Lacuna TrustBridge changelog

TrustBridge has two release lines, and they release independently:

• Server: the container image trustbridge-server:<version>. Entries are headed Server X.Y.Z.
• Workstation: the Workstation Service and the Tray App in one MSI, TrustBridge-Workstation-<version>-x64.msi. Entries are headed Workstation X.Y.Z.

A Server and its workstations talk over a versioned workstation protocol. A Server accepts its own protocol and the one before it, so the usual order is: upgrade the Server first, then the fleet, at most one protocol behind. Workstation 1.5.0 is the exception: it and Server 1.13.0 go together.

Server	Workstation protocols accepted
1.15.0 – 1.24.0	5–6 (a protocol 5 machine connects and serves every session but a per-transaction one)
1.13.0 – 1.14.1	4–5 (a protocol 4 machine connects and signs for sessions already bound to it, but is never offered a new session)
1.9.0 – 1.12.0	3–4
1.7.0 – 1.8.0	2–3
1.3.0 – 1.6.1	1–2
1.0.1 – 1.2.0	1 (no Workstation release speaks it)

Workstation	Protocol	Server needed
1.8.1 – 1.10.0	6	1.20.0 or later (Server 1.15.0 to 1.19.0 keeps it connected but takes no Workstation Report; Server 1.23.0 or later shows the console Workstation 1.10.0 reports)
1.8.0	6	1.20.0 or later (Server 1.15.0 to 1.19.0 admits it, but closes its connection when its Workstation Report is larger than 32 KB)
1.6.0 – 1.7.0	6	1.15.0 or later
1.5.0	5	1.13.0 to 1.24.0 (from Server 1.15.0, never chosen for a per-transaction session)
1.4.0 – 1.4.2	4	1.9.0 to 1.12.0 (Server 1.13.0 to 1.14.1 admits it but sends it no new sessions; Server 1.15.0 refuses it)
1.1.0 – 1.3.0	3	1.7.0 to 1.12.0 (1.8.0 or later recommended from Workstation 1.2.0)
1.0.0 – 1.0.1	2	1.3.0 to 1.8.0

A machine with a newer protocol than its Server's window is refused at the handshake, receives no PKI licence, and every certificate on it reads UNTRUSTED until the Server is upgraded. A machine with an older protocol than the window is refused as needing an update.

A Server release that updates the database model applies its migrations at start, and the previous version then refuses to start against that database: rolling back means restoring the database backup taken before the upgrade, not just switching the image tag back.

Workstation 1.10.0 (2026-10-26)

Package TrustBridge-Workstation-1.10.0-x64.msi, workstation protocol 6.

Upgrade notes: deliver it with Server 1.20.0 or later, as 1.9.0, and with Server 1.23.0 or later to see what it adds. Both additions ride protocol 6 unchanged: an earlier Server ignores the console, and records a session-start PIN prompt the machine could not show as Undeliverable alone. No configuration key is added. In the updated Group Policy templates, the explanation of Report this machine's condition to the TrustBridge Server says the report names the account signed in at the console.

New features

• The Workstation Report carries the machine's console: the Console Account signed in at the console session (its SID, and its DOMAIN\user name where it resolves), or nobody; whether that session is locked; whether a Tray App is attached there, and its version; and how many other sessions have a Tray App attached, without naming their accounts. The Workstation Service reads the account and the lock itself, so they are reported while no Tray App runs. On Server 1.23.0 or later this fills the Console Account column of the Workstations screen. See the admin console.
• The console is reported again within seconds of a sign-in or a sign-out, a lock or an unlock, a switch of user at the console, and a Tray App attaching or detaching, and not while it is unchanged.
• The console goes with the report's switch: with WorkstationReport:Enabled off, no account or other part of it leaves the machine. See Workstation configuration.
• The Workstation Service says why it could not show a session-start PIN prompt (NO_TRAY), as it has for a Signing Authorization since Workstation 1.9.0: a Tray App in a session that is not the console's (Remote Desktop, or a switched console), no Tray App attached anywhere, a release being installed, a console Tray App not reading, the Tray App closing while the prompt was up, or a Tray App restarted in its session while the prompt waited its turn. A prompt whose every certificate is an A1 with no A1 PIN set says NO_A1_PIN. Server 1.23.0 or later says the reason in words on the machine's Events tab.

Improvements

• The Workstation Service's log lines for a prompt it could not show say which case it was: a Tray App in another session or none in any, and a console that changed while the prompt waited its turn rather than a Tray App not reading.

Server 1.24.0 (2026-10-26)

Image trustbridge-server:1.24.0, accepts workstation protocols 5–6.

Updates database model: no

Upgrade notes: deliver it with any Workstation: the SignSession Contract, its error codes and the workstation protocol did not move, and no configuration key was added. No migration is new, but on SQL Server the Audit Log index that Server 1.23.0 adds (IndexTheAuditLogByWorkstationAndTime) is now built online where the edition can: at low priority on Azure SQL Database, Azure SQL Managed Instance and SQL Server 2022 or later Enterprise or Developer, online on older Enterprise, and offline on Standard, Express and Web. An offline build holds back writes to the Audit Log while it runs, and rows written meanwhile can be lost to timeouts, so a deployment on 1.22.0 or earlier should upgrade straight to 1.24.0, and one with a large Audit Log on an edition that builds offline, or on PostgreSQL, should upgrade at a quiet time. A database that applied the index under 1.23.0 needs nothing, and going back to 1.23.0 is a swap of the image tag. See Upgrading to Server 1.23.0 or later.

New features

• The Audit Log shows the Error Code an API call was answered with, after the HTTP status in the Event cell: GET /v1/certificates/info 401 SESSION_EXPIRED. The status alone does not say which error the caller got (UNAUTHORIZED and SESSION_EXPIRED are both 401s, SERVER_BUSY and TOO_MANY_PIN_ATTEMPTS both 429s), and the code is what an integrator quotes to support. The api.call row keeps it in its details as errorCode; the answer's message and details are not kept. A call answered without an error envelope has none, and a row written before this release reads as it did. See the admin console.
• A Test Signature that failed at the signature step says why, by the contract's code: a sentence chosen by the code, in both languages, with the code and the contract's answer beside it. CERT_INCOMPLETE_IDENTITY points at the E-mail address field; PIN_NOT_AVAILABLE names the holder's PIN, most often declined or unanswered at the Tray App, or a locked token; SIGN_TIMEOUT says the holder's key may already have signed; TOO_MANY_PIN_ATTEMPTS is the CPF lockout. A run whose timeout passed while a Per-Transaction PIN holder's confirmation was awaited says so. A batch says it for each document that failed. The other steps' sentences are unchanged. See Troubleshooting.

Server 1.23.0 (2026-10-26)

Image trustbridge-server:1.23.0, accepts workstation protocols 5–6.

Updates database model: yes (migrations: ReportWorkstationConsole, IndexTheAuditLogByWorkstationAndTime, RecordTheRunsFailureCause)

Upgrade notes: deliver it with any Workstation: the console is an optional part of the Workstation Report, so protocol 6 does not move, and the SignSession Contract did not change. A machine on a Workstation release before 1.10.0 reports no console, and its cell reads Needs Workstation 1.10.0. No configuration key was added. On SQL Server this release builds the new Audit Log index offline, which holds back writes to the Audit Log while it runs: upgrade to Server 1.24.0 instead, which builds the same index online where the edition can. Rolling back to 1.22.0 needs the pre-upgrade database backup. See Upgrading to Server 1.23.0 or later.

