Releases · cloudcwfranck/acc

Release list

v0.3.2 — Remote Attestation Support Latest

Latest

cloudcwfranck released this 27 Dec 17:12

v0.3.2

3d9b79f

Release 0.3.2

See CHANGELOG.md for details.

Installation

Download the appropriate binary for your platform and verify the checksum:

Linux (AMD64):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.3.2/acc_0.3.2_linux_amd64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.3.2/checksums.txt"
sha256sum -c checksums.txt --ignore-missing
tar -xzf acc_0.3.2_linux_amd64.tar.gz
sudo mv acc-linux-amd64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

macOS (Apple Silicon):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.3.2/acc_0.3.2_darwin_arm64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.3.2/checksums.txt"
shasum -a 256 -c checksums.txt --ignore-missing
tar -xzf acc_0.3.2_darwin_arm64.tar.gz
sudo mv acc-darwin-arm64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

See README.md for complete installation instructions.

Assets 8

v0.3.1 — Trust Enforcement for Run and Push

cloudcwfranck released this 23 Dec 18:42

v0.3.1

333a546

Release 0.3.1

See CHANGELOG.md for details.

Installation

Download the appropriate binary for your platform and verify the checksum:

Linux (AMD64):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.3.1/acc_0.3.1_linux_amd64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.3.1/checksums.txt"
sha256sum -c checksums.txt --ignore-missing
tar -xzf acc_0.3.1_linux_amd64.tar.gz
sudo mv acc-linux-amd64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

macOS (Apple Silicon):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.3.1/acc_0.3.1_darwin_arm64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.3.1/checksums.txt"
shasum -a 256 -c checksums.txt --ignore-missing
tar -xzf acc_0.3.1_darwin_arm64.tar.gz
sudo mv acc-darwin-arm64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

See README.md for complete installation instructions.

Assets 8

v0.3.0 - Attestation Verification

cloudcwfranck released this 22 Dec 23:00

v0.3.0

d1ab9c0

Release 0.3.0

See CHANGELOG.md for details.

Installation

Download the appropriate binary for your platform and verify the checksum:

Linux (AMD64):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.3.0/acc_0.3.0_linux_amd64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.3.0/checksums.txt"
sha256sum -c checksums.txt --ignore-missing
tar -xzf acc_0.3.0_linux_amd64.tar.gz
sudo mv acc-linux-amd64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

macOS (Apple Silicon):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.3.0/acc_0.3.0_darwin_arm64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.3.0/checksums.txt"
shasum -a 256 -c checksums.txt --ignore-missing
tar -xzf acc_0.3.0_darwin_arm64.tar.gz
sudo mv acc-darwin-arm64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

See README.md for complete installation instructions.

Assets 8

v0.2.7 — Trust & Attestation Hardening

cloudcwfranck released this 22 Dec 18:47

v0.2.7

5bb2880

Release 0.2.7

See CHANGELOG.md for details.

Installation

Download the appropriate binary for your platform and verify the checksum:

Linux (AMD64):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.7/acc_0.2.7_linux_amd64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.7/checksums.txt"
sha256sum -c checksums.txt --ignore-missing
tar -xzf acc_0.2.7_linux_amd64.tar.gz
sudo mv acc-linux-amd64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

macOS (Apple Silicon):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.7/acc_0.2.7_darwin_arm64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.7/checksums.txt"
shasum -a 256 -c checksums.txt --ignore-missing
tar -xzf acc_0.2.7_darwin_arm64.tar.gz
sudo mv acc-darwin-arm64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

See README.md for complete installation instructions.

Assets 8

v0.2.6 - Website Release

cloudcwfranck released this 21 Dec 03:59

v0.2.6

70713a8

Added - Website & Documentation

Official Website Launch (Vercel + GitHub Releases Backend)

Summary: Launched official acc website with auto-updating release information, deployed on Vercel with GitHub Releases as the backend.

