Skip to content

v0.28.2

Latest
Latest

Choose a tag to compare

View all tags
@bomly-release bomly-release released this 04 Oct 21:43
· 1 commit to main since this release
Immutable release. Only release title and notes can be modified.
v0.28.2
943a149

What's Changed

  • ci(release): shorten the release pipeline without dropping a check by @bomly-guy in #499
  • feat(assurance): compare only declared measurements, each with a plain explanation by @bomly-guy in #498
  • fix(test): keep Go's module and build caches when a test redirects HOME by @bomly-guy in #500

Full Changelog: v0.28.1...v0.28.2

Release artifacts

  • Full builtin bomly archives for Linux, macOS, and Windows.
  • Alternate bomly-lite archives for users who prefer external Syft and Grype binaries.
  • Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
  • Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
  • SHA256SUMS for release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).
  • SLSA Build Level 3 provenance (multiple.intoto.jsonl) generated by slsa-github-generator.

Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.

Contributors

bomly-guy
Assets 26
Loading