v0.5.0

Changelog

Features

• feat(cli): name the publisher key a source must be signed with
• feat(cli): verify against the identities a policy allows
• feat(cli): read a trust policy from the config
• feat(trustpolicy): decide which keys may sign a reference
• feat(trustpolicy): match a reference against a pattern
• feat(cli): say when a model lost the provenance its layers claim
• feat(transfer): report how many attestations a bundle carries
• feat(transfer): carry the attestation with the model
• feat(cli): attest to a model's sources when signing it
• feat(attest): state where an artifact's layers came from
• feat(cli): carry a fetched file's source into the packer
• feat(pack): record where a fetched file came from
• feat(cli): check an import against the publisher's signature
• feat(omsig): read the signature a model repository publishes
• feat(cli): pack a whole repository, keeping each file's digest
• feat(pack): record the digest each file was published under
• feat(hf): resolve a whole published model
• feat(cli): report the weight encoding, and carry a model's licence

Fixes

• fix(ci): decide from the changed files rather than a pattern library
• fix(ci): make the change filter subtract from everything
• fix(cli): hold an attestation to the identity that signed the artifact
• fix(trustpolicy): bound ** segments to prevent exponential backtracking
• fix(signing): resolve an attestation by the reference its target uses
• fix(cli): lay fetched files out under their repository path
• fix(hf): name the endpoint a repository was actually fetched from
• fix(cli): report a manifest that cannot say what was owed
• fix(hf): refuse an encoded walk and escape the path on the wire
• fix(cli): say how much of an artifact an attestation covers
• fix(cli): give every fetched file a directory of its own
• fix(hf): check a published path where it is decoded
• fix(cli): name the same layer every time an attestation falls short
• fix(hf): hold a paths-info response to the files that were requested
• fix(cli): match an attestation's records against whole layers
• fix(signing): annotate an attestation the way cosign reads one
• fix(transfer): report whether a source attestation travelled
• fix(signing): read attestations and tags consistently with the rest of the store
• fix(attest): validate the caller's subject digest before comparing it
• fix(hf): validate a reported commit and pin every request to it
• fix(hf): fetch from the commit the listing resolved to
• fix(cli): isolate each fetched repository under its own directory
• fix(omsig): read per-file digests from predicate.resources
• fix(cli): refuse local files and misreported failures under --oms-key
• fix(omsig): reject empty and malformed sha256 digests
• fix(e2e): stop the supervised child instead of orphaning it

Documentation

• docs: say when each set of verification rules is read
• docs: describe the trust policy and what it refuses
• docs(roadmap): separate keyless verification from the policy it extends
• docs: shorten three comments to what they explain
• docs: give the sample verify output a language
• docs: describe the listing check as the drop it is
• docs: record what a missing attestation costs and what says so
• docs: record what an attestation does and does not settle
• docs: record how a source attestation binds layers to upstream files
• docs(adr): record verifying a publisher's signature at import
• docs(readme): state what an import checks and what CI proves
• docs: scope the import digest check to what a repository publishes
• docs: packing a repository, and what its signature is checked against
• docs(roadmap): lay out the milestones from import provenance to 1.0
• docs(roadmap): plan the provenance chain from a publisher to a load
• docs(comparison): record where KitOps verifies a signature
• docs: say what the remaining validation actually waits on
• docs(readme): add the OpenSSF Best Practices badge
• docs(readme): say how to obtain palan, and how to check what you obtained
• docs: correct three claims that had drifted from what the code does
• docs: separate the Kubernetes patterns that were run from the one that was not
• docs(readme): describe zero-copy and packing for both weight formats

Other

• refactor(cli): fill an attestation reference only where it is read
• build(deps): bump golang.org/x/crypto to v0.56.0
• build: lint markdown as part of check
• refactor(cli): spell out what makes two layer records the same
• build: build on the newest patch of the Go toolchain
• refactor(safetensors): name the files a model travels with in one place
• build(release): describe the image by what it distributes and what it serves

---

Binaries are static (CGO disabled). The checksum file is signed with
cosign (keyless); see .goreleaser.yaml for the verify command.