What's New:

✅ Official website - Next.js 14 website deployed on Vercel at site/
✅ Auto-updating releases - ISR (Incremental Static Regeneration) + deploy hooks for real-time updates
✅ GitHub Releases backend - No separate server, uses GitHub API as data source
✅ Download page - Platform detection, checksums, grouped downloads by OS/arch
✅ Documentation pages - Quick start guide, how-to documentation
✅ Release history - Recent releases with changelogs
✅ Security headers - CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
✅ Deploy automation - GitHub Actions workflow triggers Vercel deployment on release

Website Architecture:

Frontend: Next.js 14 (App Router, TypeScript, React Server Components)
Backend: GitHub Releases API + repository content (unauthenticated)
Hosting: Vercel
Auto-updates: ISR with 5-minute revalidation + deploy hooks on release publish
Pages: Homepage, Download, Docs, Releases
Security: Strict CSP, security headers, no inline scripts, HTTPS-only

Auto-Update Mechanism:

ISR (Incremental Static Regeneration):
- Release data fetched from GitHub API with revalidate: 300 (5 minutes)
- Vercel automatically regenerates pages when data changes
- Fallback if deploy hook not configured
Deploy Hook on Release:
- GitHub Actions workflow .github/workflows/site-deploy.yml runs on release publish
- Triggers Vercel deployment via webhook
- Site rebuilds immediately with new release

Files Added:

site/package.json - Next.js dependencies and scripts
site/tsconfig.json - TypeScript configuration
site/next.config.js - Security headers and build configuration
site/lib/github.ts - GitHub API helpers with ISR
site/app/layout.tsx - Root layout with metadata
site/app/page.tsx - Homepage (hero, features, how it works)
site/app/download/page.tsx - Download page with platform detection
site/app/docs/page.tsx - Quick start documentation
site/app/releases/page.tsx - Release history listing
site/components/Navigation.tsx - Sticky header navigation
site/components/Footer.tsx - Footer with links
site/components/*.module.css - Component-scoped styles
site/app/globals.css - Global styles with dark/light mode
site/public/demo/ - Demo asset placeholder
.github/workflows/site-deploy.yml - Vercel deploy hook trigger
site/README.md - Website setup and deployment documentation
docs/website.md - Website architecture documentation

Release Focus:

v0.2.6 is a website and documentation release that:

✅ Launches official acc website on Vercel
✅ Provides auto-updating download and release pages
✅ Documents website architecture and deployment process
✅ Demonstrates production-grade Next.js + Vercel deployment

No Product Changes: This release contains NO changes to acc product behavior, CLI semantics, JSON schemas, or exit codes. All changes are website infrastructure and documentation.

No Test Changes: This release contains NO changes to test scripts or CI workflows for the CLI tool. All test infrastructure remains unchanged from v0.2.5.

Installation

Download the appropriate binary for your platform and verify the checksum:

Linux (AMD64):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.6/acc_0.2.6_linux_amd64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.6/checksums.txt"
sha256sum -c checksums.txt --ignore-missing
tar -xzf acc_0.2.6_linux_amd64.tar.gz
sudo mv acc-linux-amd64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

macOS (Apple Silicon):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.6/acc_0.2.6_darwin_arm64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.6/checksums.txt"
shasum -a 256 -c checksums.txt --ignore-missing
tar -xzf acc_0.2.6_darwin_arm64.tar.gz
sudo mv acc-darwin-arm64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

See README.md for complete installation instructions.

Assets 8

v0.2.5 - Documentation Accuracy & Post-Release Verification

cloudcwfranck released this 21 Dec 03:30

v0.2.5

bb1d0d4

Fixed - Documentation Accuracy

Post-Release Verification & Documentation Refresh

Summary: Corrected stale documentation references and verified all test tiers pass reliably after v0.2.3/v0.2.4 regression fixes.

