v0.4.0

Minor Changes

• 4c8029a: run --push and push sign keyless from a laptop: without --key or $SIGSTORE_ID_TOKEN and with a terminal (or with the new --login flag), they open the interactive Sigstore login in the browser (oauth2.sigstore.dev, client id sigstore; $SIGSTORE_OIDC_ISSUER and $SIGSTORE_OIDC_CLIENT_ID override them) right before signing, after the test ran. The token is used for that signature only and never stored. Without a terminal and without --login, a run with no key and no token still fails fast with exit 2. --key and --login exclude each other.

Patch Changes

• b619b24: More than 64 attestations for a fingerprint now prints an aval: SECURITY: line naming the cap, as a possible flooding attempt; the outcome stays error and the test runs. Aval's own CI and release jobs fail when a verify report lists a verification failure in rejected, even when a trusted result verified.

v0.3.0

Minor Changes

• 4b68dd5: aval stats --registry <repo> [--test <id>] [--since <duration|date>] [--by test|repository] [--output text|json] reads the run records in the registry and aggregates them on demand: runs, hit rate, misses by cause, verification failures, shadow false hits, and total and saved test time, per test (or per source repository with --by repository) and in total. It writes nothing. Records that are unreadable, oversized, malformed or inconsistent are skipped and counted; reading stops after 1000 records or 64 pages per listing, with a warning. New format, provisional: aval.trianalab.io/stats-report/v1 (pkg/evidence adds StatsReport, TestStats, RepositoryStats, RunStats, MissCauses, StatsReportVersion and StatsUnknownRepository). Run records gain the optional verifiedResult and repository (--repository on aval run and aval record; records without it count as unknown), and evidence.ParseRunRecord now rejects inconsistent records (reused: true requires outcome verified and testDurationMs 0; verifiedResult requires outcome verified), so aval record refuses a hand-edited record that claims a reuse that never happened. Docs explain pruning old records with ORAS.
• 6351105: Registry I/O is bounded. run, verify and push take --registry-timeout (default 1m). A registry that stalls past the timeout gives outcome error, and aval run still runs the test. Lookup follows at most 64 referrers pages. A listed attestation whose manifest was deleted (404) counts as absent: the remaining candidates can still be reused, and the outcome is a miss if every candidate is gone. One credential store and one auth cache are shared by every registry call. The keyless trusted root (a TUF fetch when trustedRoot is not pinned) is loaded only when a candidate's bundle carries a certificate. After pushing, push and run --push confirm that the new digest is listed among the referrers, re-pushing up to three times, and fail if it never appears.
• 7cd688f: Aval detects mutable references in a test's inputs and refuses to reuse them. A static, offline scanner reads the files in the contract scope and runner.command, one detector per ecosystem: container images without a digest (Compose and Kubernetes image:, Dockerfile FROM and COPY --from, docker run and podman run, compose files the command uses but the scope does not hold), Go (go.mod without go.sum, go install pkg@latest), npm, yarn, pnpm and bun (package.json without a lockfile, unpinned npm i and npx), Python (unpinned requirements*.txt entries, missing hashes, Poetry and Pipenv without a lockfile, unpinned pip install), Rust (Cargo.toml without Cargo.lock), Java (Maven and Gradle SNAPSHOT, LATEST, RELEASE, dynamic versions and ranges), Ruby (Gemfile without Gemfile.lock), PHP (composer.json without composer.lock), OS packages (apt-get install and apk add without versions), remote scripts (curl … | sh, remote ADD without --checksum) and git (git clone without a commit, submodules that track a branch). For hermetic and controlled-environment contracts any unacknowledged finding makes the lookup a miss (exit 4 for verify) whose reason lists each reference, the test runs, and run --push and push do not publish (exit 1). external-dependencies contracts get the findings as information; non-deterministic is unchanged. aval run prints each finding as a mutable: line (--fingerprint-only prints them on stderr). Contract format change, additive within aval.trianalab.io/v1: the optional scope.allowMutable list (ref and reason) acknowledges a reference by the exact text Aval reports. It is part of the contract hash; contracts without it keep their fingerprint, and the manifest stays aval-fingerprint/v1. Older aval binaries reject contracts that use the new field. A contract whose scope holds a mutable reference that earlier versions reused now misses until the reference is pinned or acknowledged. Guide: "Pin your dependencies" (docs/pinning.md).
