v1.0.0-rc.1

Not released yet — release candidates draw their notes from this section. The date above
is the intended one. Correct it and delete this note when v1.0.0 is tagged.

Initial public release. There is no earlier public version, so this section records the
baseline rather than a set of changes: it names the contracts this release establishes, so
that every later entry has something concrete to be breaking against.

Added

• The gdi-node-standalone service — a GA4GH Beacon v2 endpoint and a FAIR Data Point
  served on a public plane, with a separate in-cluster management plane. It ingests
  crypt4gh-encrypted .tar.c4gh dataset packages from an S3 bucket or a filesystem inbox
  and stores aggregated Parquet at rest, optionally encrypted.
• The gdi-dataset-tool provider CLI — builds, validates and packs a dataset package
  from VCF, for a data provider who does not run the node.

Contracts established by this release

A change to any of the wire contracts below is externally breaking. Bump the stated version
and record it here, so the aggregator, harvester and GDI User Portal can act on it. The Rust
version is not a wire contract: it is a ratchet, raised when a dependency needs it, and is
listed only so a packager knows what the source needs.

Contract	Version
Beacon API ([beacon].api_version)	v2.2.0
Beacon variant location encoding	GA4GH VRS 1.3
GDI metadata model (gdi_metadata_version)	1.2.0
Dataset package (manifestVersion)	1
Minimum supported Rust version	1.96

The FAIR Data Point graph shape follows the FDP specification and DCAT-AP; it is pinned by
snapshot tests rather than by a version number of its own.

---

Artifacts

Published assets for this release, generated from what was staged, so this list cannot
drift from the build matrix the way a hand-written platform list does:

• LICENSE-APACHE
• LICENSE-MIT
• SHA256SUMS
• THIRD-PARTY-LICENSES.md
• gdi-dataset-tool-v1.0.0-rc.1-aarch64-apple-darwin
• gdi-dataset-tool-v1.0.0-rc.1-x86_64-pc-windows-msvc.exe
• gdi-dataset-tool-v1.0.0-rc.1-x86_64-unknown-linux-gnu
• gdi-dataset-tool-v1.0.0-rc.1-x86_64-unknown-linux-musl
• gdi-dataset-tool.cdx.json
• gdi-node-standalone-v1.0.0-rc.1-aarch64-unknown-linux-gnu
• gdi-node-standalone-v1.0.0-rc.1-aarch64-unknown-linux-musl
• gdi-node-standalone-v1.0.0-rc.1-x86_64-unknown-linux-gnu
• gdi-node-standalone-v1.0.0-rc.1-x86_64-unknown-linux-musl
• gdi-node-standalone.cdx.json

What they are:

• gdi-dataset-tool — the data-provider CLI that builds, validates and packs a dataset.
• gdi-node-standalone — the node service, with S3 + Vault + PME compiled in and every one
  of them optional. The gnu/glibc builds are the primary, deployed artifact; the
  fully-static musl builds are a fallback for Alpine / NixOS / hard-static hosts where
  the dynamic glibc binary cannot run. For an inbox-only node, leave [s3]/[vault]
  unconfigured and the optional subsystems stay dormant.
• SHA256SUMS — checksums covering every artifact above.
• *.cdx.json — one CycloneDX SBOM per shipped binary (gdi-node-standalone.cdx.json,
  gdi-dataset-tool.cdx.json).
• THIRD-PARTY-LICENSES.md, LICENSE-APACHE, LICENSE-MIT — attribution bundle and the
  project's own dual licence.

Every artifact carries a SLSA build-provenance attestation; verify with
gh attestation verify <file> --repo GenomicDataInfrastructure/gdi-node-standalone.

The container image is published to GHCR (ghcr.io/genomicdatainfrastructure/gdi-node-standalone) from the same released
x86_64 gnu/glibc binary (no recompile), so the image and that bare-metal binary are
byte-identical; it carries its own SLSA build-provenance attestation.

What's Changed

• ci: turn off Dependabot version updates by @jaanisoe in #18
• build: Bump the patch-and-minor group with 6 updates by @dependabot[bot] in #4
• ci: Bump the patch-and-minor group with 2 updates by @dependabot[bot] in #9
• build: Bump jsonschema from 0.51.0 to 0.55.0 by @dependabot[bot] in #13
• build: Bump rust from 7f7a53a to 620dbcd by @dependabot[bot] in #1
• build: Bump the patch-and-minor group with 7 updates by @dependabot[bot] in #10
• build: regenerate the attribution bundle for the merged dependency bumps by @jaanisoe in #19
• docs(changelog): make the 1.0.0 section honest for a release candidate by @jaanisoe in #20

New Contributors

• @jaanisoe made their first contribution in #18
• @dependabot[bot] made their first contribution in #4

Full Changelog: https://github.com/GenomicDataInfrastructure/gdi-node-standalone/commits/v1.0.0-rc.1