v1.1.0

Changelog

New Features

• 3fc8728: feat(acceptance): add cosign verification acceptance tests (@trevor-vaughan)
• c3b8d6d: feat(output): centralize report filename construction (@trevor-vaughan)
• dae3b50: feat(policy): propagate MappingReferences from policy to EvaluationLog (@marcusburghardt)
• b98cf1d: feat(scan): support JSON as alternative EvaluationLog output format (@yvonnedevlinrh)
• 2dcdeb7: feat(verify): add trusted_root support for private Sigstore instances (@trevor-vaughan)
• ef89e7b: feat: add Homebrew formula and macOS binary releases (#742) (@sonupreetam)
• 75e2313: feat: add evidence source provenance (EvidenceMapping) support (@marcusburghardt)
• 6ec4df4: feat: add go-vendor-tools.toml with license overrides (@marcusburghardt)
• 7223f4d: feat: add multi-format-scan openspec change proposal (@marcusburghardt)
• 6a67911: feat: add openspec proposal for evidence source (EvidenceMapping) (@marcusburghardt)
• c3eb34f: feat: add provider-side MappingReferences to ScanResponse (@marcusburghardt)
• d247ee2: feat: modernize RPM spec for Fedora Go packaging guidelines (@marcusburghardt)
• ce44e2f: feat: propose provider-side MappingReferences in ScanResponse (@marcusburghardt)
• d538770: feat: support multiple --format values in complyctl scan (@marcusburghardt)
• a09e9d3: feat: update Packit config for go-vendor-tools integration (@marcusburghardt)

Bug Fixes

• f96d184: fix(devcontainer): use numeric UID in USER directive (DL3066) (@marcusburghardt)
• b5a3ff7: fix(doctor): discover RPM-installed providers in CheckProviders (@marcusburghardt)
• 5f01b62: fix(doctor): introduce variableValidation struct for buildVariableSummary (AP-001) (@marcusburghardt)
• 45bf100: fix(doctor): skip pinned resolution for unreachable registries (@marcusburghardt)
• b103bad: fix(proto): remove incorrect mutual exclusivity on coordinate/entry_id (@marcusburghardt)
• 7fc8c5b: fix(provider): allow overriding the system provider directory (@anyingiit)
• b94f76f: fix(scan): per-target mapping reference aggregation (@marcusburghardt)
• c094c5a: fix(scan): separate validation from format expansion and add defense-in-depth (@marcusburghardt)
• 036dfcc: fix: add GoDoc to ScanResult.MappingReferences and E2E assertion (@marcusburghardt)
• bf774c0: fix: align behavioral tests with current workspace layout and policy format (#850) (@marcusburghardt)
• 0e761b9: fix: do not create workspace directory as a side effect of logging (@marcusburghardt)
• 8a1e937: fix: exclude Passed controls from SARIF output (@rrafifnanda)
• 21563fb: fix: remove orphaned gaze agent and fix stale command references (@marcusburghardt)
• e6fc459: fix: removes illegal mitigations field (@hbraswelrh)
• 2448d99: fix: require an absolute COMPLYTIME_SYSTEM_PROVIDER_DIR (@anyingiit)
• 4473607: fix: update golang.org/x/crypto to v0.56.0 to resolve security vulnerabilities (@marcusburghardt)
• a14a8d8: fix: update golang.org/x/mod to v0.40.0 to resolve security vulnerabilities (@marcusburghardt)
• a08eb61: fix: update stale command references and remove website gate (@marcusburghardt)
• e5cc2b3: fix: use git describe for version tag detection in Makefile (@marcusburghardt)
• 6f78f4e: refactor(doctor): introduce RunOptions and extract CheckVariables helpers (@marcusburghardt)
• b8b7bee: refactor: deduplicate optional variable checks (@tomatotomata)

Dependency Updates

• 42dd448: chore(deps): Update go module directive to v1.26.7 (@complytime-renovate[bot])
• 5a172ab: chore(deps): Update go module directive to v1.26.8 (@complytime-renovate[bot])
• 251cfe1: chore(deps): bump github.com/complytime/complypack from 0.0.8 to 0.0.9 (#812) (@dependabot[bot])
• 8fdef9f: chore(deps): bump github.com/gemaraproj/go-gemara from 0.8.0 to 0.9.1 (#813) (@dependabot[bot])
• 7a4a79a: chore(deps): bump github.com/gemaraproj/go-gemara from 0.9.1 to 0.9.2 (@dependabot[bot])
• 5f8f7d7: chore(deps): bump github.com/gemaraproj/go-gemara from 0.9.2 to 0.10.0 (@dependabot[bot])
• 218fe1d: chore(deps): bump github.com/google/go-containerregistry (@dependabot[bot])
• 630b8e3: chore(deps): bump github.com/google/go-containerregistry (@dependabot[bot])
• 2e245e6: chore(deps): bump github.com/google/go-containerregistry (#810) (@dependabot[bot])
• 97c22e9: chore(deps): bump github.com/sigstore/protobuf-specs from 0.5.1 to 0.5.2 (@dependabot[bot])
• 39982c1: chore(deps): bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 (#811) (@dependabot[bot])
• d2b9223: chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 (@dependabot[bot])
• 89f10c8: chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 (@dependabot[bot])
• 83bbeb5: chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 (@dependabot[bot])
• ff9b700: chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 (@dependabot[bot])
• c55597c: chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 (@dependabot[bot])
• 8bd5e86: chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#817) (@dependabot[bot])

