v1.0.0-rc5

Changelog

New Features

• d4a81b3: feat(cli): colorize --help section headers (@Nicolas-Peiffer)
• 827dd9e: feat(providers): enforce the KMS v2 annotation size budget (@Nicolas-Peiffer)

Bug Fixes

• 4cfe2e7: fix(providers): correct the KMS v2 ciphertext and plaintext bounds (@Nicolas-Peiffer)
• 91c4051: fix(providers): reject CKA_IDs too long to serve as a KMS v2 KeyId (@Nicolas-Peiffer)
• 5d625a6: fix(providers): validate CKA_LABEL on the key-rotation paths (@Nicolas-Peiffer)

Other

• 386c083: Update k8s-kms-plugin.drawio with eclipse (@Nicolas-Peiffer)
• 01be531: Update libs-imports-gose-crypto11-k8s-kms-plugin.svg eclipse migration (@Nicolas-Peiffer)
• 8ed08dc: doc: fix marmaid participant HSM name (@Nicolas-Peiffer)
• 8dcd3c9: doc: obsolete figures and diagrams are removed (@Nicolas-Peiffer)
• 7439429: doc: rm temp file (@Nicolas-Peiffer)
• ab447e6: docs(cli): document CKA_ID vs CKA_LABEL resolution, regenerate CLI reference (@Nicolas-Peiffer)
• 34aa5aa: docs(puml): refresh class diagrams for current P11/Provider shape, add ml-kem (@Nicolas-Peiffer)
• 2222ffb: refactor(providers): extract ML-KEM envelope format and parse helpers (@Nicolas-Peiffer)
• 6595fda: refactor(providers): name size limits by their unit and origin (@Nicolas-Peiffer)
• c9da0b4: refactor(providers): split p11.go into limits and ml-kem files (@Nicolas-Peiffer)
• 7c19927: style(test): clear golangci-lint findings in the fuzz and limits tests (@Nicolas-Peiffer)

Thanks to all contributors!

v1.0.0-rc4

Changelog

New Features

• 32c8296: feat(ml-kem)!: bind the KEM ciphertext into the envelope as AAD (@Nicolas-Peiffer)
• 4f1db3c: feat(scripts): add collect-jwe-samples.sh, fix shim-blind tool checks (@Nicolas-Peiffer)

Bug Fixes

• 66e5e1b: fix(scripts): report ml-kem alg and annotation sizes correctly (@Nicolas-Peiffer)

Other

• e565aa6: build(deps): upgrade gose to v1.0.0-rc2 (@Nicolas-Peiffer)
• 64c134f: build(deps): upgrade pkcs11-go, crypto11 and gose (@Nicolas-Peiffer)
• d2ca97d: build: annotate container images with the OCI description (@Nicolas-Peiffer)
• 5d1c4c3: build: make make notices non-destructive on failure (@Nicolas-Peiffer)
• adce7b0: docs(diagrams): cover ML-KEM in the KMS v2 sequence diagrams (@Nicolas-Peiffer)
• 8341ad9: docs(readme): document go install and its two limitations (@Nicolas-Peiffer)
• 4fac988: docs(schemes): measured sizes, the ML-KEM AAD, and encoding cost (@Nicolas-Peiffer)
• c6dba8b: gitignore .claude (@Nicolas-Peiffer)
• a18103d: refactor(mlkem)!: rename the kem-ct annotation to kem-ciphertext (@Nicolas-Peiffer)
• 4a4313e: test(e2e): fail fast with an install hint when grpcurl is missing (@Nicolas-Peiffer)

Thanks to all contributors!

v1.0.0-rc3

Changelog

Bug Fixes

• bae2a46: fix(ci): verify SLSA provenance against its actual subjects (@Nicolas-Peiffer)

Other

• 5779dcc: build: pretty-print the NOTICES.md table generated by make notices (@Nicolas-Peiffer)
• 7746d68: build: tell the user how to install every tool the Makefile invokes (@Nicolas-Peiffer)

Thanks to all contributors!

v1.0.0-rc2

Changelog

Bug Fixes

• e9347f5: fix(ci): sign blobs as Sigstore bundles and harden the release pipeline (@Nicolas-Peiffer)

Thanks to all contributors!

v0.8.0-test2-ga-aarch64-riscv64

Changelog

• 887bac7 fix ga shell

Thanks to all contributors!

v0.8.0-test-ci1

Changelog

• 89690d4 remove testing go version

Thanks to all contributors!

v0.7.0-test-ci3

Changelog

• 5b47759 update go in GA

Thanks to all contributors!

