v1.1.2: Hook fail-close fix + self-catalog key rotation

A reliability and security release. Agent-harness hooks now embed the absolute beekeeper binary path so a hook cannot silently fail open when beekeeper is off the PATH, and the embedded self-catalog signing key was rotated off a key whose private half lived in the test suite. No enforcement behavior changed; same signed supply chain as every release.

Overview

Beekeeper v1.1.2 is a reliability and security release. It changes no enforcement policy and needs no config migration, but it closes a way a hook could silently stop protecting you, and it rotates the self-catalog signing key.

Highlights

1. Hooks can no longer fail open

Agent-harness hooks were installed as the bare command beekeeper. If beekeeper was not on the PATH the harness captured at launch, the hook returned "command not found" (exit 127), which most harnesses treat as a non-blocking error, so the agent ran unprotected until the next restart.

Hooks now embed the absolute path to the beekeeper binary, so a hook cannot fail open this way. Detection, idempotency, and uninstall use an anchored matcher that migrates an existing bare-name entry in place and will not touch a third party's hook. Re-run beekeeper hooks install with the v1.1.2 binary to apply it.

2. Self-catalog signing key rotation

The beekeeper-self feed (Beekeeper's defense against its own supply-chain compromise) is verified against an Ed25519 key embedded in the binary. Through v1.1.1 that key's private half was the same value committed as the test key, so the signing key was effectively public. The impact was latent: no beekeeper-self feed has ever been published, so the channel only ever degraded safely. The key is now rotated to one whose private half is held only by the maintainer, and the test suite uses its own independent key. See the threat model for details.

Download and verify

Like every release, v1.1.2 is reproducibly built, cosign-signed (keyless, via GitHub Actions OIDC), and ships SLSA Level 3 provenance and a CycloneDX SBOM.

GitHub Release v1.1.2

Release assets include signed binaries, checksums, SLSA L3 provenance, and a CycloneDX SBOM.

Verification

Step 1: Download release assets

gh -R home-beekeeper/beekeeper release download v1.1.2 --pattern "checksums.txt" --pattern "checksums.txt.sigstore.json" --pattern "multiple.intoto.jsonl" --pattern "beekeeper_1.1.2_linux_amd64.tar.gz*"

Step 2: Verify cosign signature

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json --certificate-identity-regexp '^https://github\.com/home-beekeeper/beekeeper/' --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

Step 3: Verify SLSA L3 provenance

slsa-verifier verify-artifact beekeeper_1.1.2_linux_amd64.tar.gz --provenance-path multiple.intoto.jsonl --source-uri github.com/home-beekeeper/beekeeper --source-tag v1.1.2

Examples use the linux_amd64 archive; swap _linux_amd64.tar.gz for your platform (_darwin_arm64.tar.gz, _windows_amd64.zip, and so on). A CycloneDX SBOM (*.cdx.json) is also attached for dependency auditing. See Installation for per-OS verification.

Notes

No enforcement behavior changed and there is nothing to migrate. To activate the hook fail-close fix, reinstall the hook with the v1.1.2 binary (beekeeper hooks install --target <harness>).