Skip to content

v0.3.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Oct 05:18
· 5 commits to main since this release
v0.3.0
d946ecb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The CHANGELOG is the reviewed record and lists every breaking change; the Breaking changes group below lists only the commits marked type!:.

Changelog

Install

  • Homebrew: brew install abd-ulbasit/tap/upgradescope (the tap pulls each stable release within about 6 hours)
  • krew: kubectl krew install upgradescope (once the plugin is in krew-index)
  • Debian/Ubuntu, Fedora/RHEL, Alpine: the .deb, .rpm and .apk packages below. The packages themselves are unsigned (verify them with checksums.txt), so Alpine needs apk add --allow-untrusted ./upgradescope_*.apk.
  • Binary: download the archive for your platform below; it includes shell completions and man pages.
  • Image: ghcr.io/abd-ulbasit/upgradescope:0.3.0 (linux/amd64, linux/arm64)
  • Helm: helm install upgradescope oci://ghcr.io/abd-ulbasit/charts/upgradescope --version 0.3.0

Contracts

report.schema.json (the JSON report), webhook.schema.json (webhook payloads) and openapi.yaml (the server's REST API) below are this release's machine-readable contracts, covered by checksums.txt. What may change between releases: the compatibility policy.

Verify

Archives, the image and the chart are signed keylessly by this repository's release workflow. Verifying the image or the chart needs cosign 3.x, or 2.6.3 or later (older versions fail with no signatures found); cosign verify-blob of checksums.txt works from cosign 2.4.3.

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/abd-ulbasit/upgradescope/\.github/workflows/release\.yml@refs/tags/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

cosign verify ghcr.io/abd-ulbasit/upgradescope:0.3.0 \
  --certificate-identity-regexp '^https://github.com/abd-ulbasit/upgradescope/\.github/workflows/release\.yml@refs/tags/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each platform image is signed too and verifies on its own: cosign verify ghcr.io/abd-ulbasit/upgradescope@<platform digest> with the same flags (and the chart: cosign verify ghcr.io/abd-ulbasit/charts/upgradescope:0.3.0). Each archive has an SPDX SBOM (<archive>.sbom.json); archives, packages and the image carry LICENSE, NOTICE and THIRD_PARTY_NOTICES (in the image under /licenses/).

Assets 25
Loading