New features

• The Workstations screen says who is at each machine's console. A Console Account column replaces the operating system, which stays in the detail panel's header: the account signed in at the console with what is wrong with its Tray App beside it, worst first (no Tray, a Tray App of another version than the service's, locked), or Nobody at the console. An offline machine shows when it reported it, and one with reporting off reads Not reported. The Server keeps the last console reported, for an offline or revoked machine too, and writes no Audit Log row when it changes. See the admin console.
• A Console Account, no Tray filter chip lists the online admitted machines whose holder is signed in at the console with no Tray App running there, so a machine that would refuse a per-transaction call is found before anyone calls (show=console-no-tray).
• Each machine's problem refusals in the last 24 hours show as an N refusals (24h) chip in its status cell, and a With refusals (24h) filter chip lists the admitted machines that have one (show=refusals). A decline and a Client Application that stopped waiting are not counted; a wrong PIN is.
• The search finds a machine by its Console Account, and by the name, CPF or CNPJ of a holder whose certificate it holds, an e-CNPJ by its Company too. A CPF or CNPJ typed with its dots, dashes and slash matches, here and on the Signing Sessions and Signing Operations searches.
• The detail panel has a console section: the account with its SID, the lock, the Tray App's state and version (noted when it is older than the service), and the other sessions with a Tray App, or why the machine shows none.
• The detail panel's Events tab says each Workstation Refusal in words, with what to ask the holder where the holder can fix it, and its code and session small beside it. A decline and a Client Application that gave up are marked as somebody's choice; every other refusal, a wrong PIN included, is a problem with the machine. A Refusals only toggle lists the machine's latest refusals rather than its latest events, and is on when the panel opens on a machine with a problem refusal in the last 24 hours. See everything in the Audit log opens the machine's rows on the Audit Log.
• The Audit Log has a Workstation id filter that finds every row of one machine, of every event type and a removed machine's included, and combines with the other filters; a workstationId= link fills it.
• pin.prompt-answered carries detail when a session-start PIN prompt was answered Undeliverable because no Tray App could show it, in the shape signing.authorization-refused has carried since Server 1.22.0, with one cause of its own: NO_A1_PIN. A machine before Workstation 1.10.0 sends none. The client's refusal does not change.
• The Signing Sessions screen says who, through what and on which machine. The holder reads by the name the certificate gives, with the CPF beneath; a Client Application column names the application that created the session; the bound machine links to its panel on the Workstations screen, with its Console Account beneath. A live session on a machine with a problem Workstation Refusal in the last 24 hours is tinted and says how many. The search also matches the holder's name, the Client Application and the machine's hostname. See the admin console.
• A Refused creations (24h) chip on the Signing Sessions screen (show=refused) lists the session creations refused in the last 24 hours: when, the holder with the CPF, the Client Application, why in words with the code, and each machine that was prompted for the PIN with its answer, or that no machine was. The newest 200 are listed, and the screen says when there were more.
• The Signing Operations screen says what went wrong with a run. A failure reads in words, with what to ask the holder where the holder can act, and says whether the holder's token signed (and a signed document may then exist at the signature service), did not, or is not known. A run pending longer than a live run can last is tinted and says what it is waiting on. A Client Application filter sits beside the search, the holder reads by name with the CPF beneath, and the machine links to its panel on the Workstations screen. See the admin console.
• A failed run records what the Workstation answered beside its code, since four different causes all end as PIN_NOT_AVAILABLE; a run that failed before the upgrade reads by its code alone.
• A Test Signature may sign more than one document: a Documents count, 1 to 50, or Signing:MaxBatchItems where that is lower, signs numbered copies in one batch call. The documents that signed come back as one ZIP, test-signatures.zip, and each that did not is named with the step it failed at. A run of one document is the single call it always was. Its test_signature.* audit row records how many documents were asked for and, of a completed run, how many signed. See the admin console.

Improvements

• The Workstations screen's filter select is a row of chips, each with how many machines it holds, the search applied. The show= links from the status strip and the Dashboard still select theirs.
• The Signing Sessions screen's filter select is a row of counts that act as filters: All, Live, Live with refusals (24h), Ended and Refused creations (24h).
• The Signing Operations screen's filter select is a row of counts: All, Pending, Failed (24h) and Completed (24h). Unless a search narrows them, the two 24-hour counts take in every run that ended in the window, beyond the newest 200 the table lists. With Failed (24h) picked, a row of chips groups the failures by cause.
• The Test Signature page writes every field back after a run, the API key and the PIN included, and Sign again shows the filled form, so a second run is one press. The answered page is marked no-store, so the browser does not keep it; on a shared machine, close the tab at the end of a demonstration. The Server still logs neither the key nor the PIN, and forgets both once the page is written.

Server 1.22.0 (2026-10-25)

Image trustbridge-server:1.22.0, accepts workstation protocols 5–6.

Updates database model: no

Upgrade notes: deliver it with any Workstation. Nothing a client sees changed: a per-transaction call refused because nobody could be asked is still PIN_NOT_AVAILABLE with details no Tray at the console. Neither the contract, the schema nor the configuration moved, so going back to 1.21.0 is a swap of the image tag. A machine before Workstation 1.9.0 sends no detail, and its rows read detail: null.

New features

• The signing.authorization-refused audit row carries detail on a NO_TRAY: which of the machine's reasons it was (TRAY_NOT_AT_CONSOLE, NO_TRAY_RUNNING, TRAY_CANNOT_SHOW_TRANSACTIONS, INSTALLING_RELEASE, TRAY_NOT_READING, TRAY_DETACHED or SERVICE_STOPPING), the Windows session at the console, the sessions a Tray App was attached in, and the Tray App's build. Finding out why used to take someone at the machine. It is null on every other reason, and a reason this Server does not know is recorded as told. See Why no Tray App could be asked.
• The Server's log line for a refused authorization names the detail's reason beside the refusal's.

Bug fixes

• The Revoke and Remove buttons of the Workstation detail panel have a row of their own under the header; on one line with the hostname and the status chip, their labels broke out of their outlines and covered the chip.

Workstation 1.9.0 (2026-10-25)

Package TrustBridge-Workstation-1.9.0-x64.msi, workstation protocol 6.

Upgrade notes: deliver it with Server 1.20.0 or later, as 1.8.0, for its Workstation Report. The new NO_TRAY detail rides protocol 6 unchanged, and a Server before 1.22.0 ignores it. No configuration key is added. The package adds a Start menu shortcut for every user.

New features

• A Start menu shortcut, TrustBridge, installed for every user and removed with the package, opens the Tray App's window: beside a Tray App already running in the session it brings that window forward, and with none it starts one. A Tray App that had crashed, hung, been closed by a repair or been left with Exit no longer stays gone until the next sign-in. See Workstation installation.
• A launch beside a Tray App that does not answer within 5 seconds ends it, in that session only, and takes its place; the replacement is logged as an Error, which reaches the Workstation Report. A Tray App that cannot be ended is left running, and a launch from the shortcut says so before it exits.
• The Workstation Service says why it answered a Signing Authorization NO_TRAY: a Tray App in a session that is not the console's (Remote Desktop, or a switched console), no Tray App attached anywhere, a console Tray App too old to show a transaction, a release being installed, a console Tray App not reading, the Tray App closing while its prompt was up, or the service stopping. With it go the console session, the sessions a Tray App was attached in and the Tray App's build. Server 1.22.0 records it in the Audit Log, and Server 1.23.0 says it in words on the machine's Events tab.

Improvements

• The autostart at sign-in passes --background, and so does the service's relaunch after an install or an upgrade: started that way, the Tray App shows only its icon, as before, and exits silently beside a Tray App in the session that answers. Started from the shortcut or the executable, it opens its window.
• The Workstation Service's log line for a prompt it could not show says which case it was: a Tray App in another session, none in any, or one that cannot show a transaction.

