Release v3.0.0

Changes

Breaking

• Challenges that are not services no longer get instances. cmgr now derives a
  delivery_type for every challenge (service, artifact_only, or flag_only) from
  whether it publishes ports and which challenge type it uses. Only service challenges
  run instances: builds of artifact-only and flag-only challenges always report an empty
  instances list, and POST /builds/<id> (start instance) fails for them. Previously
  every build launched a placeholder container.

  • API consumers must branch on delivery_type. An empty instance list is only a
    deployment problem when delivery_type is service and instance_count is
    positive; on-demand builds (instance_count of -1) legitimately have zero
    instances between user sessions.
  • Placeholder instances left over from older versions are torn down on the next schema
    update or challenge rebuild.
  • cmgr test and cmgr playtest skip the start/stop steps for non-service challenges
    and run the solver directly against the build.

• Docker image tags are now content-addressed. Tags changed from
  <challenge>:<build_id>-<host> to <challenge>:s<seed>-<checksum>-<host>, where the
  checksum covers the challenge source and flag format. Build IDs are local database
  handles and no longer appear in tags, so rebuilt content gets a new tag instead of
  mutating one in place (making challenge images safe to push to a registry). Anything
  that reconstructs image tags from build IDs must be updated. Existing images are
  retagged automatically by a one-time, resumable migration on first start.

• Built-in challenge types now build on ubuntu:24.04 (was ubuntu:20.04). This
  affects remote-make, static-make, and the solver image. Existing challenges may
  need updating for OpenSSL 3.x, PEP 668 (pip now runs with
  --break-system-packages), and renamed distro packages.

New features

• flag-only challenge type for challenges that are nothing but a submission prompt
  — no service, no downloads (knowledge checks, second flags exported by a sibling
  challenge). The build's only product is metadata.json; a Makefile is optional, and
  the SEED build argument allows per-build shuffling of option lists. Exempt from
  cmgr test --require-solve, since the flag is the answer. See
  examples/flag-only/.
• POST /builds/<id>/check runs the automated solver against a non-service build
  without an instance, mirroring the existing instance check. Service builds are
  rejected. cmgr test --require-solve uses the same path.
• cmgr update --prune-old untags the image generation each rebuild displaces from
  its rollback slot. Off by default, since another cmgr database on the same Docker
  daemon may reference those tags. Removal is refcount-guarded; the current and previous
  generations are always retained.
• cmgr test --keep-images retains build images until the whole run finishes so
  challenges can share base layers — a large speedup when testing a directory of
  challenges. Used by CI.
• Builds now report checksum and prev_checksum (the retained rollback generation)
  through the API, and images carry cmgr.managed / cmgr.challenge labels.
• cmgr update prints a delivery-type summary, so a challenge that is unexpectedly
  artifact-only (a forgotten # PUBLISH) is visible before deployment. A challenge that
  publishes neither ports nor artifacts logs a warning.

Fixes

• Docker build failures are no longer swallowed. Modern daemons emit an error key
  before errorDetail; the old anchored pattern missed it and surfaced every build,
  push, and pull failure as a misleading "No such image".
• cmgr update now warns when a challenge's on-disk source has drifted but its builds
  are already complete, closing the gap where updating a schema left stale images in
  place.
• Artifact extraction works against images with no CMD, no need to tail /dev/null anymore.
• Solvers for artifact-only challenges run on Docker's default bridge, preserving
  outbound network access.
• Line endings are normalized to LF via .gitattributes.

Examples and CI

• Example challenges standardized on ubuntu:24.04 and hardened; the multi reference
  was deduplicated and the static-make lockbox builds against OpenSSL 3.0.
• The disks examples share a slimmed libguestfs base image, cutting build time
  substantially.
• CI checks out before setup-go so the Go module cache actually hits, and runs the
  integration tests with --keep-images.

Dependencies

• Bumped docker/cli, moby/moby (api + client), mattn/go-sqlite3, yuin/goldmark,
  JohannesKaufmann/html-to-markdown, golang.org/x/net, and golang.org/x/sys to
  their latest releases.