release: v1.0.25 — dashboards judge from rules.json, Go 1.27.1, first SBOM - #25
Merged
Conversation
… SBOM Version stamps moved to 1.0.25: VERSION, README release block and Docker Hub example, Dockerfile usage comment, docs/openapi.yaml, the UI cache-busters and mod-store/zfw.yaml. Checksums in mod-store/zfw.yaml are taken from dist/*.sha256 of the build that produces the published assets, not typed. That build ran with SOURCE_DATE_EPOCH=1788616346, and this commit carries exactly that committer date, so `git checkout v1.0.25 && sh build.sh` reproduces the assets byte for byte without any override — reproducibility holds per commit, and the tag points at this one. One more input: cyclonedx-gomod stamps the main component with the version from the nearest git tag, so the assets were built with the v1.0.25 tag already on this commit — the tag is part of the reproducibility contract, not just a label. Two more inputs surfaced when the CI build of the first tag was compared with the local one — identical content, different checksums: file modes followed the build host's umask (002 here, 022 on the runner), and the SBOM records cyclonedx-gomod's own binary hash, which carried the install host's paths. build.sh now sets umask 022 and normalises every packed mode, and the tool is installed with -trimpath on both sides, so the CI build of this tag carries the same checksums as the assets below. amd64 5fd760a1d23e3b3c70a81680f98f2422ec4af6b807c26513ce22d6c00b358bc3 arm64 1039d46959566f8065ba9499eb2ff0e5a7ea9080e8a45b80b7107aa47e20c80c Verified on the shipped payload rather than the build log: the daemon unpacked out of dist/zfw-amd64.raw reports go1.27.1 and carries the version string 1.0.25 (and no other 1.0.2x); the README inside the tarball leads with the v1.0.25 release block; sbom.json is inside the tarball; the bundled BUG-BOUNTY.md passes the private-data scan. What ships (since v1.0.24): #23 Exposure/Audit judged from rules.json, per-rule and IPv6 docker events visible; #24 Go 1.27.1 pinned via go.mod and used by every CI job, ECDSA key parsing via ParseUncompressedPublicKey, SBOM step repaired; #19–#22 LICENSE file, maintainer's host addresses and username removed from docs, API examples and the shipped M8 finding. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GRUX9ZKesnvfMooL7UFPtX
…uce the assets Two inputs beyond the source decide the release bytes: SOURCE_DATE_EPOCH (last commit's committer date) and the nearest git tag (cyclonedx-gomod stamps the SBOM with it, and sbom.json is inside the tarball). Measured while cutting v1.0.25: the same commit built once before and once after tagging produced different tarballs, identical .raw modules. The runbook now records the commit-tag-build-amend-retag-rebuild sequence that ends in a fixed point, plus the Docker Hub steps the checklist was missing. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GRUX9ZKesnvfMooL7UFPtX
chicohaager
force-pushed
the
release/v1.0.25
branch
from
September 5, 2026 14:03
12a2610 to
eb8af7a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release cut for v1.0.25. The tag
v1.0.25points at the release commit (not at the merge commit), and that commit is built so thatgit checkout v1.0.25 && sh build.shreproduces the published assets byte for byte — details in the commit message and the updatedMOD-STORE.mdrunbook.What ships since v1.0.24: #23 (Exposure/Audit judged from
rules.json, per-rule and IPv6 docker events), #24 (Go 1.27.1 pinned, ECDSA key parsing, SBOM step repaired), #19–#22 (LICENSE, private data removed from docs and the shipped M8 finding).🤖 Generated with Claude Code
https://claude.ai/code/session_01GRUX9ZKesnvfMooL7UFPtX