What Changed:

Updated CONTRIBUTING.md to remove outdated "known regressions" warnings
Removed stale references to Tier 1 test failures (regressions fixed in v0.2.3)
Clarified that all test tiers (0, 1, Go unit tests) now pass reliably
Updated pre-push checklist to reflect current expected behavior

Documentation Corrections:

CONTRIBUTING.md line 124: Removed "Tier 1 tests currently FAIL" warning (outdated)
CONTRIBUTING.md line 189: Removed "Expected to FAIL" comment (outdated)
CONTRIBUTING.md line 198: Updated to state "MUST all pass" instead of "currently FAILS"

Verification Performed:

✅ All Go unit tests pass
✅ Tier 0 (CLI Help Matrix) passes
✅ Tier 1 (E2E Smoke Tests) passes (verified in CI)
✅ Documentation now matches implementation reality

Files Changed:

CONTRIBUTING.md - Removed stale regression warnings, updated test expectations

Release Focus:

v0.2.5 is a post-release documentation accuracy release that:

✅ Confirms all regressions from v0.2.2 are fixed
✅ Updates contributor documentation to match reality
✅ Verifies test infrastructure stability
✅ Ensures clear guidance for new contributors

No Product Changes: This release contains NO changes to acc product behavior, CLI semantics, JSON schemas, or exit codes. All changes are documentation accuracy improvements.

No Test Changes: This release contains NO changes to test scripts or CI workflows. All test infrastructure remains unchanged from v0.2.4.

Installation

Download the appropriate binary for your platform and verify the checksum:

Linux (AMD64):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.5/acc_0.2.5_linux_amd64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.5/checksums.txt"
sha256sum -c checksums.txt --ignore-missing
tar -xzf acc_0.2.5_linux_amd64.tar.gz
sudo mv acc-linux-amd64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

macOS (Apple Silicon):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.5/acc_0.2.5_darwin_arm64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.5/checksums.txt"
shasum -a 256 -c checksums.txt --ignore-missing
tar -xzf acc_0.2.5_darwin_arm64.tar.gz
sudo mv acc-darwin-arm64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

See README.md for complete installation instructions.

Assets 8

v0.2.4 — Quality, Verification & CI Hardening

cloudcwfranck released this 20 Dec 22:51

v0.2.4

308b99c

Fixed - Test Infrastructure & Documentation Quality

Test Script Quality - ShellCheck Compliance

Summary: Fixed all ShellCheck INFO warnings (SC2086, SC2317) in test scripts without changing acc behavior or test assertions.

What Changed:

Test scripts now use array-based command invocation to prevent word-splitting issues
Helper functions use set +e / set -e pattern for safe exit code capture
All variable references properly quoted in command substitutions
Zero ShellCheck warnings while maintaining identical test behavior

Files Changed:

scripts/cli_help_matrix.sh - Array-based command execution for test_help_command() and test_not_implemented()
scripts/e2e_smoke.sh - Safe exit code capture in assert_success() and assert_failure()
scripts/registry_integration.sh - Quoted variable references
docs/testing-contract.md - Documented script implementation patterns and ShellCheck compliance

Technical Details:

SC2086 Fix (Word Splitting):

# Before:
output=$($ACC_BIN $cmd_args 2>&1)

# After:
cmd=( "$ACC_BIN" )
cmd+=( $cmd_args )  # Intentional word splitting with disable comment
output=$("${cmd[@]}" 2>&1)

SC2317 Fix (Unreachable Code):

# Before (shellcheck thinks exit_code=$? is unreachable):
output=$("$@" 2>&1)
exit_code=$?

# After (explicit set +e):
set +e
output=$("$@" 2>&1)
exit_code=$?
set -e

Documentation Updates:

Added "Test Script Implementation Patterns" section to testing-contract.md
Documented why || true pattern was replaced with set +e / set -e
Clarified that config and login commands are help-only stubs
Removed "Known Regressions" section (regressions fixed in v0.2.3)

Impact:

Improved script maintainability and portability
Better adherence to bash best practices
No behavior changes to acc product or CI gates
Zero impact on existing workflows

Testing: All scripts pass bash -n validation, Tier 0 tests GREEN

Documentation Updates

Summary: Updated README and documentation to reflect v0.2.4 release with accurate version references and CI testing information.

