v1.2.0: Catalog-sync visibility and alerting
The background catalog sync is now observable and it alerts you when it acts. A new catalogs status command, a rotating sync log, a desktop notification on a sync-hit quarantine, and a TUI quarantine card. No enforcement policy changed; same signed supply chain as every release.
Overview
Beekeeper v1.2.0 makes the background catalog sync observable and adds an alert when it acts. Before this release the hourly sync ran invisibly. On Windows it flashed a blank console and threw the output away, and a quarantine triggered by a sync produced no proactive signal. This release fixes that. It changes no enforcement policy and needs no config migration.
The hourly heartbeat is not the fetch rate
The most common point of confusion: the scheduled job runs every hour, but Beekeeper does not fetch threat intel every hour.
The hourly job is a heartbeat. Each run checks an interval gate before doing any work. The gate uses the configured catalog_sync.interval, which defaults to 2h and is configurable from 2h to 24h. If the interval has not elapsed since the last successful sync, the run prints sync skipped: not due and exits. So with the default you fetch at most once every two hours, and the wake-ups in between do nothing.
The heartbeat stays hourly on purpose. It keeps the worst-case lag low without rewriting the operating system schedule every time you change the interval. Change the cadence in config or in the dashboard, and the same heartbeat honors it.
Highlights
1. Silent, logged background runs
The scheduler now runs catalogs sync --background. In that mode Beekeeper hides its console window on Windows, so the hourly heartbeat no longer flashes a blank terminal. On macOS and Linux the job already ran detached, so there was nothing to hide.
On every platform, a background run tees its output to a rotating log at <state>/logs/sync.log. That is the durable record of what each run did. Before this release, macOS discarded the output and Windows lost it with the console window.
2. See the last result with catalogs status
beekeeper catalogs statusreports the most recent run: the result (synced, unchanged, skipped, disabled, or error), the entry count, how many installed packages matched the catalog, how many were quarantined or pending, the next-due time, whether the background daemon is registered, and the log path. The dashboard catalogs panel shows the same summary as a last sync line.
3. An alert when a sync quarantines a package
When a sync makes the catalog index fresher, the first responder cross-references your installed packages against the updated index. A match that meets the corroboration threshold (auto_quarantine.threshold, default 2) is reversibly moved to quarantine when auto-quarantine is enabled, and now:
- A desktop notification fires (Windows toast, macOS Notification Center, or Linux
notify-send), so you are alerted with the dashboard closed. A headless Linux box with no display sends nothing. Dry-run mode audits the hit and sends no "quarantined" notification, because nothing moved. - The dashboard raises a catalog-quarantine card with human-gated
[r]estore,[p]urge, and[a]cknowledge. Restore and purge run in the quarantine panel, with confirmation. Purge is never automatic.
Quarantine is always a reversible move. The destructive purge stays human-gated.
Download and verify
Like every release, v1.2.0 is reproducibly built, cosign-signed (keyless, via GitHub Actions OIDC), and ships SLSA Level 3 provenance and a CycloneDX SBOM.
Release assets include signed binaries, checksums, SLSA L3 provenance, and a CycloneDX SBOM.
Verification
gh -R home-beekeeper/beekeeper release download v1.2.0 --pattern "checksums.txt" --pattern "checksums.txt.sigstore.json" --pattern "multiple.intoto.jsonl" --pattern "beekeeper_1.2.0_linux_amd64.tar.gz*"cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json --certificate-identity-regexp '^https://github\.com/home-beekeeper/beekeeper/' --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'slsa-verifier verify-artifact beekeeper_1.2.0_linux_amd64.tar.gz --provenance-path multiple.intoto.jsonl --source-uri github.com/home-beekeeper/beekeeper --source-tag v1.2.0Examples use the linux_amd64 archive; swap _linux_amd64.tar.gz for your platform (_darwin_arm64.tar.gz, _windows_amd64.zip, and so on). A CycloneDX SBOM (*.cdx.json) is also attached for dependency auditing. See Installation for per-OS verification.
Notes
No enforcement behavior changed and there is nothing to migrate. To make an already-installed sync daemon run silently and write the log, re-register it once with the v1.2.0 binary:
beekeeper catalogs daemon install