Skip to content
ReleasesGitHub

Aembit CLI changelog

Version history

Section titled “Version history”
Aembit CLI VersionRelease DatePlatformsNotes
1.34.57728/27/2026Linux (amd64, arm64)
Windows (amd64)		Add a glibc-linked Linux amd64 archive alongside the default musl build
1.32.49996/4/2026Linux (amd64, arm64)
Windows (amd64)		Add AWS (instance metadata or IAM role) and Kubernetes Trust Provider authentication to credentials get alongside OIDC tokens; add X.509 certificate retrieval for the X.509-SVID Credential Provider through a new client private-key option; add HTTP/2 keepalive options
1.31.47645/2/2026Linux (amd64, arm64)
Windows (amd64)		Add upstream HTTP proxy support; add --client-workload-id flag and OIDC token expiration validation; add support for gathering dynamic claims from environment variables
1.31.46704/17/2026Linux (amd64, arm64)
Windows (amd64)		Add upstream HTTP proxy support for Aembit Cloud and Server Workload traffic
1.30.44333/11/2026Linux (amd64, arm64)
Windows (amd64)		No CLI code changes; build pipeline and artifact signing updates only
1.29.42982/26/2026Linux (amd64, arm64)
Windows (amd64)		Internal changes to process identification and assessment caching shared with Agent Proxy; no CLI-visible change
1.28.40631/16/2026Linux (amd64, arm64)
Windows (amd64)		Internal changes shared with Agent Proxy; no CLI-visible change
1.27.386512/4/2025Linux (amd64, arm64)
Windows (amd64)		Extend attestation gathering with VMware network attestation and Client Workload binary hashing; dependency updates
1.26.363910/21/2025Linux (amd64, arm64)
Windows (amd64)		Toolchain and dependency cleanup
1.25.360010/2/2025Linux (amd64, arm64)
Windows (amd64)		No CLI code changes; rebuilt with updated base image and dependencies
1.25.34948/22/2025Linux (amd64, arm64)
Windows (amd64)		Print help when run with no subcommand; add the sh environment-variable output format; clearer error messages when an OIDC token is missing or credential retrieval fails
1.24.33287/29/2025Linux (amd64, arm64)
Windows (amd64)
1.17.09/18/2024Linux (amd64, arm64)
1.13.03/27/2024Linux (amd64, arm64)

The version number has three parts: major.minor.patch. For example, 1.24.3328 indicates:

  • Major version: 1 - This indicates a major release that may include breaking changes.
  • Minor version: 24 - This indicates a minor release that adds new features or improvements without breaking existing functionality.
  • Patch version: 3328 - This indicates a patch release that includes bug fixes or minor improvements.

Changelog

Section titled “Changelog”

Unreleased

Section titled “Unreleased”

Aembit CLI (unreleased)

Section titled “Aembit CLI (unreleased)”
  • Added support for the AWS Metadata Service, AWS Role, and Kubernetes Service Account Trust Providers to credentials get. Aembit CLI gathers attestation data from the local environment (Instance Metadata Service (IMDS), STS GetCallerIdentity, or the projected service account token), so --id-token isn’t needed for these Trust Providers.
  • Added vm, kubernetes, ecs_fargate, and lambda_container as accepted values for the --deployment-model option. The AWS Role Trust Provider requires this option.

August 27, 2026

Section titled “August 27, 2026”

Aembit CLI 1.34.5772

Section titled “Aembit CLI 1.34.5772”
  • Added a second Linux amd64 archive, aembit_agent_cli_linux_amd64_glibc_<version>.tar.gz, that links dynamically against glibc 2.28 or newer. The default archive still links statically against musl and remains the recommended download. Use the glibc build when the default build reports failed to lookup address information on a host where dig and curl resolve the same name. See Choose a Linux build.

June 3, 2026

Section titled “June 3, 2026”

Aembit CLI 1.32.4999

Section titled “Aembit CLI 1.32.4999”
  • Added --client-tls-private-key option (and the AEMBIT_CLIENT_TLS_PRIVATE_KEY environment variable) to the credentials get command for retrieving X.509-SVID certificates. Aembit CLI generates a Certificate Signing Request (CSR) locally from the supplied private key, submits it through the credential retrieval flow, and returns the signed certificate chain in CLIENT_CERT_CHAIN. See aembit credentials get --client-tls-private-key.

May 1, 2026

Section titled “May 1, 2026”

Aembit CLI 1.31.1

Section titled “Aembit CLI 1.31.1”
  • Added --client-workload-id option to the credentials get command. Use this to identify a specific Client Workload when multiple workloads share the same Trust Provider. Supply the workload’s Aembit Client ID: A UUID that Aembit generates when you choose Aembit Client ID as a Client Workload's Client Identification method. It identifies that single Client Workload.Learn more, not its own resource ID.
  • Added expiration validation for OIDC tokens provided with --id-token.

July 22, 2025

Section titled “July 22, 2025”

Initial release!