What Changed:

Updated all version references in README.md from v0.1.0 to v0.2.4
Added comprehensive "CI Test Tiers" section to README Development guide
Documented how to run Tier 0, Tier 1, and Tier 2 tests locally
Added reference to testing-contract.md for behavioral guarantees

Files Changed:

README.md - Version references updated, CI test tier documentation added
docs/testing-contract.md - Already updated with script implementation patterns

Release Focus:

v0.2.4 is a quality and verification release that demonstrates:

✅ All Tier 0 and Tier 1 CI tests pass reliably
✅ Zero ShellCheck warnings in test scripts
✅ Documentation matches implementation reality
✅ Enterprise-grade CI infrastructure with strict release gates
✅ Clear testing contract with exit code guarantees

No Product Changes: This release contains NO changes to acc product behavior, CLI semantics, JSON schemas, or exit codes. All changes are test infrastructure, documentation, and quality improvements.

Installation

Download the appropriate binary for your platform and verify the checksum:

Linux (AMD64):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.4/acc_0.2.4_linux_amd64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.4/checksums.txt"
sha256sum -c checksums.txt --ignore-missing
tar -xzf acc_0.2.4_linux_amd64.tar.gz
sudo mv acc-linux-amd64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

macOS (Apple Silicon):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.4/acc_0.2.4_darwin_arm64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.4/checksums.txt"
shasum -a 256 -c checksums.txt --ignore-missing
tar -xzf acc_0.2.4_darwin_arm64.tar.gz
sudo mv acc-darwin-arm64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

See README.md for complete installation instructions.

Assets 8

v0.2.3 — acc build CLI Regressions

cloudcwfranck released this 20 Dec 17:29

v0.2.3

54c6d50

Fixed - acc build CLI Regressions

This release fixes critical bugs in acc build that broke backward compatibility and SBOM generation guarantees.

Critical Fixes:

Positional argument handling - acc build now accepts image reference as positional argument
- Bug: acc build demo-app:ok silently ignored positional argument, exited 0 without SBOM
- Root Cause: CLI command didn't parse args, only accepted --tag flag
- Fix: Accept both acc build demo-app:ok (positional) and acc build --tag demo-app:ok (flag)
- Impact: Restores v0.1.x backward compatibility for automation scripts
- Code: cmd/acc/main.go:114-163 - NewBuildCmd with args support
SBOM generation guarantee - Build now verifies SBOM file exists or fails explicitly
- Bug: acc build could exit successfully without creating SBOM file
- Root Cause: No verification that SBOM file actually existed after syft command
- Fix: Added explicit file existence check after generateSBOM
- Impact: Build ALWAYS produces SBOM or fails with clear error
- Code: internal/build/build.go:81-84 - SBOM file verification
Help text and examples - Added usage examples to acc build --help
- Bug: Help text lacked examples, unclear that --tag was accepted
- Fix: Added examples showing both positional and flag usage
- Impact: Users can discover correct syntax via --help
- Code: cmd/acc/main.go:121-126 - Example usage in help

Positional Argument Behavior:

# All these work now:
acc build demo-app:ok              # positional argument
acc build --tag demo-app:ok        # flag syntax
acc build -t demo-app:ok          # short flag

# If both provided, --tag takes precedence with warning
acc build demo-app:ok --tag other:latest  # Uses other:latest

SBOM Guarantee:

If acc build exits 0, SBOM MUST exist in .acc/sbom/
If SBOM can't be generated (syft missing, syft fails), build exits non-zero
Build logs show explicit "Generating SBOM..." and success/failure

Regression Tests Added:

TestDetectBuildTool - Verifies build tool detection with clear errors
TestBuild_SBOMVerification - Verifies SBOM exists after successful build
TestGenerateSBOM_Contract - Verifies generateSBOM creates file or errors
TestSBOMPath_Consistency - Verifies SBOM path is predictable

Files Changed:

cmd/acc/main.go - Accept positional args, add examples to help
internal/build/build.go - Add SBOM file verification, improve logging
internal/build/build_test.go - New file with 4 regression tests

