v1.0.4

Install

npx zengate@1.0.4
# or
docker run -d --name zengate -p 127.0.0.1:8083:8083 -v zengate:/data developingchet/zengate:1.0.4

Image digest: sha256:ae88ed7bea294b49733a35d3a37c7e3689c0aba7619f825afbd634829e4340db

Verify the image signature

cosign verify developingchet/zengate:1.0.4 \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verify the release files

checksums.txt and the package tarball are signed with cosign (*.sigstore.json):

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt

The npm package carries provenance: npm audit signatures.

What's Changed

• ci: weekly security scans (Trivy image scan, OpenSSF Scorecard, weekly CI and Socket) by @developingchet in #9
• ci: sign release files and pin remaining build dependencies (Scorecard) by @developingchet in #10
• test: property-based tests (fast-check) and release v1.0.4 by @developingchet in #11

Full Changelog: v1.0.3...v1.0.4