# DataNivra agent 0.4.4

- Source commit: `49af42c026c4014df73e7afee39be3d3f7f5e71f`
- Image (pin this digest): `ghcr.io/manuelbomi/datanivra-agent@sha256:cfa91b8a257e7a966fa3f5b8694bc41e7a9ce3bbb18e28c81f90689c7bd6c5d0`
- Platforms: linux/amd64 linux/arm64
- Helm chart: `datanivra-agent-0.4.4.tgz` (+ `datanivra-agent-0.4.4-helm-values.yaml` pinning the digest)
- Packages: datanivra-agent-docker-0.4.4.tar.gz datanivra-agent-docker-compose-0.4.4.tar.gz datanivra-agent-kubernetes-generic-0.4.4.tar.gz datanivra-agent-azure-customer-vnet-0.4.4.tar.gz datanivra-agent-aws-customer-vpc-0.4.4.tar.gz 

## Verify before installing

```bash
cosign verify-blob --bundle SHA256SUMS.cosign.bundle \
  --certificate-identity 'https://github.com/manuelbomi/datanivra-platform/.github/workflows/release-agent.yml@refs/tags/agent-v0.4.4' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' SHA256SUMS
sha256sum --check SHA256SUMS
cosign verify ghcr.io/manuelbomi/datanivra-agent@sha256:cfa91b8a257e7a966fa3f5b8694bc41e7a9ce3bbb18e28c81f90689c7bd6c5d0 \
  --certificate-identity 'https://github.com/manuelbomi/datanivra-platform/.github/workflows/release-agent.yml@refs/tags/agent-v0.4.4' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'
```

The release contains no enrollment tokens or credentials: create a one-time enrollment token in
the console (Agents -> Install) and keep every credential in your own secret store. After
installing, run `datanivra-agent doctor` inside the agent's environment.

## What changed in 0.4.4

### Upgrade notice: integer pseudonyms change (read before upgrading)

Masked **32- and 64-bit integer keys** (`HMAC_PSEUDONYMIZE` on INTEGER / BIGINT columns) now use
one width-independent keyed mapping, so the same id masks to the same value in an INTEGER column,
a BIGINT column and its decimal text form. Foreign keys that cross column widths now join after
masking.

**Effect on existing datasets:** pseudonyms of 32/64-bit integer keys produced by this agent differ
from those produced by agents 0.4.3 and earlier. Datasets that must join each other (for example
two systems masked separately, or a dataset and a later refresh you compare it with) should be
built or refreshed with the same agent version. Text, e-mail, date and other strategies are
unchanged. 8- and 16-bit integer columns (TINYINT / SMALLINT) keep their own mapping and do not
link to the same id in a wider column. Referential-integrity certification still reports any
orphan.

### Other changes

* **Masking keys fail closed.** A job that pins a key version the agent does not have now fails
  instead of falling back to the unversioned key (only version 1 may use the unversioned key).
* **Composite keys.** Multi-column pseudonym inputs are length-prefixed, so different key tuples can
  no longer produce the same pseudonym.
* **PostgreSQL delivery streams in batches.** Provisioning into PostgreSQL reads Parquet in bounded
  batches instead of whole tables, so large tables no longer need agent memory proportional to
  their size.
* **Test Data API.** The agent fulfils Test Data API requests (synthetic builds from approved test
  data profiles and leases of DataNivra-certified versions) through the same jobs as before; no new
  agent configuration is needed.