v0.0.17 — authenticated catalog sources, and a powered-off worker no longer blocks updates

Released 2026-07-21.

Highlights

A catalog source can now require a credential to add. Some Stores need you to prove who’s asking before they’ll share their catalog; adding one now supports that, and it shows an “authenticated” badge once set up. This is separate from the credential a private app image might need to run — one is about reading the catalog, the other about running what’s in it.
Catalog signatures got stronger, and a source’s signing key can now be rotated or revoked with no action from you. If a source publishes a new signing key, Buddy picks it up on its own; the Store screen shows whether a source’s catalog is signed this way, how many keys are currently valid, and warns ahead of a key nearing its expiry.
A worker that’s simply switched off no longer stops every other node’s software updates from completing. Previously, one powered-down machine could make every fleet-wide update report as failed, even though every reachable node updated cleanly. A node that’s offline when an update starts is now set aside with a dated reason instead, the rest of the fleet updates normally, and the set-aside node catches up automatically the moment it’s back online — no action needed from you.

One specific detail of the fix above — that a node dispatched an update but never returning is left on its old, working software rather than half-updated — was confirmed by testing, not by an actual power failure during a real update; live confirmation of that exact scenario is still owed.