Cut v1.1.0 - #27
Merged
Merged
Conversation
Renames the [Unreleased] section to [1.1.0] - 2026-04-27 and adds a fresh [Unreleased] above it. Updates the compare-link footnotes so [Unreleased] now compares HEAD against v1.1.0 and the new [1.1.0] entry compares v1.0.2...v1.1.0. The v1.1.0 contents (already populated in [Unreleased] before this commit): - Added: cache_ttl config, sha256 release-asset publication + install.sh verification, shellcheck CI. - Changed: install.sh download path now uses curl -fLO + checksum verification. - Fixed: HTTP fetch errors no longer terminate the process. - Security: cache entries now expire so revoked keys actually stop authenticating. Per SemVer, this is a MINOR bump from 1.0.x: cache_ttl is a new backwards-compatible config field; the cache-expiry behavior change from "never expires" to "expires every 5m by default" is the *intent* of the security fix and is the right opt-out-not-opt-in default for an authentication-path tool. No public API removed; no breaking source-level change. Once this lands on main, push the v1.1.0 tag to trigger the release workflow (which will build the binary, generate ussher.sha256, and publish both as the v1.1.0 release assets with CHANGELOG.md as the release body).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the
[Unreleased]section inCHANGELOG.mdto[1.1.0] - 2026-04-27and adds a fresh empty[Unreleased]above it. Updates the compare-link footnotes so[Unreleased]now comparesHEADagainstv1.1.0and the new[1.1.0]entry comparesv1.0.2...v1.1.0.Why 1.1.0 (not 1.0.3 or 2.0.0)
Per SemVer, this is a MINOR bump from
1.0.x:cache_ttlconfig field — backwards-compatible (omitting it preserves the new default behavior).cache_ttl: 0(= retain old behavior) would have shipped the security bug forever. Operators who actively want the old behavior can setcache_ttlto something very large.A 1.0.3 PATCH bump would understate the new feature (
cache_ttl); a 2.0.0 MAJOR bump would overstate the disruption (no API was removed, just runtime behavior tightened in the security-correct direction).v1.1.0 contents
Already populated in
[Unreleased]before this PR — this commit just renames the heading and updates compare links.cache_ttlconfig field;sha256release-asset publication andinstall.shverification; shellcheck CI.install.shdownload path usescurl -fLO+ checksum verification.What happens after this merges
The release workflow (
.github/workflows/go.yml) triggers ontags: v*. Once this PR is onmain, push thev1.1.0tag — the workflow builds, generatesussher.sha256, and uploads both asv1.1.0release assets withCHANGELOG.mdas the release body. CLI for that step is in the chat reply that opened this PR.Test plan
git push origin v1.1.0runs the release workflow, which produces bothussherandussher.sha256on the v1.1.0 release page with the CHANGELOG as body.https://claude.ai/code/session_013HnepY8MhhxrJJjE5ysW47
Generated by Claude Code