Skip to content

v1.0.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Oct 11:53
v1.0.1
This tag was signed with the committer’s verified signature.
Coopyrightdmin Ludovic Fernandez
SSH Key Fingerprint: KFrwTb32Z+Iy5gnmM3EgIoXkK7P/d5XTTFm/DrMMADg
Verified
Learn about vigilant mode.
990acbc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release overview

hankoShell Operator 1.0.1 updates the embedded image verifier and improves the
standalone onboarding path. The 17 hanko.sh/v1alpha1 APIs remain experimental;
this patch does not change their schema or enable lifecycle operations.

Security

  • Update embedded Cosign to 3.1.4 and chi to 5.4.0, addressing CVE-2026-114437.
  • Use maintained OpenPGP dependencies instead of the deprecated
    golang.org/x/crypto/openpgp packages reported by GO-2026-5932. The module-level
    UNKNOWN report can remain in scanners; this is not a claim of an empty report.
  • Reject verifier builds that downgrade Cosign or reintroduce those packages.

Onboarding

  • Add a disposable kind demonstration for OIDC registration, explicit adoption
    with a preserved client UUID, and real machine authentication.
  • Verify callback changes against the current declared generation and the actual
    Keycloak client, with isolated kubeconfig and owned-cluster cleanup.
  • Organize the README around three usage journeys and publish the qualification
    measurements with their limits.
  • Align documentation with the public release and the 17-resource API inventory.

See the standalone chart guide,
API scope, support window and
qualification. Historical endurance results retain their
recorded revisions; the patch has its own final-image qualification.

Assets 19
Loading