Releases · datum-cloud/app

08 Jun 22:56

drewr

cli-v0.2.1

7fd3448

datum-connect CLI v0.2.1 Latest

Latest

Hotfix on top of v0.2.0.

Fixed

auth login --no-browser against the production auth server returned:

Error: Failed to exchange device access token
Caused by:
    Server returned error response: unauthorized_client:
    grant_type "urn:ietf:params:oauth:grant-type:device_code" not allowed

The auth server (Zitadel) gates which OAuth2 grants each registered client can use. Our OIDC client (datum-desktop-app, shared with the desktop app) is allow-listed only for AUTHORIZATION_CODE + REFRESH_TOKEN. DEVICE_CODE isn't in its grantTypes list, so the device-flow exchange is rejected — correctly, given the current config.

This release works around it by reusing datumctl's OIDC client_id (datumctl-cli, which has DEVICE_CODE in its grantTypes) for the device-flow path only. The browser flow (auth login without --no-browser) still uses the regular datum-desktop-app client.

This is a deliberate quick-hack until the planned datumctl connect plugin lands with its own properly-scoped OIDC client. Tokens are still scoped to the same Zitadel project, so downstream Datum API calls are unaffected.

Commit: 7fd3448.

Binaries

Target	Tarball	sha256
Linux amd64 (x86-64)	`datum-connect-linux-amd64.tar.gz`	`305d7e951b98e7d0841c204b0dc0e41502704a7d1ac43b1447911447912f25a0`
Linux arm64 (aarch64)	`datum-connect-linux-arm64.tar.gz`	`e94f1320d23918f292e9e1fb3f1926cd6bc71e4886c4eab95d3cb1b57a885b51`

Install

ARCH=amd64   # or arm64

curl -fsSL -o datum-connect.tar.gz \
  "https://github.com/datum-cloud/app/releases/download/cli-v0.2.1/datum-connect-linux-${ARCH}.tar.gz"
curl -fsSL -o SHA256SUMS \
  "https://github.com/datum-cloud/app/releases/download/cli-v0.2.1/SHA256SUMS"

sha256sum -c <(grep "datum-connect-linux-${ARCH}.tar.gz" SHA256SUMS)

tar xf datum-connect.tar.gz
sudo install -m 0755 datum-connect-linux-${ARCH}/datum-connect /usr/local/bin/datum-connect
datum-connect --version
# datum-connect 0.2.1

Changes since cli-v0.2.0

7fd3448 fix(auth): use datumctl-cli client_id for device-code grant

cli-v0.2.0 is left in the release history but should be considered superseded for --no-browser use.

Assets 5

08 Jun 22:44

drewr

cli-v0.2.0

e0ce7c0

datum-connect CLI v0.2.0

Adds headless / SSH-friendly login to the datum-connect CLI.

What's new

`auth login --no-browser` (and `auth switch --no-browser`)

The existing auth login uses an OAuth2 authorization-code-with-PKCE flow that binds a localhost HTTP server for the redirect. On a remote machine over SSH, in CI, or in a container, that pattern is unreachable — a browser running on your laptop can't reach a port bound on the remote box without a separate SSH port-forward.

Pass --no-browser to switch to the OAuth2 device authorization grant (RFC 8628) instead. The CLI prints a verification URL and a short user code; complete authorization on any other device. Same flag and same flow as datumctl login --no-browser.

$ datum-connect auth login --no-browser

================================================================
  Open this URL on another device to authorize:

      https://auth.datum.net/device

  Enter this code when prompted:

      ABCD-EFGH

  (Or open this pre-filled URL to skip the code step:
   https://auth.datum.net/device?user_code=ABCD-EFGH)

  Code expires in 600 seconds. Waiting for authorization…
================================================================

Logged in as you@example.com

Implementation: e14d689. The lib surface (StatelessClient::login_device_code, AuthClient::login_device_code, DatumCloudClient::login_device_code, plus a new DeviceCodeInfo public type) is shaped so the upcoming connect-lib extraction inherits the right boundary — the display callback takes a plain struct so callers don't take a direct dep on openidconnect.

Binaries

Target	Tarball	sha256
Linux amd64 (x86-64)	`datum-connect-linux-amd64.tar.gz`	`1ae36d289d5bdcbc74cc3f5697afe4d50acae4486328b05414c58df3f9f871aa`
Linux arm64 (aarch64)	`datum-connect-linux-arm64.tar.gz`	`80cc9657ae01dff06a3863ce053f7d4385946a808d69de80d96b1422d5ae895c`

