v0.4.3

Added

• docs/technical-documentation.md: the index of the technical documentation of the Cyber
  Resilience Act (Annex VII), with the product category, the conformity route, who signs the
  declaration, how the CE marking is shown for software and how the documentation is kept; and
  docs/declaration-of-conformity.md, the template of the EU declaration of conformity. The
  user information now gives the address of the declaration.
  (#129)
• docs/third-party-components.md: the criteria for adding a dependency and who reviews it, how
  the dependency checks fit together, what is done when a dependency has a vulnerability, and how
  it is reported to the component's maintainers with any fix. SECURITY.md, CONTRIBUTING.md and the
  pull request template point to it.
  (#130)
• The Linux binaries can be rebuilt from the release tag with the same bytes:
  packaging/build/build.sh builds them in a container image pinned by digest, with Debian packages
  from a fixed snapshot, and the release builds them the same way. docs/verifying-releases.md
  describes the rebuild, and a workflow repeats it for every published release.
  (#43)

Changed

• A release is no longer signed or published while a security advisory is open for its tagged
  commit: the release workflow checks it with cargo deny and cargo audit against the RustSec
  advisory database, and the release notes end with the result. An advisory can only be accepted
  in deny.toml with a written reason and a review date, which CI checks; CONTRIBUTING.md
  ("Known vulnerabilities at release") has the rule.
  (#121)

Verify the download as described in Verifying releases.

No unaddressed security advisory for this commit (cargo-deny 0.20.2, cargo-audit 0.22.2, RustSec advisory database at 6aed84668c23).

What's Changed

• OpenAPI drift report: de-duplicate on the workflow's own text only by Gorka Gonzalo (@d0ubl3g) in #165
• Package repository: what users check against comes from the source repository only by Gorka Gonzalo (@d0ubl3g) in #166
• Add the technical documentation index and the declaration of conformity template by Gorka Gonzalo (@d0ubl3g) in #167
• Do not sign or publish a release with an unaddressed security advisory by Gorka Gonzalo (@d0ubl3g) in #168
• Write the third-party component policy by Gorka Gonzalo (@d0ubl3g) in #169
• Build the Linux binaries reproducibly in a pinned image by Gorka Gonzalo (@d0ubl3g) in #171
• Prepare 0.4.3: version and changelog by Gorka Gonzalo (@d0ubl3g) in #172
• Release 0.4.3 by Gorka Gonzalo (@d0ubl3g) in #173

Full Changelog: v0.4.2...v0.4.3