• 0e259b7: Aval resolves declared artifacts to immutable ids at fingerprint time. The optional scope.resolve list takes kind: reference entries for container images (image, tag to manifest or index digest), npm, PyPI, Go modules (through the module proxy, h1: hash), Maven, crates.io, RubyGems, git (ref to commit with git ls-remote) and plain URLs (sha256 of the download, up to 256 MiB). Each resolves a tag, a version range or a branch to its digest, checksum or commit, which goes into the manifest as a resolve <kind> <reference> <version> <id> line: a repushed tag, a new release inside a range or a moved branch changes the fingerprint. Resolution is opt-in and stateless, bounded by a 2-minute deadline; a reference that cannot be resolved fails the fingerprint, so nothing is looked up, the test runs and nothing is published, and the reason names the reference. aval run --explain prints the time each lookup took on stderr. scope.resolve never clears a finding of the mutable-reference scanner: it makes a move change the fingerprint, and the reference still blocks reuse until it is pinned in place or accepted with scope.allowMutable. scope.resolve binds the named artifact, not its transitive dependencies. Registries come from $npm_config_registry, $GOPROXY, $AVAL_PYPI_URL, $AVAL_MAVEN_URL, $AVAL_CRATES_INDEX and $AVAL_RUBYGEMS_URL; credentials from the Docker config, ~/.npmrc tokens, ~/.netrc machine entries and git, sent only over https or to a loopback host. Format changes, additive: the contract field within aval.trianalab.io/v1 (older binaries reject contracts that use it), and the resolve manifest lines within aval-fingerprint/v1, which only contracts with the field have; every other manifest is unchanged. Guide: "Resolve references" (docs/resolve/).
• 8d4b8d8: Run statistics in the registry. aval run --record publishes one run record per run, for every outcome, with the test id, fingerprint, outcome, whether the result was reused, the result, the test duration, the saved duration, the aval version, a timestamp and an optional --ci-run-url. Records hang off a per-test stats anchor tagged stats-<test id>, never off a fingerprint anchor. run and verify never read them, so a record cannot cause reuse or count toward the candidate cap. Recording is best-effort: a record that cannot be published, for example without write credentials, is a warning and never changes the exit code. --record-file writes the record to a file and aval record publishes it later. New format identifiers, provisional: aval.trianalab.io/run-record/v1, application/vnd.trianalab.aval.run.v1 (+json for the layer) and application/vnd.trianalab.aval.stats.v1. pkg/evidence adds RunRecord, ParseRunRecord and these constants.
• ff2a2c8: A contract can depend on other contracts in the same repository. The optional scope.contracts list takes paths to other aval.yaml files, relative to the contract (../backend/aval.yaml). Each referenced contract is fingerprinted from its own directory and scope, and its fingerprint goes into the manifest as a contract <path> <name> <fingerprint> line, transitively: a change inside a referenced contract's scope makes the dependent miss and run, a change outside it does not. References must stay inside the git working tree of the contract (the nearest directory with a .git entry); a missing, invalid, symlinked or cyclic reference, or more than 8 levels or 64 contracts, fails the fingerprint, so the test runs. A referenced contract's mutable references block the dependent's reuse unless the referenced contract's own scope.allowMutable accepts them. aval run --explain prints the dependency tree after the manifest. Format changes, additive: the contract field within aval.trianalab.io/v1 (older binaries reject contracts that use it), and the contract <path> manifest lines within aval-fingerprint/v1, which only contracts with the field have; every other manifest is unchanged. Guide: "Depend on another part of the repo".
• 6b94c21: One-line installers: scripts/get-aval.sh (Linux and macOS, curl | bash) and scripts/install.ps1 (Windows, irm | iex). Both refuse a download whose sha256 does not match the release's checksums.txt, and verify the release signature (cosign) and SLSA provenance (gh attestation verify) when those tools are installed. See docs/install.md.