Workstation 1.8.1 (2026-10-24)

Package TrustBridge-Workstation-1.8.1-x64.msi, workstation protocol 6.

Upgrade notes: deliver it as soon as you can. Nothing on the wire moves and no configuration key is added. Unlike 1.8.0, it stays connected to a Server from 1.15.0 to 1.19.0, which takes no Workstation Report; Server 1.20.0 or later is still what receives and shows the report. The upgrade relaunches a Tray App that already has the fix, so the upgrade itself cannot set off the bug.

Bug fixes

• Closing a PIN prompt no longer ends the Tray App. In a Tray App whose window had not been opened since sign-in, or since an upgrade relaunched it, a PIN prompt closing (an Insertion Prompt answered, declined or timed out among them) ended it without a log line, and until sign-out a per-transaction signing call on that machine was refused (PIN_NOT_AVAILABLE) and launching the Tray App again did nothing. It now ends only through its menu's Exit, its window closed while it has no icon to come back through, or sign-out.
• The Tray App's exit cannot hang: it waits at most 3 seconds for its teardown, then lets go of the session, so the next launch starts a Tray App.
• An exception nothing caught is logged by the Tray App as an Error, with its type and message, on its Log tab; one the Tray App survives also reaches the Workstation Report.
• A Workstation Report stays under 32 KB until the Server has taken one on the connection, so a machine with a large report no longer loses its connection to a Server older than 1.20.0. Once a report has landed, the connection's reports go whole.

Improvements

• A revoked machine's refusal no longer says there is no way back: since Server 1.21.0 an Administrator can remove it, and it rejoins the admission queue as a new machine. The Workstation Service's log lines and the refusal the Tray App shows, in English and Portuguese, say so.

Server 1.21.0 (2026-10-22)

Image trustbridge-server:1.21.0, accepts workstation protocols 5–6.

Updates database model: yes (migration: RecordTheBindingsWorkstationId)

Upgrade notes: the SignSession Contract's shape did not change and no error code is new, but a signing call under a live session whose machine was removed answers 422 WORKSTATION_OFFLINE with details workstation removed, as does a session creation that chose a machine removed under it. A workstation.disconnect audit row can carry the new reason removed. No configuration key was added. Rolling back to 1.20.0 needs the pre-upgrade database backup.

New features

• An Administrator can Remove a Workstation from its detail panel on the Workstations screen, beside Revoke, after typing the machine's hostname to confirm. Its certificates, its Workstation Report and its failed PIN Proofs go with it; every Signing Session, Signing Operation and Audit Log row it appears in stays.
• A machine that has signed can be removed: the session and operation lists then name it removed workstation and the first group of its id, and the Dashboard's Signing Activity is the same before and after. A session still live on it is neither ended nor charged; a signing call under it answers WORKSTATION_OFFLINE until it expires.
• A connected machine is disconnected when it is removed. If it is still installed, it asks for admission again and arrives in the admission queue as a new machine.
• A Revoked machine can be removed too, and its refusal goes with its row: the same key could ask again and be admitted.
• The admission queue offers Remove on a row that was admitted once and sent back to Pending.
• New audit event admin.workstation-removed, naming the machine in full.
• deploy-docker.ps1 deploys the Server on Docker with PostgreSQL, RustFS and REST PKI Core in one script: it asks for the host name, the PKI licence and the first Administrator's e-mail address, generates every password, key and the TLS certificate, starts the containers and waits for /healthz. A second run keeps every value, so it upgrades or repairs without re-keying, and -ConnectRestPki connects the Server to REST PKI Core once a Worker key exists. It refuses an image older than 1.20.0. See Server installation.

Improvements

• The Revoke confirmation says a revoked machine stays refused for as long as its row stands, no longer that revoking is permanent.
• Revoking a machine removed in the meantime says the machine is gone and closes the detail panel.

Workstation 1.8.0 (2026-10-22)

Package TrustBridge-Workstation-1.8.0-x64.msi, workstation protocol 6.

Upgrade notes: deliver it with Server 1.20.0 or later. The protocol stays at 6, so Server 1.15.0 or later admits it, but only Server 1.20.0 takes a Workstation Report larger than 32 KB, and an earlier Server closes the connection of a machine whose report is (one with many tokens, middleware or errors). Two configuration keys are new, each with an MSI property, both on by default: WorkstationReport:Enabled (WORKSTATION_REPORT) and Certificates:RestartFailedReaders (RESTART_FAILED_READERS). A value other than 0 or 1 reads as off and is logged as an Error. The updated Group Policy templates add Report this machine's condition to the TrustBridge Server and Restart a smart-card reader Windows could not start.

New features

• The Workstation Report: the Workstation Service tells its Server the machine's PKI licence and .NET runtime, its switches, the middleware it loaded, its tokens and how close each PIN is to locking, the readers left failed, and the errors the Service and the Tray App logged, grouped by message template. It reports after every accepted handshake and again shortly after anything in it changes, and a report never costs the machine its connection, its signing or its PIN Cache.
• WorkstationReport:Enabled (MSI WORKSTATION_REPORT, or Group Policy) turns the report off for a machine; the Server then forgets what it held for it.
• The Tokens tab says when Windows could not start a smart-card reader, where it used to say only that no token was seen.
• The Workstation Service restarts a USB smart-card reader Windows left failed (problem code 10), up to three times, and the Tokens tab says so meanwhile; only then does it ask the holder to unplug the reader and plug it back in. It never elevates and never reboots.
• Certificates:RestartFailedReaders (MSI RESTART_FAILED_READERS, or Group Policy) turns the restart off; the Tokens tab then asks for the replug at once.
• Plugging in a USB device starts a certificate pass, so a reader that fails as it is plugged in is seen at once.

Improvements

• The PIN window is laid out anew: a header with the prompt's details under it, an orange rule that shrinks as the deadline runs out, and the countdown and buttons at the foot.
• An e-CPF is named for its holder, not by its whole subject, on the Insertion Prompt, the certificate list, the Tokens tab, the balloons and the PIN window's picker; the picker marks an A1 certificate, which takes a different PIN from the same holder's token.
• The Insertion Prompt says what to do once, and names the token and its reader on two lines.
• The Portuguese Tray App says (definido por Política de Grupo) where a policy sets the Server URL, as the Group Policy template does.

Server 1.20.0 (2026-10-21)

Image trustbridge-server:1.20.0, accepts workstation protocols 5–6.

Updates database model: yes (migrations: SpellThumbprintsUpperCase, RecordWorkstationReports, ReportWorkstationReportingOff, ReportWorkstationTokens, ReportWorkstationFailedReaders, ReportWorkstationMiddleware, ReportWorkstationErrors, KeepTheReportingVersionAndAgeUnlistedErrors, AgeErrorGroupsByTheServersClock)

Upgrade notes: nothing changes for a SQL Server deployment until it asks: Database:Engine defaults to SqlServer, and no deployment moves between engines. SpellThumbprintsUpperCase upper-cases the thumbprints in the certificate registry, the Certificate Vault and the Trusted CAs (the Audit Log is never rewritten); on a database with a case-sensitive collation it refuses, changing nothing, if two rows differ only in case, and names the table. The SignSession Contract did not change, and the workstation protocol window stays 5–6. New configuration keys: Database:Engine and WorkstationReports:ErrorRetentionDays. Rolling back to 1.19.0 needs the pre-upgrade database backup.

