v0.3.1

Added

• Artifact kind oci-artifact: a non-image artifact pushed to a registry with oras push, flux push artifact, cosign upload blob or regctl artifact put, in the workflow step or in a repository script the step runs. Implementations of the four release capabilities for it: signing by digest with cosign or Notation, an SBOM attached with cosign attest or oras attach, provenance with actions/attest-build-provenance, cosign attest or the SLSA generic generator; trusted publishing does not apply.
• The published catalog version carries an SPDX SBOM (cosign attest) and SLSA build provenance (actions/attest-build-provenance) on its digest, next to the signature.

Changed

• release/checksums does not ask a release that publishes an OCI artifact or a chart for a checksums file: the registry digest is the checksum.
• The catalog repository checks itself at tier 1.
• The image kind sees GoReleaser dockers_v2: and kos: next to dockers:; release/sbom/image accepts dockers_v2 with sbom: true and ko's SBOM, release/provenance/image accepts a dockers_v2 build (buildx attaches provenance unless provenance: false).

---

Engine level 5: needs fleetlint 0.6.0 or newer.

Pin this version in .fleetlint.yaml, by digest from the registry:

catalog: { oci: ghcr.io/fleetlint/catalog@sha256:bac517f63c92e26b9269ebc45a89fbd7ecf457598795efd61be94026c656e4f4 }

or by tag from git: catalog: { version: v0.3.1 }.

As a Go module: go get github.com/fleetlint/catalog@v0.3.1.

Verify the signature of the published artifact:

cosign verify ghcr.io/fleetlint/catalog@sha256:bac517f63c92e26b9269ebc45a89fbd7ecf457598795efd61be94026c656e4f4 \
  --certificate-identity-regexp '^https://github\.com/fleetlint/catalog/\.github/workflows/publish\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/fleetlint/catalog@sha256:bac517f63c92e26b9269ebc45a89fbd7ecf457598795efd61be94026c656e4f4 --repo fleetlint/catalog   # SLSA build provenance

The SPDX SBOM of the tree is attested to the same digest (cosign verify-attestation --type spdxjson).