Skip to content

Abysslink Release Checklist

This checklist must be completed before tagging any release. Each milestone section lists the mandatory review items specific to that version.

v3.x / v4.0.0 — Status

The v3.0.0–v3.0.2 releases were gated by the automated CI release gates (lint, test, security scans, repro-check, claims-check) rather than a hand-written checklist section here. v4.0.0 was tagged but its release run failed at the sign/verify gates and was never published (fail-closed, by design); its draft is superseded.

v4.0.1 — Checklist (the actual launch release)

  • [ ] Release-pipeline fixes merged to main (PR #55): sign-job repo context + egress, verify gate binds to draft-release bytes (contents: write), package publishing moved behind the publish gate (publish-packages job), replace_existing_draft, install.sh fail-closed bundle gate.
  • [ ] Rehearsal tag v4.0.1-rc.1 runs GREEN end-to-end: published prerelease with abysslink_4.0.1-rc.1_checksums.txt.bundle asset (first-ever execution of the sign job's cosign v3 path).
  • [ ] v4.0.1 tag green: published release, .bundle present.
  • [ ] curl -fsSL https://raw.githubusercontent.com/abysslink/abysslink/main/install.sh | sh installs v4.0.1 and prints cosign bundle OK (with cosign installed).
  • [ ] cosign verify-blob --bundle per docs/VERIFYING.md Leg 1 passes (needs internet for the Sigstore trust root).
  • [ ] Post-publish docs flip: quickstart/faq version pins → v4.0.1, tap answer updated once the cask lands (operator: tap repo + HOMEBREW_TAP_GITHUB_TOKEN).
  • [ ] Security-surface review deltas since v3.0.2 (metrics/webui bind floors, audit chain, push gateways, kill-switch, dead-man switch) covered by the standing CI gates (claims-check 0 warnings — GATE-LNCH-04 sign-off).

v2.0.0 — Self-Hosted Backends & Fleet

  • [ ] AGPLv3 legal review: confirm no github.com/netbirdio/netbird/management/... package is transitively imported in the final binary. Run: 

    go mod why github.com/netbirdio/netbird/management
    The output MUST be (main module does not need github.com/netbirdio/netbird/management). If any AGPLv3 transitive import is found, engage legal review before proceeding with the release — the abysslink binary is Apache-2.0 licensed and must remain uncontaminated by AGPLv3 dependencies.

  • [ ] Verify go mod tidy leaves go.sum and go.mod clean (no unexpected deps added).

  • [ ] Run golangci-lint run ./... with the no-netbird-agpl depguard rule enabled — must exit 0 (no new violations).

Security Review

  • [ ] All NetBird REST calls use Authorization: Token <nbp_...> (not Bearer).
  • [ ] NetBird setup keys generated by abysslink are type: one-off with explicit expiry.
  • [ ] Management port is bound to loopback/overlay only (nb-mgmt-bind check passes).
  • [ ] nb-version check enforces ≥ v0.57.0 floor (CVE-2025-10678 fix).
  • [ ] No secrets appear in argv, audit log, or config YAML (API key, setup key are keychain-only).

Functionality

  • [ ] make lint test exits 0 on macOS 13/14 and Ubuntu 22.04/24.04.
  • [ ] abysslink doctor reports correct PASS/WARN/FAIL for all nb-* checks.
  • [ ] abysslink server netbird init --apply provisions the server (Linux path verified).
  • [ ] abysslink server headscale init --apply provisions Headscale (both OS paths).
  • [ ] Backend abstraction: backend.New returns correct adapter for all three types.
  • [ ] Tailscale v1 behavior is unchanged (regression test against v1.0.0 acceptance criteria).

v1.0.0 — Tailscale + CLI Foundation

(All v1.0.0 criteria were verified at release — archived here for reference)

  • [x] Single static binary, cross-compiled for darwin/amd64, darwin/arm64, linux/amd64, linux/arm64.
  • [x] abysslink up --apply runs full module convergence loop.
  • [x] abysslink doctor catches all footguns from the 7-file setup guide.
  • [x] Audit log and backup on every file mutation.
  • [x] golangci-lint clean; make lint test green.
  • [x] Tailnet Lock enabled by default; disablement secrets printed once.
  • [x] FileVault/LUKS fail-closed gate in abysslink doctor.
  • [x] ntfy bound to tailnet IP only, never 0.0.0.0.
  • [x] No telemetry.