New features

• PostgreSQL 16 or later is a second supported engine on Docker, chosen once per deployment by Database:Engine (SqlServer or PostgreSql). A connection string only the other engine reads, or a value naming neither engine, refuses the start. On PostgreSQL the Server creates its database and schema as it does on SQL Server. The deployment files add docker-compose.postgresql.yml and POSTGRES_PASSWORD, and backups use pg_dump. App Service stays on Azure SQL. See Server installation.
• The Workstation Report: the Server keeps what each machine last reported of its own condition and shows it in a Report column on the Workstations screen, a section of the detail panel, two items on the Dashboard (a reader left failed, a locked token) and the new Workstation Reports screen, whose rows open the matching machines. A machine on a Workstation release before 1.8.0 sends none, and reads Not reported.
• Reported error groups that no report has added to for WorkstationReports:ErrorRetentionDays (30 by default) are deleted by a daily sweep.
• The login page remembers the way in this browser last used: with Certificate Sign-In on, an accepted certificate sign-in makes it open on the certificate page next time (cookie TrustBridge.SignInCredential), and a Password | Digital certificate switch on both pages is one click away.
• The certificate page lists certificates as rows with holder, issuer, validity and an A3 or A1 badge, a search from six certificates up, and expired certificates under their own heading.

Improvements

• Every signed-out page (login, the certificate page, both Second Factor pages and access denied) is drawn as one card in the same style.
• The Workstation hub accepts messages up to 1 MB, for the Workstation Report; every other hub keeps 32 KB.
• Thumbprints are written and looked up as upper-case hex by the Server itself, and every moment is stored in UTC, on either engine.
• The Audit Log search matches an actor's name regardless of case.
• Saving the platform settings is retried when it loses a race with another save, up to three attempts.
• The schema step names two more failures in its own words: a statement or lock time limit set on the database, and a migration that lost a lock to another session.

Server 1.19.0 (2026-10-20)

Image trustbridge-server:1.19.0, accepts workstation protocols 5–6.

Updates database model: no

Upgrade notes: neither the contract, the schema nor the configuration moved, so going back to 1.18.0 is a swap of the image tag. The fleet needs nothing.

Improvements

• The Dashboard has a new layout: three tabs (Today, This month, Last 30 days) choose a sentence such as Today so far, 11 documents and 538 digests were signed. 4 Workstations took part. Documents and digests are always two figures, never summed.
• What needs you, beside the sentence, lists Signing Activity falling behind, the last 24 hours' failures, Workstations refused until they update, admitted Workstations not connected and expiring certificates, each linking where its status strip chip does.
• The window's panels are the stages a signature passes through: who asked, how long the holder took to authorize, where it was signed and the outcome. The timing table is folded away beneath them.
• The Workstations screen has an Admitted, offline filter (?show=admitted-offline), which is what the Dashboard's not-connected line opens; the Offline filter also lists Revoked machines.

Bug fixes

• A machine's offered release and its last update sit on two lines in the Updates cell instead of running together.

Workstation 1.7.0 (2026-10-19)

Package TrustBridge-Workstation-1.7.0-x64.msi, workstation protocol 6.

Upgrade notes: no Server change: it needs Server 1.15.0 or later, as 1.6.0 does. One configuration key is new, Tray:InsertionPrompt, with the MSI property INSERTION_PROMPT, on by default. The updated Group Policy templates add Ask for a token's PIN when it is inserted, which beats the installer's value.

New features

• The Insertion Prompt: a token put in a reader at the console asks for its PIN there and then, and what the token accepts is kept in the PIN Cache for every certificate on it, so the signatures that follow need no prompt.
• It is offered once per token, while the Tray App is attached at the console, for a token with at least one ACTIVE certificate that is not an A1, is not PIN-locked and has no cached PIN. The window names the token, its reader and the holder (and Company) of each certificate, opens without taking the keyboard focus, and has Not now and the 90-second countdown of every prompt. A wrong PIN is typed again in the same window.
• It never reaches the Server and never authorizes a per-transaction signing call: such a call still asks at the Tray App every time.
• Tray:InsertionPrompt (MSI INSERTION_PROMPT, or Group Policy) turns it off for a machine, keeping the token balloon.

Improvements

• The Insertion Prompt gives way to a session's PIN prompt or a Signing Authorization, and is offered again once the screen is free if its token is still in and its PIN still not cached. It closes when its token is pulled out, its PIN is cached another way, or the Tray App detaches.
• It never opens behind the lock screen: a token put in while the console is locked is offered at the unlock.
• Where the Insertion Prompt is on, the Tray App no longer raises the unlock balloon for an arriving token.
• The start-up log's Error for an unreadable registry switch names the configuration key it reads as off.

Server 1.18.0 (2026-10-19)

Image trustbridge-server:1.18.0, accepts workstation protocols 5–6.

Updates database model: yes (migrations: SignDocumentsWithRestPkiCore, WaiveTheSessionPin)

Upgrade notes: nothing changes until an Administrator moves one of the new switches: every Client Application signs with the Signer, and pin is still required on POST /v1/sessions. Three configuration keys are new, optional and all three or none: RestPkiCore:Endpoint, RestPkiCore:ApiKey (of an application with the Worker role) and RestPkiCore:SecurityContextId; some without the others, or a malformed one, refuses the start. Signing:StrandedAfter must now be greater than twice Signing:RequestBudget plus Signing:SignerCancelBudget: the defaults clear it, but a deployment that set it lower refuses to start, naming the key. Before switching an application to REST PKI Core, set what REST PKI Core decides on its side (the signature policy, the subscription's PDF marking policy, and a security context that trusts the holders' CAs), and let the Server reach both REST PKI Core's endpoint and its site address. See the configuration page. Rolling back to 1.17.0 needs the pre-upgrade database backup.

New features

• Sign documents with REST PKI Core: an Administrator switches a Client Application on the Client Applications screen, and from its next signing call REST PKI Core prepares and completes each PDF around the holder's signature, and keeps the signed document. The switch is refused while the Server has no RestPkiCore section.
• On that path the responses keep their shape, the signatureId is REST PKI Core's document id, and GET /v1/signatures/{signatureId}/document fetches the document from REST PKI Core. Ids the Signer produced are fetched from the Signer as before.
• REST PKI Core's failures arrive in the existing codes: a certificate it refuses is 422 CERT_NOT_ACTIVE before the holder is asked, a PDF it cannot sign is 422 UNSUPPORTED_DOCUMENT, an outage or exhausted quota is 502 SIGNER_ERROR, a key, role or security context it refuses is 500 INTERNAL_ERROR with an Error naming which, and a document it no longer has is 422 DOCUMENT_UNAVAILABLE.
• Sessions without a PIN: for a Client Application with Per-Transaction PIN on, a second switch makes pin optional on POST /v1/sessions. A session created without it binds only where exactly one certificate could serve it, and otherwise answers 400 INVALID_REQUEST; every signing call under it still asks the holder. Turning Per-Transaction PIN off turns this switch off too.
• A Test Signature follows the engine of the application whose key is typed, and can be made without typing the PIN.
• New audit events admin.application-document-signer-changed, admin.application-session-pin-waived and admin.application-session-pin-required. Every row a signing run writes carries documentSigner, and session.created carries pin: "proven" or "none".

Improvements

• On the REST PKI Core path a batch runs each document the same way, and a document that fails is that item's ERROR while the others are still signed.
• A certificate that names no e-mail address can sign through REST PKI Core; only the Signer needs one.

Server 1.17.0 (2026-10-19)

Image trustbridge-server:1.17.0, accepts workstation protocols 5–6.