Patch Changes

• 0553f1e: scope.allowMutable entries take an optional file: (the path a finding prints, relative to the contract, or runner.command): the entry then accepts the reference in that file only. A ref-only entry still accepts a reference that one file reports; when several files report it (generic refs such as resources[0] or patches[0] repeat across kustomizations), nothing is accepted and the finding asks for file:. With scope.contracts, each contract's entries apply to its own findings. The scanner also reports kustomize helmCharts entries other than a local chart in the scope, and patches given by a path outside the scope; checks instructions behind ONBUILD; uses the # escape= character when it splits heredoc words; and no longer reports a range loop's key variable used as a key directly under labels: or annotations: in a Helm template. Since the previous release, image refs in JSON files ("image": "postgres:16",) no longer end in ",: update an acknowledgement written with the trailing characters to the bare reference (postgres:16).
• 2df8ee2: A signer the trust policy lists but below minTrustLevel is now reported as miss (exit 4), and with outcome miss in the verify report's rejected list, instead of verification-failed (exit 5). Such an attestation is still never reused, and a false claim from that signer stays verification-failed. The report stays `aval.trianalab.i...

v0.2.0

Minor Changes

• 0148c76: Formats are frozen. The contract and policy apiVersion is now aval.trianalab.io/v1 and the verify report version is aval.trianalab.io/verify-report/v1; aval.dev/v1alpha1 contracts and policy files are rejected, so change that line in yours. The contract hash covers apiVersion, so results published before are misses and each test runs once. The predicate type (https://aval.trianalab.io/attestation/execution/v2), media and artifact types (application/vnd.trianalab.aval.execution.v2, application/vnd.trianalab.aval.fingerprint.v1) and predicate schemaVersion v2 are unchanged and now frozen, so attestations written by v0.1.0 keep a valid, readable format. Compatibility rules (additive changes within a version, what needs a new version, how consumers treat unknown fields and values, deprecation) are in docs/artifact-format.md, and golden files guard the JSON shape of the statement, predicate and verify report.

Patch Changes

• c17dc26: aval run and aval verify escape newlines and control characters in reasons printed as text and on stderr, so text from an untrusted attestation cannot start a log line of its own. Aval's own CI now reuses its signed e2e results, and a release requires a verified e2e attestation for its commit.
• 59b9b66: pkg/evidence is semver-stable Go API: within a major version it changes additively only, and CI fails when an exported identifier is removed or changes type or signature without a new major module path. examples/evidence-consumer is a separate module that consumes Aval evidence through pkg/evidence alone, with its own signature verifier. The policy is in docs/integrations.md.
• bbf9e55: Fingerprinting fails closed in two more cases: a scope.source glob that matches no file (a typo, or a name that differs on disk by case or Unicode form), and a file excluded only because a trailing ** in exclude matched zero segments (build/** against a file named build). Trees that fingerprinted before and still do keep the same fingerprint. A table-driven false-hit corpus now pins every kind of relevant and irrelevant change.

v0.1.0

Minor Changes

• a6d2b1a: First release: signed aval binaries for Linux, macOS and Windows with checksums, SBOMs and SLSA provenance. aval --version prints the release version.

Patch Changes

• 59664a3: Dependency updates: oras.land/oras-go/v2 2.6.4 to 2.7.0; GitHub Actions actions/checkout to v7.0.1, actions/setup-go to v7.0.0, actions/upload-artifact to v7.0.2, actions/download-artifact to v8.0.2 and actions/dependency-review-action to v5.0.0 (Node 24 runtime).