumerate client releases jq-free in the one-client guard so a jq-less host can't fork a second release under a new namespace (#286).

Chart

• egress-enforcement-check: fail closed on TLS/transport errors, not just connect failures, and retry the probe to tolerate the standard-mode CNI reconciliation window (#274, #276).

Install

curl -fsSL https://github.com/tracebloc/client/releases/latest/download/install.sh | bash

Promotion: #284.

What's Changed

• fix(egress-enforcement-check): retry probe to tolerate standard-mode CNI reconciliation window by @saadqbal in #276
• chore(chart): bump client 1.8.0 → 1.8.1 by @saadqbal in #277
• Sync develop → main for v1.8.1 chart release (egress-enforcement-check standard-mode CNI fix) by @saadqbal in #278
• feat(installer): reorder — sign in + provision the client before Helm (#838) by @LukasWodka in #279
• feat(installer): immutable-tag pin + signed sub-script manifest for the curl|bash bootstrap (RFC-0001 R8) by @saadqbal in #281
• fix: Bugbot finding from promotion PR #284 by @shujaatTracebloc in #285
• fix: jq-free one-client guard (2nd Bugbot finding on #284) by @saadqbal in #286
• chore(release): promote develop → main (week of 2026-06-29) by @aptracebloc in #284

New Contributors

• @aptracebloc made their first contribution in #284

Full Changelog: v1.8.0...v1.8.1

v1.8.0 — network-mount datasets + in-cluster backend-reachability test

Network-mount datasets (backend#743) + in-cluster backend-reachability test (cli#90). Minor bump; inert on fleet auto-upgrade.

What this adds

• Datasets on a network mount, MySQL stays local (#262) — dataset PV hostPath parameterized (hostPath.datasetPath, default /tracebloc); installer sets /tracebloc-data only when HOST_DATASET_DIR is given. mysql + logs stay local.
• Backend-reachability helm test (#270) — a test-hook Job; dormant on install/upgrade, run via helm test <release>. Passes only on a full TCP+TLS+HTTP round trip; fails closed on TLS/cert errors (#274).
• Job resource-defaults fix (#260/#745); installer non-interactive credentials (#266); CI/security hardening (#263/#265); e2e-proxy egress tests (#264/#269).

Fleet impact: none on auto-upgrade

The dataset-path helper defaults to /tracebloc and is nil-guarded, so existing clusters render the identical PV path (incl. --reuse-values). Network-mount behavior only activates on fresh installs passing HOST_DATASET_DIR.

Full Changelog: v1.7.1...v1.8.0

What's Changed

• test(jobs-manager): lock spawned-job RESOURCE_REQUESTS/LIMITS default at 8Gi by @saadqbal in #260
• test(e2e-proxy): exercise application-pod egress through the proxy (Charité setup) by @LukasWodka in #264
• ci(security): add public-repo PII gate caller by @LukasWodka in #263
• ci: add concurrency cancellation + job timeouts to chart CI by @LukasWodka in #265
• feat(installer): fail fast when HOST_DATA_DIR is on a network filesystem by @saadqbal in #261
• feat(installer,chart): place datasets on a network mount while MySQL stays local by @saadqbal in #262
• feat(installer): non-interactive credentials + softer connect copy (#834) by @LukasWodka in #266
• test(e2e-proxy): deflake §4 app-egress — hermetic target + non-silent diagnostics by @saadqbal in #269
• feat: in-cluster backend-reachability helm test (WS3 / cli#90) by @saadqbal in #270
• chore(chart): bump client 1.7.1 → 1.8.0 (version + appVersion) by @saadqbal in #272
• fix(egress-reachability-check): fail closed on TLS/transport errors, not just connect failures by @saadqbal in #274
• Sync develop → main for v1.8.0 chart release (network-mount datasets, backend-reachability test, installer hardening) by @saadqbal in #273

Full Changelog: v1.7.1...v1.8.0