What shipped, newest first.

Enterprise The audit head leaves the machine that wrote it. A hash-chained audit log proves less than it sounds when it lives on the machine under suspicion: an attacker who owns that machine can rewrite the chain and re-hash it to be self-consistent, and a chain checked against itself always agrees with itself. The head of the chain is now published to an external witness — a file on separately administered storage, or by mail — and compared on every cycle. A retroactive rewrite is reported as a critical finding naming the sequence number, what the witness holds and what the local log claims. It detects a rewrite; it does not prevent one, and the finding says so.

A fourth package: etminan-witness. The receiving side of the evidence, meant for a machine that is neither the verifier nor a monitored host. It opens no database, holds no key, needs no TPM and makes no network connection. Given a signed summary from op self-attest and a pinned identity it answers three questions: does the signature verify, did the counter advance, and is this summary too old? A replayed summary is refused, and a verifier that has quietly stopped emitting stops looking like a quiet one. Part of the free Standard edition.

Enterprise Four eyes over who may act. Dual control now covers the operator registry itself: op identity add and op identity revoke become a request a second, distinct administrator must co-sign, each as its own signed act. Nobody can grant themselves a second pair of hands. Air-gapped operation for segments with no route out refuses the outbound call before it is attempted rather than letting it fail, while attestation inside the enclave is untouched. Measured boot extends the quote to the boot chain — firmware, bootloader, kernel and initramfs — so the evidence covers how the machine came up and not only what ran afterwards.

Directory roles and portable evidence. An operator’s role can come from an Active Directory or LDAP group, and an unreachable directory stops nothing. op audit-export writes the trail as evidence a third party can verify with audit-export-verify and no other tooling of ours. Signed mapping reports for ISO/IEC 27001, PCI-DSS and SOC 2 join the NIS2 and DORA ones, all built from one shared evidence base so they cannot drift apart.

A fix that mattered more than any feature. A host that simply rebooted was permanently accused of forging its measurement log — the strongest accusation this product makes — and nothing recovered it. The host was honest; the verifier was comparing against a cumulative value belonging to the previous boot. It now re-reads from offset zero before calling a mismatch tampering: if the replay from the beginning reaches the value the TPM signed, that was a reboot, and it is adopted with a note rather than an alarm. If it does not, the critical finding stands.

Known limits, stated rather than discovered. arm64 packages are published and must not be deployed: the agent builds and links there, and no arm64 host has completed an attestation — on a virtualized guest IMA initialises before the TPM driver, so PCR 10 is never extended while the measurement log keeps filling and looks healthy. Three of the four hypervisor setup guides are written from vendor documentation rather than walked end to end. Directory-sourced roles were exercised against OpenLDAP and not against Active Directory.

Role-based access control — built in, and free. The verifier now runs a privilege-separated trust daemon, etminan-verifierd, and every operator action goes through it as op <command>. The daemon authenticates each call by kernel peer-UID (SO_PEERCRED) — no key files — and maps it to a registered identity with one of three roles: admin, operator (host-group scoped), or viewer. It is default-deny, and both allows and denials are written to the hash-chained audit log; an optional per-role TOTP second factor is available. RBAC is part of the free Standard edition, not an add-on.

One path for every trust-changing action. Enrolment, baseline approve/reject, exclusions, profile assignment and TLS/AK rotation — and the read/audit commands op review, op check, op exclude list and op verify-signatures — all run through the daemon under RBAC, so nothing bypasses authorization. The old key-file operator flow is retired; a root break-glass path remains for recovery.

Enterprise Dual control, re-platformed and impossible to quietly switch off. Four-eyes approval is now a co-sign by a second distinct authenticated identity, not a second key file. Which actions need four-eyes — and the threshold — live in an admin-latched, signed policy that is authoritative over the environment: a single operator can never turn it off or drop below two, because every change to the policy is itself four-eyes. op verify-signatures reconciles each co-signed batch and the policy row, so a hand-loosened row is a finding, not a silent bypass. Four-eyes now also covers exclude-create — the most trust-suppressing action there is.

