release: v1.0.25 — dashboards judge from rules.json, Go 1.27.1, first SBOM
Version stamps moved to 1.0.25: VERSION, README release block and Docker
Hub example, Dockerfile usage comment, docs/openapi.yaml, the UI
cache-busters and mod-store/zfw.yaml.
Checksums in mod-store/zfw.yaml are taken from dist/*.sha256 of the build
that produces the published assets, not typed. That build ran with
SOURCE_DATE_EPOCH=1788616346, and this commit carries exactly that
committer date, so git checkout v1.0.25 && sh build.sh reproduces the
assets byte for byte without any override — reproducibility holds per
commit, and the tag points at this one. One more input: cyclonedx-gomod
stamps the main component with the version from the nearest git tag, so
the assets were built with the v1.0.25 tag already on this commit — the
tag is part of the reproducibility contract, not just a label.
Two more inputs surfaced when the CI build of the first tag was compared
with the local one — identical content, different checksums: file modes
followed the build host's umask (002 here, 022 on the runner), and the
SBOM records cyclonedx-gomod's own binary hash, which carried the install
host's paths. build.sh now sets umask 022 and normalises every packed
mode, and the tool is installed with -trimpath on both sides, so the CI
build of this tag carries the same checksums as the assets below.
amd64 5fd760a1d23e3b3c70a81680f98f2422ec4af6b807c26513ce22d6c00b358bc3
arm64 1039d46959566f8065ba9499eb2ff0e5a7ea9080e8a45b80b7107aa47e20c80c
Verified on the shipped payload rather than the build log: the daemon
unpacked out of dist/zfw-amd64.raw reports go1.27.1 and carries the
version string 1.0.25 (and no other 1.0.2x); the README inside the tarball
leads with the v1.0.25 release block; sbom.json is inside the tarball; the
bundled BUG-BOUNTY.md passes the private-data scan.
What ships (since v1.0.24): #23 Exposure/Audit judged from rules.json,
per-rule and IPv6 docker events visible; #24 Go 1.27.1 pinned via go.mod
and used by every CI job, ECDSA key parsing via ParseUncompressedPublicKey,
SBOM step repaired; #19–#22 LICENSE file, maintainer's host addresses and
username removed from docs, API examples and the shipped M8 finding.