12 releases 14 tags

RSS feed

• 0.10.0 784746ce03

  Compare

  0.10.0 Stable

  marvin8 released this 2026-08-31 08:20:51 +00:00 | 0 commits to main since this release

  Signed by marvin8

  SSH key fingerprint: SHA256:B4Q+9pbWSIqGYTl3Ub/FPrBSqAVd2OkCR13hYRG5wek

  [0.10.0] - 2026-08-31

  • Newly published wuming container images carry a Software Bill of Materials (SBOM) as a signed CycloneDX attestation — cosign verify-attestation --key wuming.pub --insecure-ignore-tlog --type cyclonedx registry.marvin8.zone/marvin8/wuming:latest checks and retrieves it.
  • Images are signed with cosign (managed key, public key published as wuming.pub); the SBOM is attached as a signed attestation, verifiable with cosign verify-attestation.

  Commits

  • 🔀 Merge branch 'feat/sbom-signing' 0406d94
  • 🛡️ remove credential file via EXIT trap in both workflows 60d5033
  • 🔀 Merge branch 'feat/port-ci-publish' into feat/sbom-signing cf81aa1
  • 🚀 port SBOM, signing, and attestation into prod publish 0926321
  • 🔀 Merge branch 'feat/issue-66-cosign' into feat/sbom-signing e0db6b4
  • 🔄 switch cosign signing to v2 for podman-native verification 6024d8a
  • 📝 point SBOM retrieval at the attestation flow 5602c34
  • 🐛 disable signing-config for managed-key cosign calls ac27e84
  • 🔑 add cosign public key for image verification 411d162
  • ✨ sign images and attest SBOMs with cosign 73a19f8
  • 🔀 Merge branch 'feat/issue-65-sbom' into feat/sbom-signing 37dedc9
  • 🔒 write docker creds with restrictive umask and clean up baa65be
  • 🐛 give cosign registry creds and attach as CycloneDX bfdbb1f
  • 🔒 keep registry password out of process argv 21e8c92
  • 🔒 pass registry password via stdin de1f357
  • 👷 publish-container workflow only ever pushes :dev ad04c25
  • 👷 make publish-container a dev-only testing workflow by default 3f61bc8
  • 🛡️ fail on empty checksum file; polish release notes fe60655
  • 📝 use timeless wording for SBOM release note c188b01
  • 📝 clarify release boundary in SBOM note f414607
  • 🛡️ wrap pin verification errors and sanitize log values 7e3cd83
  • 🛡️ harden checker against bad pins and log injection 4938873
  • ✅ harden version checker and clarify SBOM release notes 6bcf4f3
  • 🐛 fix urlopen timeout and correct cosign download sbom command 0d8c104
  • 📝 document SBOM attachment in release notes ed5a207
  • ⬆️ bump pinned syft/cosign to 7-day-aged releases bcb5ac6
  • 🔧 add weekly staleness check for pinned syft/cosign versions 471d736
  • 🔒 use checksum-verified binary downloads instead of curl | sh 493be8c
  • ✨ add SBOM generation and attachment to container images 96ba4df

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads