Skip to content
ssoossh

Release notes

Per-release notes are generated from the git log at tag time. For what changed in any given version, see the GitHub releases:

This page carries only what lives nowhere else: the build floors and the revocation stance. For what ssoossh does today, and for what is coming, see How it works and the roadmap.

Revocation

Section titled “Revocation”

Deliberately not included, and not an oversight. Certificates are short-lived by design – minutes, not years – so they expire faster than a revocation list could reasonably be distributed. Expiry does that work. The reasoning is in Decisions.

Section titled “PAM module: what it links”

pam_ssoossh links only libraries the operating system already ships, so which of them is resident in sudo is a property of the host rather than of the module. OpenSSL 1.1.1 is a hard floor, set by RHEL 8; a build against anything older fails at compile time.

Artifacts are built per platform rather than to one lowest common denominator, which is what the -glibc-openssl3, -glibc-openssl1.1 and -musl names on a release distinguish. See Installing pam_ssoossh.

Client packages

Section titled “Client packages”

Linux (.deb/.rpm), Windows (a per-machine .msi for amd64, and the .zip for both architectures), and macOS (a Developer ID signed and notarized .pkg per architecture, plus the .zip for anyone who would rather unpack it by hand; the binary inside both is quill-signed and notarized).