Breaking Changes: None - changes restore v0.1.x compatibility

Installation

Download the appropriate binary for your platform and verify the checksum:

Linux (AMD64):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.3/acc_0.2.3_linux_amd64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.3/checksums.txt"
sha256sum -c checksums.txt --ignore-missing
tar -xzf acc_0.2.3_linux_amd64.tar.gz
sudo mv acc-linux-amd64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

macOS (Apple Silicon):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.3/acc_0.2.3_darwin_arm64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.3/checksums.txt"
shasum -a 256 -c checksums.txt --ignore-missing
tar -xzf acc_0.2.3_darwin_arm64.tar.gz
sudo mv acc-darwin-arm64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

See README.md for complete installation instructions.

Assets 8

v0.2.2 — Fix acc SBOM workflow and decision consistency (no policy changes)

cloudcwfranck released this 20 Dec 16:52

v0.2.2

ee4a613

Fixed - Final Gate Consistency & SBOM Workflow

This release implements a single authoritative final gate for verify decision consistency.

Critical Fixes:

Final gate consistency - Implemented single authoritative decision gate
- Bug: status:"fail" could occur while PolicyResult.allow:true due to early status assignments
- Root Cause: Multiple places set status = "fail", but final gate only set "fail" if still not failed
- Fix: Single authoritative finalAllow variable that ALWAYS determines final status, overriding all earlier assignments
- Impact: Guarantees status and exit code derive from PolicyResult.Allow (the final decision after profile filtering)
- Code: internal/verify/verify.go:255-286 - Authoritative final gate
SBOM workflow guidance - Improved error messages and documentation
- Bug: SBOM-required error lacked actionable workflow guidance
- Fix: Error message now includes step-by-step workflow:
  - Option 1: docker build → syft → acc verify
  - Option 2: acc build (automatic SBOM generation)
- Impact: Users know exactly how to generate SBOMs
- Code: internal/verify/verify.go:75-97 - Enhanced error message
README SBOM Workflows section - Comprehensive workflow documentation
- Added: Dedicated "SBOM Workflows" section with 3 workflows:
  - Workflow 1: acc build (recommended, automatic)
  - Workflow 2: docker build + manual SBOM generation
  - Workflow 3: CI/CD integration example
- Added: SBOM troubleshooting guide
- Impact: Clear documentation for all use cases

Regression Tests Added:

TestVerify_FinalGateConsistency - Verifies status MUST match allow field
TestVerify_SBOMMissingErrorMessage - Verifies error includes workflow guidance

Design Principle:

// Single authoritative final gate (v0.2.2)
var finalAllow bool
if result.PolicyResult != nil {
    finalAllow = result.PolicyResult.Allow
} else {
    finalAllow = false
}

// Status ALWAYS derives from final gate
if finalAllow {
    result.Status = "pass"
} else {
    result.Status = "fail"
}

Files Changed:

internal/verify/verify.go - Single authoritative final gate, improved SBOM error
internal/verify/verify_test.go - Added regression tests, added strings import
README.md - Added comprehensive SBOM Workflows section

Breaking Changes: None - all changes maintain backward compatibility

Installation

Download the appropriate binary for your platform and verify the checksum:

Linux (AMD64):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.2/acc_0.2.2_linux_amd64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.2/checksums.txt"
sha256sum -c checksums.txt --ignore-missing
tar -xzf acc_0.2.2_linux_amd64.tar.gz
sudo mv acc-linux-amd64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

macOS (Apple Silicon):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.2/acc_0.2.2_darwin_arm64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.2/checksums.txt"
shasum -a 256 -c checksums.txt --ignore-missing
tar -xzf acc_0.2.2_darwin_arm64.tar.gz
sudo mv acc-darwin-arm64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

See README.md for complete installation instructions.

