Skip to content

v0.36.0

Choose a tag to compare

View all tags
@colonel-byte-release-please colonel-byte-release-please released this 27 Oct 15:17
v0.36.0
216627c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.36.0 (2026-10-27)

⚠ BREAKING CHANGES

  • drop mdbook golang docs (#914)

Features

  • api: read a chart manifest wrapper carrying enabled, images, and values (#944) (ad0f036)
  • examples: declare each chart's images under the chart that needs them (#946) (2cd97f8)
  • phase: keep a disabled chart's images out of the upload (#945) (9960e00)

Bug Fixes

  • phase: promote the staged engine binary in the phase that stages it (#935) (e38835c)

Refactoring

  • coci: import zarf's src/pkg/oci instead of defenseunicorns/pkg/oci (#897) (cb6e117)
  • microvm: export the fleet harness as test/microvm (#920) (742dd77)
  • provider: export the two symbols the OpenTofu provider needs across a module boundary (#913) (d72b98e)

Documentation

Miscellaneous

  • examples: refresh generated examples (#915) (37d1634)

CI/CD

  • image: drop registry1 and pin the base image straight from cgr.dev (#933) (0ab83a4)

Build

  • deps: bump github.com/andybalholm/brotli from 1.2.6 to 1.2.7 (#936) (c09e093)
  • deps: bump github.com/docker/cli from 29.9.1+incompatible to 29.9.2+incompatible in the docker group (#903) (f4fe458)
  • deps: bump github.com/docker/docker-credential-helpers from 0.9.10 to 0.9.12 in the docker group (#926) (fb49ebc)
  • deps: bump github.com/go-openapi/strfmt from 0.27.3 to 0.27.4 in the openapi group (#898) (6cf315a)
  • deps: bump github.com/go-openapi/validate from 1.0.0 to 1.0.1 in the openapi group (#928) (31240db)
  • deps: bump github.com/google/certificate-transparency-go from 1.3.3 to 1.4.0 (#905) (669ef4c)
  • deps: bump github.com/huandu/xstrings from 1.6.2 to 1.6.3 (#906) (fedcf2b)
  • deps: bump github.com/klauspost/pgzip from 1.2.7 to 1.3.0 (#894) (1f3f7e3)
  • deps: bump github.com/minio/minlz from 1.2.2 to 1.2.3 (#900) (89738f9)
  • deps: bump github.com/shopspring/decimal from 1.5.0 to 1.6.0 (#895) (99e974b)
  • deps: bump github.com/sigstore/timestamp-authority/v2 from 2.1.4 to 2.1.5 in the sigstore group (#902) (888b887)
  • deps: bump google.golang.org/api from 0.304.0 to 0.305.0 (#899) (e448fb5)
  • deps: bump google.golang.org/api from 0.305.0 to 0.308.0 (#929) (c216bd3)
  • deps: bump https://github.com/astral-sh/ruff-pre-commit from v0.17.1 to 0.17.2 (#924) (c021ebb)
  • deps: bump j178/prek-action from 3.0.1 to 3.0.2 in the core group (#901) (970de60)
  • deps: bump j178/prek-action from 3.0.2 to 3.1.0 in the core group (#907) (0a2dbf3)
  • deps: bump library/alpine from 294b683 to be26560 in /containers/base (#921) (f44d214)
  • deps: bump library/debian from a29215f to 62bd423 in /containers/deb (#923) (5c6ce07)
  • deps: bump oras.land/oras-go/v2 from 2.6.4 to 2.7.0 (#930) (7c8d680)
  • deps: bump the cloud-kms group across 1 directory with 2 updates (#932) (e12c6bc)
  • deps: bump the core group with 4 updates (#931) (2185d3a)
  • deps: bump the sigstore group with 3 updates (#925) (46f5926)

Changelog

  • c09e093 build(deps): bump github.com/andybalholm/brotli from 1.2.6 to 1.2.7 (#936)
  • f4fe458 build(deps): bump github.com/docker/cli from 29.9.1+incompatible to 29.9.2+incompatible in the docker group (#903)
  • fb49ebc build(deps): bump github.com/docker/docker-credential-helpers from 0.9.10 to 0.9.12 in the docker group (#926)
  • 6cf315a build(deps): bump github.com/go-openapi/strfmt from 0.27.3 to 0.27.4 in the openapi group (#898)
  • 31240db build(deps): bump github.com/go-openapi/validate from 1.0.0 to 1.0.1 in the openapi group (#928)
  • 669ef4c build(deps): bump github.com/google/certificate-transparency-go from 1.3.3 to 1.4.0 (#905)
  • fedcf2b build(deps): bump github.com/huandu/xstrings from 1.6.2 to 1.6.3 (#906)
  • 1f3f7e3 build(deps): bump github.com/klauspost/pgzip from 1.2.7 to 1.3.0 (#894)
  • 89738f9 build(deps): bump github.com/minio/minlz from 1.2.2 to 1.2.3 (#900)
  • 99e974b build(deps): bump github.com/shopspring/decimal from 1.5.0 to 1.6.0 (#895)
  • 888b887 build(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.1.4 to 2.1.5 in the sigstore group (#902)
  • e448fb5 build(deps): bump google.golang.org/api from 0.304.0 to 0.305.0 (#899)
  • c216bd3 build(deps): bump google.golang.org/api from 0.305.0 to 0.308.0 (#929)
  • c021ebb build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.17.1 to 0.17.2 (#924)
  • 970de60 build(deps): bump j178/prek-action from 3.0.1 to 3.0.2 in the core group (#901)
  • 0a2dbf3 build(deps): bump j178/prek-action from 3.0.2 to 3.1.0 in the core group (#907)
  • f44d214 build(deps): bump library/alpine from 294b683 to be26560 in /containers/base (#921)
  • 5c6ce07 build(deps): bump library/debian from a29215f to 62bd423 in /containers/deb (#923)
  • 7c8d680 build(deps): bump oras.land/oras-go/v2 from 2.6.4 to 2.7.0 (#930)
  • e12c6bc build(deps): bump the cloud-kms group across 1 directory with 2 updates (#932)
  • 2185d3a build(deps): bump the core group with 4 updates (#931)
  • 46f5926 build(deps): bump the sigstore group with 3 updates (#925)
  • 37d1634 chore(examples): refresh generated examples (#915)
  • 216627c chore(main): release 0.36.0 (#896)
  • 0ab83a4 ci(image): drop registry1 and pin the base image straight from cgr.dev (#933)
  • b525b38 docs!: drop mdbook golang docs (#914)
  • eecb084 docs: remove hooks comment (#911)
  • ad0f036 feat(api): read a chart manifest wrapper carrying enabled, images, and values (#944)
  • 2cd97f8 feat(examples): declare each chart's images under the chart that needs them (#946)
  • 9960e00 feat(phase): keep a disabled chart's images out of the upload (#945)
  • e38835c fix(phase): promote the staged engine binary in the phase that stages it (#935)
  • cb6e117 refactor(coci): import zarf's src/pkg/oci instead of defenseunicorns/pkg/oci (#897)
  • 742dd77 refactor(microvm): export the fleet harness as test/microvm (#920)
  • d72b98e refactor(provider): export the two symbols the OpenTofu provider needs across a module boundary (#913)
  • 24daaa1 test(e2e): let a suite outside this module name the example root (#941)

Verify release artifacts with Cosign

Release archives and container images are signed with Cosign.

Find the public key at cosign.pub

Verify a binary archive:

cosign verify-blob --key cosign.pub --bundle cargoship_Linux_x86_64.tar.gz.sigstore.json cargoship_Linux_x86_64.tar.gz

Verify a image tag:

cosign verify --key cosign.pub ghcr.io/colonel-byte/cargoship:v0.36.0
Assets 40
Loading