Security-hardened, independently audited. The whole 0.10.2 line went through a full external-style security-code audit, validated on a VM. Among the results: a compromised host can no longer abuse the “catching up” state to hide a real mismatch or stall an alarm, and any measurements recorded while catching up are provisional — refused by op approve until a later genuine cycle confirms them against the signed PCR. Every four-eyes co-signer is re-validated as still-authorized at apply time; the plugin sandbox fails closed (a plugin never runs unsandboxed); TOTP codes are strictly one-time-use; and the audit log fails loud on a missing anchor instead of silently.

Packaged for Debian. The agent and the verifier — the verifier package now also carrying the etminan-verifierd daemon — install as signed .deb packages from one source at one version. The full op command surface is covered by bash/zsh/fish completions, and both binaries answer --version.

Enterprise Native SIEM output — CEF or LEEF over syslog. For a SOC that ingests syslog into Splunk, QRadar, Sentinel, or Elastic. Off by default; the switch is ETMINAN_SIEM_FORMAT=cef (or leef), and when on, one syslog event is emitted per finding and per signed operator action (op enroll, op approve/reject/exclude, TLS/AK rotation, identity-registry changes). Transport defaults to the local /dev/log socket, or ETMINAN_SIEM_SYSLOG_ADDR=host:port sends UDP to a remote collector; facility local0, with severity mapped critical→err / warning→warning / action→info. It’s an addition to the Slack/PagerDuty notification plugins, not a replacement — syslog only, no in-process HTTP — and it’s best-effort, so a broken syslog target never breaks a verification run. See Enterprise features.

Operator authorization becomes governed, with role separation, revocation, and host-AK rotation. Trust-changing actions were accountability-only — any operator could sign any of them. A signed, audit-chained authorization registry now governs who may do what, split into administrative and operational roles, with revocation. This is the foundation the RBAC identity registry and the etminan-verifierd daemon build on today, where operators are authenticated by Unix UID and reach every action through op. New op rotate-ak re-binds a host’s attestation key within the same TPM without discarding its baseline. See the operator guide.

Optional manufacturer EK-certificate verification at enrollment (op enroll <host> --ek-roots <dir>) adds the genuine-hardware layer for discrete TPMs: the verifier requires the host’s EK certificate to chain to a manufacturer root you supply. Paired with a detection-bypass fix — the agent now sends the IMA measurement log as raw kernel bytes, so the per-line template-hash binding holds even for a filename that isn’t valid UTF-8, which previously could dodge the check. Both are agent↔verifier wire changes (now behind explicit protocol versioning); upgrade the pair together. See the architecture.

Also in this release: a certified, signed plugin catalog (plugins list/install/update) with per-plugin execution sandboxing (plugins run as a dedicated unprivileged user); configurable notification templates with notify-preview and notify-test; shell autocomplete for both binaries. On the security side, AK enrollment now enforces the required key template, so a compromised host can’t get its attestation key trusted by submitting a software-generated one at enrollment.

Maintenance release — no user-facing changes.

Every alarm finding now carries a stable, machine-matchable kind field (e.g. pcr-mismatch, sla-exceeded) alongside the existing free-form text — so a PagerDuty/Slack/webhook rule can route or filter on category without parsing prose. Paired with new per-channel message formatting (ETMINAN_NOTIFY_<CHANNEL>_FORMAT): reshape one channel's message text purely via config, no plugin script edit needed. New Notification channels page covering the full contract.

The headline change: change-source (ticket-system) correlation moved from an in-process HTTP client to an external, allowlisted, hash-verified plugin process — the same model now formalized as the Etminan Plugin API, which also covers the new PagerDuty/Slack/generic-webhook notification channels introduced this release. Operators using change-source correlation need to install the plugin and allowlist its pinned hash — see Change-source correlation for the full walkthrough.

• New op rotate-tls command re-pins a host's TLS certificate fingerprint after its agent's keypair is regenerated, without a full re-enrollment.
• Package-manager correlation deepened: op review now also reports install/upgrade transaction timing and trust-store verification.

Every trust-changing action is now signed and recorded in a new self-contained, hash-chained audit log — no external tool required. op enroll, op reject, and op exclude revoke became signed operator actions carrying a --reason, which they previously didn't take at all.

• etminan-agent now watches every configured path with unprivileged fanotify and sweeps a changed file the instant a write completes, instead of waiting for the next hourly cycle.
• New centralized profile registry: etminan-verifier op assign-profile pushes a watched-path profile selection to a host, instead of requiring an operator to edit that host's own config directly.