max-rh/sshelf v0.16.1

0.16.1 (2026-10-27)

on GitHub

Release Notes

Added

• sshelf add --credential NAME (-c) binds a host to a shared credential as it is created, so
  a scripted rollout is one call per group and one call per node rather than an add and a
  bind for every host. It works with --from-ssh --quiet too, and an invalid name fails
  before the host is written.
• sshelf credentials add NAME --password-stdin stores the credential's secret in the same call
  that defines it, which makes one call per group enough. The full loop is in the
  CLI reference.
• Shell completion for credential names, on --credential and credentials bind. Names a host
  already uses complete even when they were never declared.

Fixed

• sshelf add --credential X --password-stdin stored the password under the host's own id, which
  a bound host never reads, so the password was silently useless. It now goes to the credential.
  The flag is new in this release, so no stored secret was affected.
• sshelf add, sshelf sites add and sshelf import refuse to save when another sshelf process
  changed hosts.toml since they read it, instead of replacing that change. The credential
  commands already did this in 0.16.0. A sequential script is unaffected; parallel invocations
  now fail rather than quietly losing hosts.
• A host added with a credential that already has a secret no longer prints the "no password
  stored" note, and one whose credential is empty names the credential in the advice rather than
  the host.

Install sshelf 0.16.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/max-rh/sshelf/releases/download/v0.16.1/sshelf-installer.sh | sh

Install prebuilt binaries via Homebrew

brew install max-rh/tap/sshelf

Download sshelf 0.16.1

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo max-rh/sshelf

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>