Skip to content

v0.19.6

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jul 21:11
v0.19.6
137d13d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Docker images

Pull the matching ghcr.io tag:

docker pull ghcr.io/cloudfieldcz/shieldoo-gate:0.19.6
docker pull ghcr.io/cloudfieldcz/scanner-bridge:0.19.6

Image pages:

shdg CLI

Push-from-CI client. Pre-built for Linux, macOS, and Windows:

OS Arch Archive
Linux x86_64 shdg-0.19.6-linux-amd64.tar.gz
Linux aarch64 shdg-0.19.6-linux-arm64.tar.gz
macOS Intel shdg-0.19.6-darwin-amd64.tar.gz
macOS Apple Silicon shdg-0.19.6-darwin-arm64.tar.gz
Windows x86_64 shdg-0.19.6-windows-amd64.zip

shdg version reports 0.19.6 to match the Docker tag.
Verify archive integrity with SHA256SUMS (also attached).

Supply-chain security

All artifacts are signed and carry SLSA build provenance (keyless, via GitHub OIDC + Sigstore).

  • Images — cosign signature + SLSA provenance + CycloneDX SBOM attached as OCI referrers: 
    cosign verify ghcr.io/cloudfieldcz/shieldoo-gate:0.19.6 \
  --certificate-identity-regexp 'https://github.com/cloudfieldcz/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/cloudfieldcz/shieldoo-gate:0.19.6 --repo cloudfieldcz/shieldoo-gate
  • shdg binaries — SLSA provenance: gh attestation verify shdg-0.19.6-linux-amd64.tar.gz --repo cloudfieldcz/shieldoo-gate
  • Detached signatures — each archive and SHA256SUMS also ships a keyless *.sig + *.pem cert (recognised by OpenSSF Scorecard): 
    cosign verify-blob \
  --signature shdg-0.19.6-linux-amd64.tar.gz.sig \
  --certificate shdg-0.19.6-linux-amd64.tar.gz.pem \
  --certificate-identity-regexp 'https://github.com/cloudfieldcz/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com shdg-0.19.6-linux-amd64.tar.gz
    The same provenance is also attached as shdg-0.19.6.intoto.jsonl.
  • SBOMs — the CycloneDX SBOMs dogfooded through the gate are attached (*.cdx.json) with a detached cosign bundle (*.cdx.json.cosign.bundle): 
    cosign verify-blob --bundle sbom-gate.cdx.json.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/cloudfieldcz/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com sbom-gate.cdx.json

Changes (v0.19.5…v0.19.6)

  • fix(policy): terminal scanner errors block instead of returning 503 (#148) (137d13d)
  • chore(deps): bump scanner-bridge openai 2.48.0 -> 2.50.0 (#157) (ae06715)
  • chore(deps): bump the npm-minor-patch group in /ui with 2 updates (#153) (50e6f8b)
  • chore(deps): bump the gomod-minor-patch group with 6 updates (#156) (bb18979)
  • build(ci): bump docker/login-action from 4.5.1 to 4.6.0 (#154) (53c769d)
  • chore(deps): bump scanner-bridge grpcio 1.83.0, openai 2.48.0, setuptools 83.0.0 (#151) (c015018)
  • chore(deps): bump npm minor/patch group + brace-expansion, lockstep playwright image (#150) (517836c)
  • build(ci): hold typescript at 6.x until typescript-eslint supports TS 7 (#152) (10e5bbf)
  • build(ci): bump github/codeql-action to v4.37.3 (init/autobuild/analyze/upload-sarif) (#149) (d4f7e4a)
  • build(ci): bump actions/setup-go from 6.5.0 to 7.0.0 (#130) (c1da80f)
  • build(ci): bump actions/setup-node from 6.4.0 to 7.0.0 (#132) (cb1963e)
  • chore(deps): bump the gomod-minor-patch group across 1 directory with 8 updates (#147) (87e2fb2)
  • build(ci): bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#126) (37a8287)
  • build(ci): bump docker/login-action from 4.4.0 to 4.5.1 (#139) (ddc55c8)
  • build(ci): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#138) (899a70a)
  • build(ci): bump actions/checkout from 7.0.0 to 7.0.1 (#137) (a250ae3)
Assets 31
Loading