Infrastructure Updates

• b8e9a27: ci(deps): bump carabiner-dev/actions/install/ampel from 1.2.3 to 1.2.6 (@dependabot[bot])
• 9077921: ci(deps): bump carabiner-dev/actions/install/ampel from 1.2.6 to 1.2.9 (@dependabot[bot])
• 3883679: ci(deps): bump carabiner-dev/actions/install/ampel from 1.2.9 to 1.3.0 (@dependabot[bot])
• 7fee830: ci(deps): bump carabiner-dev/actions/install/snappy from 1.2.3 to 1.2.6 (@dependabot[bot])
• 434e772: ci(deps): bump carabiner-dev/actions/install/snappy from 1.2.6 to 1.2.9 (@dependabot[bot])
• 3b0d2e5: ci(deps): bump carabiner-dev/actions/install/snappy from 1.2.9 to 1.3.0 (@dependabot[bot])
• e54400f: ci(deps): bump complytime/org-infra/.github/workflows/reusable_ci.yml (#784) (@dependabot[bot])
• 8c3c302: ci(deps): bump complytime/org-infra/.github/workflows/reusable_ci.yml (#859) (@dependabot[bot])
• 28093e1: ci(deps): bump complytime/org-infra/.github/workflows/reusable_compliance.yml (#793) (@dependabot[bot])
• 0601220: ci(deps): bump complytime/org-infra/.github/workflows/reusable_compliance.yml (#866) (@dependabot[bot])
• dfb5d8a: ci(deps): bump complytime/org-infra/.github/workflows/reusable_crapload_analysis.yml (#792) (@dependabot[bot])
• 9ca92ca: ci(deps): bump complytime/org-infra/.github/workflows/reusable_crapload_analysis.yml (#860) (@dependabot[bot])
• e965bfc: ci(deps): bump complytime/org-infra/.github/workflows/reusable_dependabot_reviewer.yml (#783) (@dependabot[bot])
• b9df3f7: ci(deps): bump complytime/org-infra/.github/workflows/reusable_dependabot_reviewer.yml (#863) (@dependabot[bot])
• 820f617: ci(deps): bump complytime/org-infra/.github/workflows/reusable_deps_reviewer.yml (#790) (@dependabot[bot])
• ce23eb6: ci(deps): bump complytime/org-infra/.github/workflows/reusable_deps_reviewer.yml (#861) (@dependabot[bot])
• 8987170: ci(deps): bump complytime/org-infra/.github/workflows/reusable_release_goreleaser.yml (#858) (@dependabot[bot])
• 1bb9cd3: ci(deps): bump complytime/org-infra/.github/workflows/reusable_release_preflight.yml (#864) (@dependabot[bot])
• 9025a8d: ci(deps): bump complytime/org-infra/.github/workflows/reusable_scheduled.yml (#794) (@dependabot[bot])
• b92a780: ci(deps): bump complytime/org-infra/.github/workflows/reusable_scheduled.yml (#857) (@dependabot[bot])
• 5f86ba6: ci(deps): bump complytime/org-infra/.github/workflows/reusable_security.yml (#782) (@dependabot[bot])
• 0cec01c: ci(deps): bump complytime/org-infra/.github/workflows/reusable_security.yml (#870) (@dependabot[bot])
• 1283d22: ci(deps): bump complytime/org-infra/.github/workflows/reusable_sonarqube.yml (#785) (@dependabot[bot])
• d2a10d4: ci(deps): bump complytime/org-infra/.github/workflows/reusable_sonarqube.yml (#869) (@dependabot[bot])
• 77f99f0: ci(deps): bump complytime/org-infra/.github/workflows/reusable_vuln_scan.yml (#791) (@dependabot[bot])
• 42fe2f1: ci(deps): bump complytime/org-infra/.github/workflows/reusable_vuln_scan.yml (#865) (@dependabot[bot])
• 766e1c9: ci(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.7 (#818) (@dependabot[bot])
• fd76919: ci(deps): bump github/codeql-action/upload-sarif from 4.37.7 to 4.37.8 (@dependabot[bot])
• 8fcb5fc: ci(deps): bump github/codeql-action/upload-sarif from 4.37.8 to 4.37.9 (#835) (@dependabot[bot])
• d76eba6: ci(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 (@dependabot[bot])
• ded9ded: ci(deps): bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1 (@dependabot[bot])
• 90735e9: ci(deps): bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 (@dependabot[bot])

Other Work

• e5b4c86: Apply batched suggestions from code review (@marcusburghardt)
• 852a469: Documentation formatting updates (@sedonnel)
• e9f3e78: Fix linting error (@sedonnel)
• 40464ce: Small formatting and refactoring updates (@sedonnel)
• d004c00: chore: add Fedora 45 to Packit configuration (@marcusburghardt)
• c68235a: chore: archive 32 completed openspec changes (@marcusburghardt)
• d4f4d38: chore: archive 8 completed openspec changes (@marcusburghardt)
• 2aabe6b: chore: archive ampel-complypack-content openspec change (@marcusburghardt)
• 4107c7e: chore: complete and archive 2 more changes, update task status (@marcusburghardt)
• 815c220: chore: force-update uf scaffolded agents and packs (@marcusburghardt)
• 336f65f: chore: remove F43 Go version compatibility hack from spec (@marcusburghardt)
• 3461697: chore: restore CentOS Stream targets in Packit config (@marcusburghardt)
• 72e60de: chore: sync repository standards ()
• 3652b7c: chore: update uf scaffolded files to latest version (@marcusburghardt)
• cb07065: fix(devcontainer) Registry auto-start update after new bundle added (@sedonnel)
• 5ae41df: test(e2e): add repeated-flag coverage, SARIF exclusion, and env isolation (@marcusburghardt)