Updates database model: yes (migrations: CountSettledSigningActivity, SetTheSignatureAllowancePerClientApplication, FoldSigningTimingHistograms, ConstrainSigningActivity)

Upgrade notes: Sessions:SignatureAllowance is no longer read, so a deployment that sets it has unbounded sessions after this upgrade until an Administrator sets the figure on each Client Application that needs one: nothing carries the key's value over. Straight after upgrading, set the Signature Allowance on the Client Applications screen for each application whose sessions it bounded, then remove the key; a Server that still finds it set starts, with one Warning. One configuration key is new, Dashboard:TimeZone (default UTC), the IANA zone whose midnight starts a Dashboard day; a zone the Server cannot find, or a Windows zone id, refuses the start. The first start counts Signing Activity back over the whole Audit Log, and the audit purge deletes nothing until it has. The contract did not move. Rolling back to 1.16.0 needs the pre-upgrade database backup. See the configuration page.

New features

• Signature Allowance per Client Application: an Administrator sets, changes or clears it from the application's card on the Client Applications screen. Every Signing Session the application creates afterwards ends as Exhausted after that many signing calls; a session that already exists keeps the allowance it was granted. An empty field means no bound, and zero or less is refused.
• The admin console opens on a Dashboard, /admin/dashboard: documents signed and digests signed, never summed, and the Workstations that signed, for today, this month and since the installation, with a 30-day trend and the moment the figures are settled to.
• Signing Activity is counted off the Audit Log a few minutes behind, without making any signature slower, and names no holder. Test Signatures are counted apart. A count that has fallen behind says so on the Dashboard and on the status strip.
• The Dashboard shows approximate p50 and p95 timings of each signing leg and of the Signing Authorization wait, and panels over a chosen window (Today, This month or Last 30 days): failures by code, Client Applications, custody, the busiest minute and the admitted fleet.
• New audit event admin.application-signature-allowance-changed.

Improvements

• The status strip's signature count reads Signing Activity, so it counts documents and digests actually signed rather than Signing Operations started.
• Every signing call is timed whatever Diagnostics:ServerTiming says, which now decides only whether the Server-Timing header is sent; the timings are written into the details of the signing.completed/failed and hash-signing.completed/failed audit rows.

Server 1.16.0 (2026-10-18)

Image trustbridge-server:1.16.0, accepts workstation protocols 5–6.

Updates database model: no

Upgrade notes: neither the contract nor the schema moved, so going back to 1.15.0 is a swap of the image tag. The Test Signature's configuration changed: TestSignature:Cpfs, ApiKey, FallbackEmail, Turnstile:SiteKey and Turnstile:SecretKey are no longer read, and TestSignature:Timeout is renamed TestSignature:MaxTimeout. A deployment that still sets any of them starts, with one Warning naming them. Remove them, and revoke the key TestSignature:ApiKey held on the Client Applications screen: it is still a live key of its Client Application. TestSignature:MaxTimeout and TestSignature:LoopbackAddress are now checked at start even with the public page off, so a bad value that used to be ignored refuses the start.

New features

• The Test Signature is made with the key its asker types: /test-signature asks for the CPF, the PIN, an optional CNPJ, a Client Application's API key, an optional fallback e-mail address and a timeout, capped by TestSignature:MaxTimeout (at most one hour). The CPF list and the Cloudflare Turnstile check are gone.
• The admin console has its own Test Signature page, /admin/test-signature under System, always there for Administrators whatever TestSignature:Enabled says; an Auditor sees whether the public page is on, and no form.
• A Test Signature has its own Audit Log rows: new events test_signature.completed, test_signature.failed (with the step) and test_signature.refused (with the reason). They never carry the PIN or the key.
• A Test Signature works for a Client Application with Per-Transaction PIN on.

Improvements

• The Test Signature page shows that it is waiting, and gives up after the typed timeout and a margin, or on Escape, clearing the PIN and the key.
• The signed test document names the signing certificate's public details, chain included, in the page's language, and nothing about the deployment.
• A failed Test Signature names its step: session, certificate, document, signature, Signer, timeout or loopback.

Bug fixes

• Deleting a Workstation Release no longer times out on a small Azure SQL database (Basic, 5 DTU): it has the 10-minute budget the upload has, and the screen says the delete has started and may take a few minutes.
• The admin menu opens at every width on the Test Signature screen.
• A page's heading no longer shows a focus ring after a navigation.

Workstation 1.6.0 (2026-10-18)

Package TrustBridge-Workstation-1.6.0-x64.msi, workstation protocol 6.

Upgrade notes: needs Server 1.15.0, and the Server goes first: a Server before 1.15.0 refuses this release at the handshake with update the Server first, gives it no licence, and every certificate on it reads UNTRUSTED. Server 1.15.0 in turn refuses Workstation 1.4.x, so a fleet still on 1.4.x goes to 1.5.0 before the Server moves, and to this release after it. Cached PINs, A1 PINs and the machine's admission carry over, and no MSI property or setting changed. Going back to 1.5.0 needs a full uninstall first, which makes the machine ask to be admitted again.

New features

• Per-Transaction PIN: for a Client Application that has it on, the Tray App asks the holder for the PIN on every signing call, under the headline A signing transaction needs your PIN. It names the Client Application asking and what it will sign: the number of hashes, or the number of documents and the first five names. Its buttons are Authorize and Decline.
• A token's PIN typed there is checked by the token, and an A1's against its A1 PIN; a wrong PIN is typed again in the same window. The accepted PIN is held in memory for that call only, and never comes from or goes into the PIN Cache.
• The Tray App's Service tab has a Change Server… button that opens the installed package's own maintenance dialog to re-point the machine. It is disabled, and the address reads (set by Group Policy), where a policy sets the URL.
• A re-point to a new Server address no longer reinstalls the package's files, so it works on a machine whose MSI was deleted by a Server-delivered update.

Improvements

• The bundled runtime is .NET 10.0.13, past the October 2026 security advisories.
• The Portuguese Group Policy template says "Política de Grupo" and "política", as Windows pt-BR does.

Server 1.15.0 (2026-10-18)

Image trustbridge-server:1.15.0, accepts workstation protocols 5–6.

Updates database model: yes (migration: RequireThePinPerTransaction)

Upgrade notes: before upgrading, check the Fleet screen for any admitted machine still on Workstation 1.4.x and update it to 1.5.0: this Server refuses protocol 4 at the handshake. Then upgrade the Server, and upload Workstation 1.6.0. A machine on 1.5.0 keeps serving every session as before, but is never chosen for a per-transaction one, so turn Per-Transaction PIN on for a Client Application only once its holders' machines run 1.6.0. Integrators: a pin sent on a signing call, which earlier Servers ignored, is now refused 400 INVALID_REQUEST unless the session is a "client" per-transaction one. New configuration keys: Signing:AuthorizationTimeout, Signing:MaxPendingAuthorizations and Diagnostics:ServerTiming; none was renamed or removed. Rolling back to 1.14.1 needs the pre-upgrade database backup.

New features

• Per-Transaction PIN: an Administrator can switch a Client Application to require the holder's PIN for every signing call, from the Client Applications screen. It applies to the sessions the application creates afterwards.
• POST /v1/sessions and GET /v1/sessions/status answer transactionPin: null, "workstation" (the holder authorizes each call at the Tray App) or "client" (a Vault Certificate: the client sends pin on each call). The Signing Sessions screen shows it.
• POST /v1/signatures, /signatures/batch and /signatures/hashes take an optional pin, required on a "client" session and refused on every other.
• Under a "workstation" session each signing call opens a Signing Authorization on the bound machine; a batch asks once. A declined, unanswered or undeliverable prompt is 422 PIN_NOT_AVAILABLE with a details word, and nothing reaches the signature service.
• New audit events admin.application-transaction-pin-enabled, admin.application-transaction-pin-disabled, signing.authorization-requested, signing.authorization-granted and signing.authorization-refused.
• With Diagnostics:ServerTiming on (off by default; leave it off in production), contract responses carry a Server-Timing header saying where the call's time went.

