Skip to content

Moco 0.0.1

Choose a tag to compare

View all tags
@guilycst guilycst released this 26 Oct 01:59
· 26 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.0.1
45f08c8

First Moco release: a self-hosted secret-management API with a single-instance SQLite production profile.

  • Tenant and vault isolation, envelope-encrypted secrets, conditional requests and transactional audit.
  • Independent Cobra CLI module with table, JSON and CSV output.
  • Production Helm chart with JSON Schema, native TLS, retained storage, verified mirrored backups and optional Prometheus Operator integration.
  • Public Linux amd64/arm64 OCI image with provenance and SBOM attestations, plus an OCI Helm chart whose defaults pin the exact image digest.

All release validation jobs passed: application/Dagger checks, production profile, and Helm 3/4. Both OCI packages were published successfully and verified by pulling their registry descriptors and chart archive.

docker pull ghcr.io/araihu/moco:0.0.1
helm pull oci://ghcr.io/araihu/charts/moco --version 0.0.1

Verified release manifest:

{
  "tag": "v0.0.1",
  "version": "0.0.1",
  "ociTag": "0.0.1",
  "commit": "45f08c889c70fea3b962394f1d52bb86ceefce37",
  "repository": "araihu/moco",
  "imageRepository": "ghcr.io/araihu/moco",
  "chartRegistry": "oci://ghcr.io/araihu/charts",
  "imageDigest": "sha256:21c070f36c2e60cb760fb1f763be8da9c55d14c126727615f95ee97c97a6921e",
  "chartDigest": "sha256:bc1e08645b2307f02269577098eadcab13a5608dad000478da75c48188c814de",
  "chartSHA256": "1a126fafab9f69754b8d7e9c08c4bf2e7a49d65e3fce0402f6cd4493b8b0061b"
}

Chart archive checksum (after helm pull):

1a126fafab9f69754b8d7e9c08c4bf2e7a49d65e3fce0402f6cd4493b8b0061b  moco-0.0.1.tgz

The initial publication workflow reports a failure only at GitHub asset upload: this release became immutable before the workflow attached moco-0.0.1.tgz, release.json and SHA256SUMS. These attachments are unavailable for v0.0.1; download the chart from OCI and use the verified manifest/checksum above. The tag, source commit and published OCI artifacts remain unchanged. Subsequent versions use a draft-first workflow that uploads assets before publication, as required by GitHub immutable releases.

See the installation and operations guide and updated release runbook.

Assets 3
Loading