Verify: sha256sum -c SHA256SUMS

Install

ARCH=amd64   # or arm64

curl -fsSL -o datum-connect.tar.gz \
  "https://github.com/datum-cloud/app/releases/download/cli-v0.2.0/datum-connect-linux-${ARCH}.tar.gz"
curl -fsSL -o SHA256SUMS \
  "https://github.com/datum-cloud/app/releases/download/cli-v0.2.0/SHA256SUMS"

sha256sum -c <(grep "datum-connect-linux-${ARCH}.tar.gz" SHA256SUMS)

tar xf datum-connect.tar.gz
sudo install -m 0755 datum-connect-linux-${ARCH}/datum-connect /usr/local/bin/datum-connect
datum-connect --version
# datum-connect 0.2.0

Changes since cli-v0.1.0

e14d689 feat: auth login --no-browser via OAuth2 device authorization grant
e0ce7c0 chore(cli): bump version to 0.2.0

macOS

Still not in this release — same blocker as v0.1.0 (aws-lc-sys needs Apple Frameworks that Zig's bundled SDK doesn't include). Tracked for a future macos-14 GitHub Actions workflow.

Build provenance

Built locally on Linux x86_64 via cargo-zigbuild (Zig 0.16.0, Rust stable, cargo-zigbuild 0.22.3) from commit e0ce7c0. openssl vendored statically per d702e02. Binary debug info stripped before packaging.

Assets 5

08 Jun 22:13

drewr

cli-v0.1.0

7fbd576

datum-connect CLI v0.1.0

First standalone release of the datum-connect CLI.

This is the headless tunnel agent — the same Rust binary the desktop app uses for its tunnel data plane — packaged as a self-contained executable for unattended use on servers and CI.

Binaries

Target	Tarball	sha256
Linux amd64 (x86-64)	`datum-connect-linux-amd64.tar.gz`	`aaca5533cf8e19b13d364471c4466a644b1058e42d537991326a123bee31b83b`
Linux arm64 (aarch64)	`datum-connect-linux-arm64.tar.gz`	`a8bf0342b9a6ca70a54ed5e64ae5f202d7dfe577a0afbfd4daff97d1ef92848d`

Verify: sha256sum -c SHA256SUMS

Install

ARCH=amd64   # or arm64

curl -fsSL -o datum-connect.tar.gz \
  "https://github.com/datum-cloud/app/releases/download/cli-v0.1.0/datum-connect-linux-${ARCH}.tar.gz"
curl -fsSL -o SHA256SUMS \
  "https://github.com/datum-cloud/app/releases/download/cli-v0.1.0/SHA256SUMS"

sha256sum -c <(grep "datum-connect-linux-${ARCH}.tar.gz" SHA256SUMS)

tar xf datum-connect.tar.gz
sudo install -m 0755 datum-connect-linux-${ARCH}/datum-connect /usr/local/bin/datum-connect
datum-connect --version
# datum-connect 0.1.0

What's in this build

Built from 7fbd576 on the cli-tunnel-and-auth branch. Includes the recent set of CLI hardening landed throughout this branch:

Per-project iroh listen_key to prevent cross-project Connector collisions
--id resume with the matching-endpoint guard
Single-candidate auto-adopt; arrow-key picker for multi-candidate cases
Streaming setup progress with observedGeneration-aware Ready checks
Resource-id annotations on every progress line for datumctl describe pivots
Connectivity-verification phase (origin + proxy URL probes, configurable --timeout)
Runtime watch that fail-fasts on iroh DNS owner conflicts
Quota-check timeout retries on resource creates
Idempotent update_project so resumes don't churn Envoy
Transient-apiserver-error tolerance during setup polling

See PR #130 for the full commit-by-commit summary.

macOS

Not in this release. The macOS aarch64 cross-compile from Linux is blocked on Zig's bundled Apple SDK not including Frameworks (CoreServices.h missing for aws-lc-sys). Building this target needs either a Mac runner or a GitHub Actions macos-14 job — tracked separately.

Build provenance

Built locally on Linux x86_64 via cargo-zigbuild (Zig 0.16.0, Rust stable, cargo-zigbuild 0.22.3). openssl vendored statically per d702e02. Binary debug info stripped before packaging.

Assets 5

14 May 16:45

mattdjenkinson

v0.0.41

46aaeba

v0.0.41

Version: 0.0.41
Tag: v0.0.41
Commit: 46aaeba
Built: Thu May 14 16:52:36 UTC 2026
Workflow: https://github.com/datum-cloud/app/actions/runs/25872790513

Assets: Datum.dmg, Datum.AppImage, Datum-setup.exe (see SHA256 checksums below).

Assets 5

14 May 15:20

mattdjenkinson

v0.0.40

a067264

v0.0.40

What's Changed

fix(dns_dev): emit one addr= TXT entry per address by @zachsmith1 in #152
chore: enable Sentry release reporting and bump Dioxus to 0.7.9 by @mattdjenkinson in #155
fix: stale-auth recovery in PCP client and tunnel delete UX by @mattdjenkinson in #156

Full Changelog: v0.0.39...v0.0.40