Releases · faustbrian/go-xsd

1.0.0 - 2026-08-25

Exclude intentional nested modules from root local-proxy archives so local,
bootstrap, CI, and public module checksums describe the same source
boundary.
Track the pinned documentation-tool lockfile so clean CI checkouts install
the exact validated cspell dependency.
Reconcile standalone dependency checksums against deterministic current
module archives so CI, local verification, and release consumers resolve
identical content.
Harden standalone documentation validation with deterministic spelling and
link checks, package-specific documentation gates, and repository-local
contributor guidance.

Publish the module from its standalone github.com/faustbrian/go-xsd identity while preserving its documented API and behavior.
Validate native and JAXP benchmark output with the standard shell toolchain
so clean Linux CI runners do not require an undeclared ripgrep installation.
Link conformance and migration guidance directly to the canonical
specification decision register.
Delegate local mutation checks to the canonical exact-100 repository runner
instead of a reduced package-local efficacy threshold.
Avoid retaining a pre-compilation complex-type lookup that must be refreshed
after recursive base compilation.
Execute API compatibility tooling against the isolated module graph so owned
dependency source changes cannot conflict with release checksums.
Require exact per-production-package coverage with the pinned XSTS corpus,
including serializer partial-write and reflection-budget failure paths.
Clarify simple-content base resolution and simplify equivalent serializer
initialization so strict static analysis remains clean.
Run Java interoperability, official XSTS conformance, and reference
benchmarks through the root gate using one digest-pinned, network-isolated
Eclipse Temurin container instead of relying on host Java.
Separate official XSTS conformance from JAXP differential interoperability
so both results remain attributable.
Use the repository-pinned current apidiff revision for the canonical API
compatibility gate.

Preserve root confinement for platform-native file URIs and accept resources
whose size exactly matches the configured byte limit.
Reject simple types without a restriction, list, or union during parsing
instead of returning a document that deterministic serialization rejects.
Propagate resolver file-close failures without discarding read failures and
verify differential-corpus manifest cleanup.
Bound Unicode range-table expansion before iteration so malformed or
corrupted tables fail closed instead of amplifying work.

Add a canonical, evidence-linked specification decision register covering
the supported feature line, source precedence, XSTS, secure XML handling,
namespace identity, regex, XPath, value spaces, serialization, and limits.
Add module-local MIT license metadata for clean consumer and supply-chain
tooling.
Establish the pinned XML Schema 1.0 specification and evidence matrix.
Add a pinned, fail-closed public API compatibility baseline for the complete
multi-package module.
Add secure parsing, bounded resolution and compilation, immutable schema
sets, instance validation, datatype support, deterministic serialization,
and checked builders.
Complete the XML Schema 1.0 requirement matrix with executable evidence.
Add correctness-gated JAXP reference benchmarks and a public wsdl
consumer contract.

Source commit: 8f93e6ebd80508deeb73de7fc91adeb24d2c4b8c
Exact-head CI: https://github.com/faustbrian/go-xsd/actions/runs/32907581733
Release dry-run: urn:sha256:529bde0cad8795b5fc25fca8ad2d731aa17a0ea65940fa2b6c709c2b214ff42b
Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS