Skip to content

v1.0.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Jul 17:34
· 57 commits to main since this release
v1.0.0
66c1517

v1.0.0 - First Stable Release

This is the first stable release of complyctl.
Since the v1.0.0-alpha.0 in March -- which introduced the core redesign from OSCAL to Gemara -- the project has gone through three pre-release milestones (alpha, beta, RC) with contributions from 11 people across 200+ commits. This release marks the point where the CLI surface, configuration format, provider gRPC API, and output formats are considered stable under semantic versioning.

Thank you to everyone who tested pre-release builds, reported issues, and contributed code during this maturity cycle.

What's New Since the Core Redesign

Sigstore signature verification -- complyctl get verifies OCI artifact signatures via sigstore-go before content reaches the local cache. Supports keyless verification (OIDC issuer + identity) and keyed verification (public key). Per-policy and per-complypack verification overrides in complytime.yaml. complyctl list shows verification status, and complyctl doctor includes verification diagnostics.

Complypack OCI pipeline -- complyctl get fetches complypack artifacts from OCI registries alongside policies. Cache versioning with configurable retention (COMPLYTIME_CACHE_VERSIONS). Digest-based freshness tracking prevents stale generation artifacts. complyctl doctor reports cache health, disk usage, and orphaned versions.

XDG Base Directory paths -- User-scoped paths now follow the XDG Base Directory Specification. Cache goes to ~/.cache/complytime/, data to ~/.local/share/complytime/. The workspace-local .complytime/ directory is unchanged. Legacy ~/.complytime/ triggers a deprecation warning with migration guidance. This aligns complyctl with Linux packaging standards.

Redesigned markdown report -- --format pretty produces a report with summary metadata, pass rate, grouped controls table with messages, findings grouped by result type with recommendations and collapsible evidence. Emoji status indicators make reports directly usable as GitHub Actions Step Summaries.

Bundle metadata visibility -- complyctl list displays EVALUATOR, CONTROLS, and DIGEST columns. complyctl get prints a post-sync summary showing policy title, evaluator, control count, and assessment count. Users can see what they have without running a scan.

Machine-readable doctor output -- complyctl doctor --format text|json for CI pipelines. Text format produces grep-stable [PASS]/[FAIL]/[WARN] labels. JSON format provides structured output with a blocking_failure field for programmatic gates. NO_COLOR auto-detection selects the text renderer automatically.

Workspace configuration -- --workspace flag and COMPLYTIME_WORKSPACE environment variable allow running commands from any directory. Configuration moved to .complytime/complytime.yaml with backward compatibility.

Scan improvements -- complyctl scan [target] positional argument for scoping to a single target. --show-passing flag to include passing controls in the terminal summary. Non-zero exit codes on operational errors. Evidence and Recommendation fields in the provider gRPC API.

Providers repository split -- Providers moved to the complytime-providers repository. complyctl is now the core CLI runtime, and providers are standalone binaries with independent release cycles. The repository currently includes the OpenSCAP, Ampel, and OPA providers.

Gemara bundle-format support -- The policy resolver handles both split-layer and bundle-format OCI artifacts, keeping complyctl forward-compatible with evolving Gemara packaging.

RPM packaging -- Updated spec for core-only complyctl after the provider split. Go 1.25, go-rpm-macros, Packit, and Testing Farm (TMT/FMF) support.

Testing infrastructure -- Container-based acceptance tests with a real zot OCI registry. Cross-repo integration tests validating the full complyctl + providers pipeline. EvaluationLog schema validation against Gemara CUE schemas. Devcontainer environment for interactive testing during PR reviews.

Debug visibility -- --debug now outputs to stderr in addition to the log file, with a hint showing the log file path.

Notes for Early Adopters

If you used a pre-release version, the following changes may require attention:

  • XDG paths: ~/.complytime/ is replaced by ~/.cache/complytime/ and ~/.local/share/complytime/. A deprecation warning with migration steps is printed automatically.
  • Collector export removed: The collector: config block, COMPLYTIME_EXPORT_ENABLED env var, and Export RPC were removed. These were speculative and will be redesigned when the backend shape is known.
  • Doctor output format: Default output now includes text labels alongside emoji. Use --format json for stable machine parsing.
  • Config location: complytime.yaml moved to .complytime/complytime.yaml. The legacy location still works but triggers a deprecation warning.

Changelog (since v1.0.0-rc.0)

New Features

Bug Fixes

Dependency Updates

  • bc1331e: chore(deps): Update go module directive to v1.26.5 (@complytime-renovate[bot])
  • 5d71496: chore(deps): bump complypack to v0.0.6 and update tests (@marcusburghardt)
  • f0b9314: chore(deps): bump github.com/complytime/complypack from 0.0.6 to 0.0.7 (@dependabot[bot])
  • 20f606d: chore(deps): bump github.com/complytime/complypack from 0.0.7 to 0.0.8 (@dependabot[bot])
  • 1d8484d: chore(deps): bump github.com/defenseunicorns/go-oscal (#754) (@dependabot[bot])
  • ca12b04: chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.22 (#689) (@dependabot[bot])
  • cb7dbfd: chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 (@dependabot[bot])
  • 552db67: chore(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (@dependabot[bot])
  • f416506: chore(deps): bump github.com/sigstore/sigstore-go from 1.2.1 to 1.2.2 (@dependabot[bot])
  • a6a3ab4: chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#688) (@dependabot[bot])
  • 85e98ae: chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 (@dependabot[bot])
  • 8d6aa3a: chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (@dependabot[bot])

Infrastructure Updates

Documentation Updates

Other Work

Contributors

marcusburghardt, trevor-vaughan, and 6 other contributors
Assets 10
Loading