What's Changed

• Improve cobra cli and logrus logs by @Nicolas-Peiffer in #51
• Update to kms api v2 with key rotation & update go1.24.5 by @Nicolas-Peiffer in #71

Full Changelog: v0.6.1-alpha...v0.7.0-test-ci3

v0.6.1-alpha

What's Changed

• Adding CI/CD security features and version CLI command by @louison77 in #39
• [github action goreleaser] update docker-login github action to v3 by @Nicolas-Peiffer in #59
• [github action goreleaser] fix goreleaser v2.7.0 archives.format deprecation by @Nicolas-Peiffer in #60
• [github action goreleaser] remove sbom field from ko-build by @Nicolas-Peiffer in #62
• [github action goreleaser] use a repository list for ko-build by @Nicolas-Peiffer in #63
• [github action goreleaser] update goreleaser-action to v6 as per documentation by @Nicolas-Peiffer in #64
• github action not on PR by @Nicolas-Peiffer in #65
• update to go 1.23.6 by @Nicolas-Peiffer in #54
• update gose and crypto11 with latest go 1.23.6 versions by @Nicolas-Peiffer in #66
• Bump golang.org/x/net from 0.35.0 to 0.38.0 by @dependabot[bot] in #69
• update from go1.23.6 to go1.23.9 by @Nicolas-Peiffer in #70

New Contributors

• @louison77 made their first contribution in #39
• @Nicolas-Peiffer made their first contribution in #59
• @dependabot[bot] made their first contribution in #69

Full Changelog: v0.6.0-alpha...v0.6.1-alpha

v0.6.0-alpha

What's Changed

• README.md: Fix typo. by @justinpettit in #1
• test: Fix build issues. by @justinpettit in #5
• serve:go: Set socket file permissions to 0775. by @justinpettit in #6
• test: Remove last SEK references. by @justinpettit in #7
• p11: Use PEM type "RSA PRIVATE KEY" for PKCS #1 encoding. by @justinpettit in #9
• Remove last references to SEK. by @justinpettit in #10
• AuthenticatedEncrypt and AuthenticatedDecrypt support by @solcates in #8
• Make FIPS compliant and lint fix. by @myidpt in #11
• Simplifying AuthenticatedEncryptResponse and AuthenticatedEncryptRequ… by @ProsaicSatsuma in #12
• Istio: Use []byte instead of string for KEK ID in Auth Encrypt/Decrypt. by @justinpettit in #14
• Moving to use wrapped DEK in authenticatedcrypt instead of KEK directly by @ProsaicSatsuma in #15
• Add prod Dockerfile and enable loading PIN from file. by @myidpt in #16
• Import Root CA Cert file via import-cert by @solcates in #17
• Import cert mods by @ProsaicSatsuma in #18
• Version response by @ProsaicSatsuma in #20
• New commands and cleanups for "cmd". by @justinpettit in #19
• revved to gose 0.8.2 by @solcates in #22
• Additional behavior for verifying cert chains - now handles the cases… by @ProsaicSatsuma in #24
• resolving test certificate expiry errors and re-formatting by @ProsaicSatsuma in #25
• Fix k8s kms registration by @ProsaicSatsuma in #29
• remove whitespace from P11_PIN_FILE by @hoskeri in #28
• Updating modules and adding Luna compatibility (entails setting GCMIV… by @ProsaicSatsuma in #33
• No pkcs11 panic by @hoskeri in #34
• Thales Plugin Injector by @hoskeri in #35
• Make Istio client compatible with grpc 1.42+ by @howardjohn in #36
• feature : aes-cbc then hmac for tpm2 by @IceManGreen in #37
• Support RSA OAEP encryption by @IceManGreen in #50

New Contributors

• @solcates made their first contribution in #8
• @myidpt made their first contribution in #11
• @ProsaicSatsuma made their first contribution in #12
• @hoskeri made their first contribution in #28
• @howardjohn made their first contribution in #36
• @IceManGreen made their first contribution in #37

Full Changelog: v0.5.0...v0.6.0-alpha