Skip to content

v0.2.1

Choose a tag to compare

View all tags
@johnnycube johnnycube released this 21 Oct 20:12
· 77 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.2.1
This tag was signed with the committer’s verified signature.
johnnycube Johnny
SSH Key Fingerprint: rMuyBddrbsXVu5UjsBnN1Q2MzdF61mDaC+QMiAYkzMc
Verified
Learn about vigilant mode.
7b6841d
This commit was signed with the committer’s verified signature.
johnnycube Johnny
SSH Key Fingerprint: rMuyBddrbsXVu5UjsBnN1Q2MzdF61mDaC+QMiAYkzMc
Verified
Learn about vigilant mode.

The rules are those of 0.2.0.

Fixed

  • The publish workflow installs the fleetlint that reads engine level 4, so the published artifact is loaded the way a repository pins it before the run passes; 0.2.0 was pushed and signed, but that last check ran the old fleetlint.

Engine level 4: needs fleetlint 0.5.0 or newer.

Pin this version in .fleetlint.yaml, by digest from the registry:

catalog: { oci: ghcr.io/fleetlint/catalog@sha256:d246c2ed1a0cf6082cdbfe6f37bb6e53607afddb8a0b7392dbb4fd1ad046cd20 }

or by tag from git: catalog: { version: v0.2.1 }.

As a Go module: go get github.com/fleetlint/catalog@v0.2.1.

Verify the signature of the published artifact:

cosign verify ghcr.io/fleetlint/catalog@sha256:d246c2ed1a0cf6082cdbfe6f37bb6e53607afddb8a0b7392dbb4fd1ad046cd20 \
  --certificate-identity-regexp '^https://github\.com/fleetlint/catalog/\.github/workflows/publish\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
Assets 3
Loading