Assets 8

v0.2.1 — Regression Fixes for Policy Profiles & Trust Status

cloudcwfranck released this 20 Dec 16:23

v0.2.1

2e22a78

Fixed - v0.2.0 Regression Bugs

This release fixes 5 critical bugs found in v0.2.0 testing.

verify status inconsistency - Fixed verify returning status:"fail" when allow:true and no violations
- Bug: verify checked violation count instead of PolicyResult.Allow field after profile filtering
- Fix: Use PolicyResult.Allow as source of truth for status determination
- Impact: Profiles now correctly set status to "pass" when all violations are filtered
sbomPresent false after build - Fixed SBOM detection after acc build
- Bug: checkSBOMExists() required exact filename match, failed on name/format mismatches
- Fix: Added fallback to detect ANY .json file in .acc/sbom/ directory
- Impact: More robust SBOM detection across different configurations
Profile loading broken - Fixed profile name resolution and error messages
- Bug: .acc/profiles/ directory not created by acc init, unclear error messages
- Fix: acc init now creates .acc/profiles/, improved error messages with remediation
- Impact: Better user experience when loading profiles by name
trust status image leakage - Fixed digest resolution to prevent state leakage across images
- Bug: resolveImageDigest() was simplistic, couldn't query container runtimes
- Fix: Properly query Docker/Podman/nerdctl for image digest
- Impact: acc trust status now shows correct per-image state, not global state
trust status exit codes wrong - Fixed exit codes when no state found
- Bug: Returned exit 1 (error) instead of exit 2 (no state) when verification state missing
- Fix: Return StatusResult with status:"unknown" and exit code 2
- Impact: Correct exit code behavior: 0=pass, 1=fail, 2=no state

Regression Tests Added:

TestVerify_StatusFromAllow - Verifies status derives from allow field
TestCheckSBOMExists_Fallback - Verifies SBOM fallback detection

Files Changed:

internal/verify/verify.go - Fixed status logic, improved SBOM detection
internal/profile/profile.go - Improved error messages
internal/config/init.go - Create .acc/profiles/ directory
internal/trust/status.go - Fixed digest resolution and exit codes
internal/verify/verify_test.go - Added regression tests

Installation

Download the appropriate binary for your platform and verify the checksum:

Linux (AMD64):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.1/acc_0.2.1_linux_amd64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.1/checksums.txt"
sha256sum -c checksums.txt --ignore-missing
tar -xzf acc_0.2.1_linux_amd64.tar.gz
sudo mv acc-linux-amd64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

macOS (Apple Silicon):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.1/acc_0.2.1_darwin_arm64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.1/checksums.txt"
shasum -a 256 -c checksums.txt --ignore-missing
tar -xzf acc_0.2.1_darwin_arm64.tar.gz
sudo mv acc-darwin-arm64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

See README.md for complete installation instructions.

Assets 8

Releases: cloudcwfranck/acc

Release list

v0.3.2 — Remote Attestation Support

Installation

Uh oh!

v0.3.1 — Trust Enforcement for Run and Push

Installation

Uh oh!

v0.3.0 - Attestation Verification

Installation

Uh oh!

v0.2.7 — Trust & Attestation Hardening

Installation

Uh oh!

v0.2.6 - Website Release

Added - Website & Documentation

Official Website Launch (Vercel + GitHub Releases Backend)

Installation

Uh oh!

v0.2.5 - Documentation Accuracy & Post-Release Verification

Fixed - Documentation Accuracy

Post-Release Verification & Documentation Refresh

Installation

Uh oh!

v0.2.4 — Quality, Verification & CI Hardening

Fixed - Test Infrastructure & Documentation Quality

Test Script Quality - ShellCheck Compliance

Documentation Updates

Installation

Uh oh!

v0.2.3 — acc build CLI Regressions

Fixed - acc build CLI Regressions

Installation

Uh oh!

v0.2.2 — Fix acc SBOM workflow and decision consistency (no policy changes)

Fixed - Final Gate Consistency & SBOM Workflow

Installation

Uh oh!

v0.2.1 — Regression Fixes for Policy Profiles & Trust Status

Fixed - v0.2.0 Regression Bugs

Installation

Uh oh!