Improvements

• Workstation protocol 6; protocol 4 leaves the window.
• A machine holds at most Signing:MaxPendingAuthorizations calls waiting for its holder (2 by default); one more is answered 422 PIN_NOT_AVAILABLE with too many calls waiting.
• Signing:AuthorizationTimeout (60 s, at most ten minutes) bounds the wait for the holder, outside Signing:RequestBudget.
• A per-transaction call waits for a machine that is briefly away, within Signing:WorkstationReconnectGrace, before its holder is asked.
• For a creator with Per-Transaction PIN on, session creation passes over a protocol 5 machine, with a Warning naming it.
• A "client" session keeps no password between calls, so it survives a Server restart and signs again with the next call's pin.

Server 1.14.1 (2026-10-15)

Image trustbridge-server:1.14.1, accepts workstation protocols 4–5.

Updates database model: no

Upgrade notes: neither the contract nor the configuration moved; a swap of the image tag is enough. A console served in English sees no difference.

Improvements

• The Portuguese admin console says "Política de Grupo" and "política", as Windows pt-BR does, instead of "Diretiva de Grupo" and "diretiva": the Workstations screen shows Atualizações desativadas por política.
• The Audit Log's Subject column reads Objeto in Portuguese, not Assunto.
• The Portuguese Group Policy template carries the same change, but it ships with the Workstation line's templates, so it reaches a domain with the next Workstation release rather than with this image.

Server 1.14.0 (2026-10-14)

Image trustbridge-server:1.14.0, accepts workstation protocols 4–5.

Updates database model: yes (migrations: RecordTheVaultChainsEncodings, GrantHashSigningPerClientApplication)

Upgrade notes: the workstation protocol did not move, so the fleet needs nothing and Workstation 1.5.0 stays current. A Client Application that is not granted Hash Signing sees no difference beyond the new certificate and chain members. Eight configuration keys under TestSignature: are new, and the feature is off by default. Rolling back to 1.13.0 needs the pre-upgrade database backup.

New features

• Hash Signing: POST /v1/signatures/hashes signs digests the client computed itself and answers raw PKCS#1 v1.5 signatures in order, all or nothing. It is off for every Client Application until an Administrator grants it from the Client Applications screen; an ungranted caller is refused 403 HASH_SIGNING_NOT_GRANTED.
• POST /v1/sessions and GET /v1/certificates/info answer the bound certificate (DER, base64) and its chain, nearest issuer first. A Workstation Certificate still answers chain: [].
• The Test Signature: with TestSignature:Enabled on, the Landing Page can make a real signature end to end from a browser. (Reworked in 1.16.0.)
• New audit events admin.application-hash-signing-granted, admin.application-hash-signing-revoked, hash-signing.digest-signed, hash-signing.completed and hash-signing.failed.

Improvements

• Certificate Sign-In has a page of its own, /admin/login/certificate, reached from a button on the login page; the login page no longer carries the Web PKI script or licence. With Admin:CertificateSignIn:Required on, the login page sends every visitor on to it.
• The certificate challenge request gives up after thirty seconds, and a challenge's lifetime is counted on the Server's clock.
• The admin console's app bar is compact: the language switch and the account menu are one button each, and the version moved to the drawer.
• An Audit Log write can no longer be cancelled, and has a fifteen-second limit of its own, so closing a tab mid-request no longer raises a false audit-fallback alert.
• Only a database outage is called "cannot reach the database" on an admin screen.
• The refused-licence banner stays true after a refused renewal: machines already running keep signing until their Workstation Service restarts.
• The image moves to .NET 10.0.13, past the October 2026 security advisories.

Bug fixes

• A certificate announcement whose thumbprint is not 40 or 64 hex digits is refused.

Workstation 1.5.0 (2026-10-04)

Package TrustBridge-Workstation-1.5.0-x64.msi, workstation protocol 5.

Upgrade notes: needs Server 1.13.0; upgrade the Server and the fleet together. An older Server refuses this release at the handshake. PINs cached and A1 PINs set under 1.4.x carry over, and no MSI property or setting changed.

New features

• e-CNPJ certificates are read, announced with their Company to a Server that accepts them, and used to sign a Company's Signing Sessions.
• Alphanumeric CNPJs are supported.
• The Tray App's certificate list and detail name an e-CNPJ's Company, and the PIN prompt for a Company's session names the Company being authorized.
• Against a Server that does not accept e-CNPJs, the Tray App shows the certificate as not announced, with the reason.

Improvements

• The PIN no longer reaches this machine: the Service answers the Server's challenge with a PIN Proof over its cached PIN or A1 PIN, and the Server decides whether it matches.
• A PIN typed at the Tray prompt is still checked locally against the token or the A1 PIN; the prompt then waits for the Server's verdict and closes when the Server's prompt timeout runs out.
• A cached PIN's lifetime slides when the Server binds a session to this machine.

Server 1.13.0 (2026-10-04)

Image trustbridge-server:1.13.0, accepts workstation protocols 4–5.

Updates database model: yes (migrations: RegisterACompanysCnpj, HoldACompanysCnpjInTheVault, KeyASessionByItsCompany, BudgetAMachinesFailedPinProofs, BudgetTheVaultsFailedUnlocks)

Upgrade notes: upgrade the Server and the fleet together, and upload Workstation 1.5.0 with this upgrade. A holder whose machines all still run Workstation 1.4.x is answered 422 WORKSTATION_OFFLINE until one of them updates, and Workstation 1.3.0 or older is refused. No configuration key was added, renamed or removed. Rolling back to 1.12.0 needs the pre-upgrade database backup.

New features

• e-CNPJ support: POST /v1/sessions takes an optional cnpj; such a session binds only to that Company's e-CNPJ and signs with it, and responses carry cnpj only when one applies.
• The Certificate Vault imports e-CNPJ certificates and records their Company.
• The Certificates, Vault Certificates, Sessions and Audit Log screens show the Company where there is one.
• New audit event pin.proof-budget-spent.

Improvements

• Workstation protocol 5: PIN Proofs replace sending the PIN to workstations; the Server challenges every candidate machine at once, within Sessions:PinRelayTimeout, and checks each proof itself.
• Each workstation's failed PIN Proofs for a holder are limited by Sessions:MaxPinFailures within Sessions:PinFailureWindow; past the limit the machine is passed over for that CPF until its failures age out.
• Certificate Vault passwords that open nothing are limited the same way, and a spent limit answers PIN_NOT_AVAILABLE with a details sentence.
• A successful session creation no longer clears a CPF's lockout failures; they age out with the window.
• INVALID_PIN now means every candidate gave a proof and none matched the PIN sent.
• When Sessions:PinPromptTimeout runs out, the Tray App's PIN prompt is taken down at once.
• The admin console login page lists only e-CPF certificates.
• The status strip's chips link to the screens they summarize.

Server 1.12.0 (2026-10-03)

Image trustbridge-server:1.12.0, accepts workstation protocols 3–4.

Updates database model: yes (migration: RecordWhoSetABoundCpf)

Upgrade notes: a deployment that switches passwords off needs at least two Administrators, because nobody can set their own Bound CPF. Rolling back to 1.11.0 needs the pre-upgrade database backup.

Improvements

• An Administrator sets or replaces another account's Bound CPF (Set Bound CPF, or on the new-account form), only while Admin:CertificateSignIn:Enabled is on and never on their own account.
• Binding one's own certificate from the account screen is removed; passwords no longer need to be turned on for a first binding.
• The accounts screen shows each account's full Bound CPF to Administrators and Auditors; the owner sees it read-only, with who set it and when.
• Replacing a Bound CPF ends that person's certificate sessions within five minutes.
• Audit: new admin.account-bound-cpf-set; admin.account-bound-cpf-cleared now carries the CPF; admin.bound-cpf-enrolled is no longer written.
• Setting and clearing a Bound CPF are retried on a database deadlock.

