·
4 commits
to main
since this release
Immutable
release. Only release title and notes can be modified.
Changelog
Features
- c3af0e4 feat(cli): dynamically inject Version, Commit SHA, and BuildTime into CLI binary using compiler ldflags
- bc541c1 feat(examples): add security configuration blocks to all examples specs, and base frontend on alpine:3.20
- db0b3e0 feat(linter): implement build-time OPA config hardening linter with ignore-rules
- 820596f feat(reproducible): integrate SOURCE_DATE_EPOCH constraints on build-args and metadata creation timestamps
- ccb4634 feat(sbom): add support for declarative spdx and cyclonedx sbom formats via yaml
- 66041af feat(sbom): apply 'bhi-' brand prefix naming pattern for in-image SBOM directories
- 5c2f96e feat(sbom): implement automated CycloneDX SBOM generation via Syft
- b4df49e feat(security): integrate build-time vulnerability scanning via Grype CLI wrapper
- 0cc072b feat(signature): implement doko sign command for OCI signing and Cosign SBOM attestations
- bcea327 feat(signature): implement doko verify and doko keygen subcommands
Bug Fixes
- da13a2e fix(cli): add help and default fallback logic to prevent gRPC EOF preface crashes on standalone execution
- 5b2ee8f fix(deps): update github.com/tonistiigi/fsutil digest to 519e39a
- 4358a07 fix(deps): update github.com/tonistiigi/fsutil digest to 519e39a
- 3a5083e fix(deps): update github.com/tonistiigi/fsutil digest to 83cac42
- 7065f21 fix(deps): update github.com/tonistiigi/fsutil digest to 83cac42
- 17574c1 fix(deps): update module github.com/glebarez/go-sqlite to v1.23.0
- 4a3769d fix(deps): update module github.com/glebarez/go-sqlite to v1.23.0
- 1816d03 fix(deps): update module github.com/open-policy-agent/opa to v1.19.1
- 4b223db fix(deps): update module github.com/open-policy-agent/opa to v1.19.1
- dd83a6b fix(nginx): recursively update permission folders and disable user directive in config for nonroot container compatibility
- c1aa507 fix(signature): map spdx layout suffix specifically to spdxjson for cosign parsing compatibility
- a7259c4 fix(signature): resolve golangci-lint violations and gofmt
- 394b251 fix(test): resolve errorlint, noctx, and unparam lint warnings in main_test
Documentation
- b52323d docs: refactor SECURITY.md to open-source standards
- 28d4391 docs: update contributing prerequisites for go 1.26 and release tools
Other Changes
- 546ccf3 cleanup: remove all scanner implementation files and config block fields
- 8e8ef5c perf(dockerfile): revert final base stage to scratch to minimize frontend image footprint
- a35839e refactor: centralize fetchCACert logic into a shared HTTP utility package
- 4b5e673 refactor: remove custom SBOM generation and prune syft dependencies
- e90069f refactor: remove in-image SBOM generation and legacy signature subcommands
- 4a4ffa8 refactor: remove sbom configuration block from nginx spec and go schema config
- a00b431 refactor: standardize native SBOMs and clean up legacy code
- 2e42f55 security: pin base container image by digest to resolve scorecard warning
- 5a56bfb security: pin development environment base image and gofumpt version
- d41a7c3 security: pin gofumpt version to resolve scorecard warning
- a98f534 test: add mock subprocess tests to verify CLI and signature package coverage
- cfc9b5b test: improve internal/builder package test coverage to 84.8%
- c36c02e test: resolve codecov missing coverage on cmd, builder, sbom, and signature packages