Workstation 1.4.2 (2026-10-02)

Package TrustBridge-Workstation-1.4.2-x64.msi, workstation protocol 4.

Upgrade notes: a machine on 1.4.0 or 1.4.1 can take this release from its Server; a machine on 1.3.0 or older needs a manual or Group Policy install.

Bug fixes

• One A3 certificate with an undecodable extension list no longer hides every token's certificates; that certificate alone is skipped, with a Warning naming it.
• The Service's log names each certificate that leaves the inventory.
• A pending PIN prompt can no longer print the PIN if it is ever formatted for a log.
• No trust anchors configured is reported as that, not as a licence problem.

Server 1.11.0 (2026-10-02)

Image trustbridge-server:1.11.0, accepts workstation protocols 3–4.

Updates database model: yes (migrations: BindCpfToAdminAccounts, RenameEnrolledAtToFirstSeenAt)

Upgrade notes: the column Workstations.EnrolledAt is renamed FirstSeenAt, so a query or report on it has to change. A Docker deployment behind its own reverse proxy should replace ASPNETCORE_FORWARDEDHEADERS_ENABLED=true with ForwardedHeaders:TrustedProxies. Rolling back to 1.10.0 needs the pre-upgrade database backup.

New features

• Certificate Sign-In: Administrators and Auditors can sign in to the admin console with an ICP-Brasil e-CPF through Lacuna Web PKI; off by default (Admin:CertificateSignIn:Enabled, which requires Admin:CertificateSignIn:WebPkiLicense).
• An account is bound by CPF, not by certificate, so a renewed certificate keeps working.
• Admin:CertificateSignIn:Required switches password sign-in off; an account without a Bound CPF then cannot sign in.
• Web PKI is served by the Server itself, so an air-gapped deployment works.
• The Trusted CAs screen counts the administrators who sign in with a certificate from each authority.
• New setting ForwardedHeaders:TrustedProxies: X-Forwarded-For and X-Forwarded-Proto are honoured only from the listed proxies, and a malformed list refuses the start.
• POST /v1/signatures answers the fileName of the document it signed, and the batch names every item by the same rule.
• New audit events admin.certificate-sign-in, admin.certificate-sign-in-refused and admin.account-bound-cpf-cleared.

Improvements

• certificate.encoding-dropped and certificate.announcement-refused write one audit row per snapshot, with details { count, entries: [...] }; rows written before keep their flat fields.
• certificate.inserted records encodingVerified.
• Admission's per-address limit counts an IPv6 address by its /64.
• The SignSession Contract has a new normative specification written from this Server, and the list of divergences from the reference implementation is withdrawn.

Bug fixes

• POST /v1/signatures/batch without a sessionId answers 400 INVALID_REQUEST instead of 401 SESSION_EXPIRED.
• ClockOffset on a clock refusal now always reads now − IssuedAt (positive when the machine is behind); re-check a ClockSkewTolerance tuned from older log values.
• A certificate whose holder fields cannot be read is refused (422 CERT_INCOMPLETE_IDENTITY when signing) instead of passing the holder check.
• An announcement without the certificate's encoding can no longer rewrite a verified certificate's holder.
• Behind a TLS proxy, the login redirect no longer points at http://.
• Signing out checks its antiforgery token.
• The admin cookie is evaluated only on admin paths.
• A half-finished certificate sign-in is dropped once its account enrolls a Second Factor elsewhere, and the code steps refuse an account with no factor.
• A clock refusal on the admission path is recorded against its machine.
• A start refused for an unreachable database reports how long it actually waited.
• No trust anchors configured is reported as that, not as a licence problem.
• An admin account change that hits a database deadlock is retried instead of showing an error screen.
• Commands and responses carrying a secret are redacted when printed.

Server 1.10.0 (2026-09-29)

Image trustbridge-server:1.10.0, accepts workstation protocols 3–4.

Updates database model: yes (migration: RecordValidatedChain)

Upgrade notes: rolling back to 1.9.0 needs the pre-upgrade database backup: 1.9.0 refuses the migrated database and cannot redeem a Recovery Code this release has hashed.

Improvements

• Recovery Codes are hashed at rest; existing codes are hashed in the background at start and keep working.
• Each Vault Certificate records the chain its last validation built, so an intermediate Trusted CA's removal count is exact for the vault after the first hourly revalidation.
• The Certificate Vault screen shows the import-password warning on request (About the import password).

Bug fixes

• A structured refusal from Signer is reported as a refusal: a structured 400 or 403 answers 422 SIGNER_REJECTED and a structured 404 on the document download answers 404 DOCUMENT_NOT_FOUND, instead of 502 SIGNER_ERROR.
• One failing admin screen no longer breaks the rest of the console until the page is reloaded.

Workstation 1.4.1 (2026-09-28)

Package TrustBridge-Workstation-1.4.1-x64.msi, workstation protocol 4.

Improvements

• Same code as 1.4.0, released so that a machine on 1.4.0 has a newer release to take from its Server.

Workstation 1.4.0 (2026-09-28)

Package TrustBridge-Workstation-1.4.0-x64.msi, workstation protocol 4.

Upgrade notes: needs Server 1.9.0; upgrade the Server first. This release itself is installed manually or by Group Policy. Its updated Group Policy templates add Take updates from the TrustBridge Server (ServerUpdates), on unless disabled.

New features

• Server-delivered updates: the Service downloads a release its Server offers, verifies it (hash, Authenticode signature and timestamp, Publisher Pin, revocation, product and version), installs it at an idle moment and reports the outcome.
• The ServerUpdates Group Policy turns Server-delivered updates off for a machine.

Bug fixes

• The Log tab stops receiving the service log in a session that leaves the console.
• The Log tab follows the service log again after the Service restarts.
• Refresh and status reads with the Service stopped give up after ten seconds instead of waiting forever.
• The Tokens tab marks its list when it may be out of date.

Server 1.9.0 (2026-09-27)

Image trustbridge-server:1.9.0, accepts workstation protocols 3–4.

Updates database model: yes (migrations: WorkstationReleases, WorkstationReleaseOffers)

Upgrade notes: Workstation 1.0.x machines (protocol 2) are refused after this upgrade, so update them first; the Workstations screen shows each machine's version. Uploading a Workstation Release needs the writable scratch directory /tmp/trustbridge-releases.

New features

• Workstation Releases screen: an Administrator uploads a signed Workstation MSI of up to 256 MB, and the Server reads its version, protocol and signer from the file.
• Releases are offered to and withdrawn from machines on the Workstations screen, which shows Updates disabled by policy, Needs a manual update and failed installs.
• Machines download an offered release from GET /workstations/releases/{version}, resumable, with its own cap WorkstationReleases:MaxConcurrentDownloads (default 20).
• Uploads, offers, withdrawals and each machine's update outcome are audited.

Workstation 1.3.0 (2026-09-26)

Package TrustBridge-Workstation-1.3.0-x64.msi, workstation protocol 3.

New features

• A Tokens tab in the Tray App shows each token the Service sees: its middleware, state, whether a PIN is stored, and its certificates.
• The Tokens tab names a smart-card reader holding a card no installed middleware reads, or a card that does not respond.
• After an install or upgrade, the Service starts the Tray App in every signed-in Windows session.
• The package carries the Publisher Pin and declares the protocol it speaks, for Server-delivered updates.

Bug fixes

• The Tray App's own warnings appear in the Log tab beside the Service's.
• A PKCS#11 module that will not load is reported as failed, with the reason.

Workstation 1.2.2 (2026-09-25)

Package TrustBridge-Workstation-1.2.2-x64.msi, workstation protocol 3.

Bug fixes

• Upgrades 1.2.0 in place: the same signed product as 1.2.1, carrying a .NET runtime no older than 1.2.0's.

Workstation 1.2.1 (2026-09-25)

Withdrawn: its package carried an older .NET runtime than 1.2.0's, and an upgrade from 1.2.0 left the Service unable to start. Use 1.2.2.

Improvements

• The MSI and every TrustBridge executable and library in it are signed by LACUNA SOFTWARE LTDA, with a timestamp.

Workstation 1.2.0 (2026-09-24)

Package TrustBridge-Workstation-1.2.0-x64.msi, workstation protocol 3. Server 1.8.0 is recommended.

New features

• An A1 Certificate can sign: the holder sets an A1 PIN for it in the Tray App, and a client's PIN is checked against it; the Service stores only a verifier.

Improvements

• The Service pings its Server every 5 seconds, so against Server 1.8.0 a lost connection is noticed within 15 seconds.
• The Tray App's PIN column says "Stored" instead of "Cached".

Bug fixes

• PIN entry follows the console session when the machine is reached over Remote Desktop.
• An A1 Certificate is no longer offered a token PIN prompt.

Server 1.8.0 (2026-09-24)

Image trustbridge-server:1.8.0, accepts workstation protocols 2–3.

Updates database model: no

Upgrade notes: the new Workstations:ClientTimeout defaults to 30 seconds; leave it there until every machine runs Workstation 1.2.0 or later.

New features

• A workstation that drops off without closing its connection reads offline sooner, and an online row shows when the machine connected.
• workstation.disconnect audit rows carry the reason the connection ended.
• The failures chip on the status strip opens the Audit Log filtered to those failures.

Bug fixes

• Revoking a machine or returning it to the queue also closes its older, displaced connections.
• A handshake re-reads the machine's admission, so a machine revoked mid-handshake is disconnected.
• Overlapping Audit Log searches no longer mix their results.
• The app bar's deployment chip is readable.

Workstation 1.1.0 (2026-09-23)

Package TrustBridge-Workstation-1.1.0-x64.msi, workstation protocol 3.

Upgrade notes: needs Server 1.7.0; upgrade the Server first. The PKI licence now comes from the Server: the MSI property PKI_LICENSE and the PkiLicense Group Policy are removed, and a PKI_LICENSE on the msiexec line is ignored.

New features

• The machine receives its PKI licence from the Server at every connection.
• The Tray App says why a machine is unlicensed and what fixes it.

Improvements

• The stored-PIN note says the machine keeps the PIN encrypted to protect the token from being blocked.

Bug fixes

• The MSI no longer installs the Service's development settings file, and an upgrade removes it.

Server 1.7.0 (2026-09-23)

Image trustbridge-server:1.7.0, accepts workstation protocols 2–3.

Updates database model: no

Upgrade notes: Certificates:Validation:License is now required on every deployment, with or without the Certificate Vault; set it before upgrading, or the Server refuses to start.

New features

• The Server hands its PKI licence to every admitted machine at the handshake; renewing it means replacing the value and restarting the Server.
• A PKI licence the SDK refuses is logged as Critical and shown in a banner on every admin page.

Bug fixes

• Concurrent session creations for the same CPF take turns instead of failing with a 500.

Workstation 1.0.1 (2026-09-21)

Package TrustBridge-Workstation-1.0.1-x64.msi, workstation protocol 2.

Bug fixes

• The Tray App attaches to the installed Workstation Service, which under 1.0.0 it refused as not genuine.

Workstation 1.0.0 (2026-09-21)

Package TrustBridge-Workstation-1.0.0-x64.msi, workstation protocol 2.

New features

• First release of the Workstation line: the Workstation Service and the Tray App in one MSI, with Group Policy templates. The package is not signed, so Windows warns on install.

Server 1.6.1 (2026-09-16)

Updates database model: no

Bug fixes

• The log file and Application Insights obey Logging:LogLevel.

Server 1.6.0 (2026-09-16)

Updates database model: no

New features

• The Server log also goes to a daily rolling file (Logging:File:Directory, Logging:File:RetainedDays) and, optionally, to Application Insights (Logging:ApplicationInsights:ConnectionString).
• A Server log screen in the admin console.

Server 1.5.0 (2026-09-11)

Updates database model: yes (migration: KeepBagChainCertificates)

New features

• The Server can fetch a missing issuer over AIA; nothing is stored until an Administrator confirms.
• An UNTRUSTED Vault Certificate offers to trust its issuer.
• A vault import keeps the CA certificates its PKCS#12 file carried.
• The Trusted CAs upload accepts PKCS#7 bundles (.p7b).

Bug fixes

• A certificate with a corrupt Basic Constraints extension is treated as not a CA, and the upload logs a Warning for each certificate it passes over.
• The removal confirmation says its counts are approximate.

Server 1.4.0 (2026-08-31)

Updates database model: yes (migration: WorkstationTrustedCaReport)

New features

• The fleet page shows whether each machine has the Server's current Trusted CAs, and why not.
• Removing a Trusted CA counts the Workstation Certificates it affects as well as the Vault Certificates.

Server 1.3.0 (2026-08-28)

Updates database model: yes (migration history replaced by a single InitialCreate)

Upgrade notes: a database created by 1.2.0 or earlier is refused; drop it and let the Server create a new one. Audit:FallbackLogPath is removed: an audit entry the database refuses goes to the Server log as Critical.

New features

• Workstation admission: a machine creates a non-exportable key and waits in the admission queue until an Administrator admits it; the Enrollment Token is gone.
• A Trusted CA added on the Server reaches every admitted machine within seconds.
• A global throttle answers 429 SERVER_BUSY (Throttle:ConcurrencyLimit, Throttle:QueueLimit).
• GET /healthz reports whether the Server and its database are working.
• A Signing Operation left Pending by a stopped process is ended by a sweep (RUN_STRANDED).
• Signing Sessions and API Keys open their own Audit Log trail, and a session shows how much of its Signature Allowance it has spent.

Improvements

• POST /v1/signatures accepts any file part as the document, and a request naming no session answers 400 INVALID_REQUEST.
• A Signer that is throttling (429 or 408) answers 502 SIGNER_ERROR instead of a refusal.

Server 1.2.0 (2026-08-24)

Updates database model: yes (migration: SessionSignatureAllowance)

Upgrade notes: the Server applies its own migrations at start (Database:MigrateOnStart, default true), so dotnet ef database update is no longer part of an upgrade.

New features

• Signature Allowance: Sessions:SignatureAllowance limits how many signing calls a session may make.
• Uploading a holder's certificate on the Trusted CAs screen resolves its issuing chain and offers it for confirmation.

Server 1.1.0 (2026-08-23)

Updates database model: no

Upgrade notes: the image ships with the Certificate Vault off; set Vault:Enabled if you use it.

New features

• The Trusted CAs screen: upload, list and remove the certification authorities the Server trusts.

Bug fixes

• A bundle of concatenated DER certificates is read in full instead of keeping only the first.
• Certificates stored by an upload that failed part-way take effect at once instead of after a restart.
• Text before the first BEGIN marker, such as a comment or an openssl dump, is no longer counted as an unreadable block.

Server 1.0.1 (2026-08-23)

Updates database model: yes (migration: TrustedCas)

Upgrade notes: Certificates:Validation:TrustedRootPaths is no longer honoured on the Server; it still is on the Workstation Service.

New features

• The certification authorities the Server trusts are stored in the database and applied without a restart.
• Certificates:Validation:UseLacunaTestPki trusts the Lacuna test PKI.

Improvements

• The PKI SDK's disk caches are kept under /tmp/trustbridge-pki.