v0.4.0

Engine level 6: needs fleetlint 0.7.0 or newer (typed refs).

Changed

• Every rule names its source with a typed ref. A refs: entry is a bare URL or {url, kind, section}; the kinds, strongest first, are spec (a language or format specification, or an official tool), guidance (official guidance such as Go Code Review Comments, PEP 8 or GitHub's own docs), style-guide (a public style guide), standard (a process or supply-chain standard: NIST SSDF, SLSA, OpenSSF Scorecard, Keep a Changelog, Conventional Commits, Semantic Versioning, EditorConfig, Reproducible Builds), check (a linter's check, section is its id) and convention (a convention of this catalog with no outside source, pointing at the fleetlint.org baseline page). Implementations carry the stack's own source (the tool's documentation), capabilities the general one; the fleetlint.org page links stay as untyped refs after the typed sources.

---

Engine level 6: needs fleetlint 0.7.0 or newer.

Pin this version in .fleetlint.yaml, by digest from the registry:

catalog: { oci: ghcr.io/fleetlint/catalog@sha256:f9236c508275124195020520071219d99491a6e2b224ff8457157c61810b3c93 }

or by tag from git: catalog: { version: v0.4.0 }.

As a Go module: go get github.com/fleetlint/catalog@v0.4.0.

Verify the signature of the published artifact:

cosign verify ghcr.io/fleetlint/catalog@sha256:f9236c508275124195020520071219d99491a6e2b224ff8457157c61810b3c93 \
  --certificate-identity-regexp '^https://github\.com/fleetlint/catalog/\.github/workflows/publish\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/fleetlint/catalog@sha256:f9236c508275124195020520071219d99491a6e2b224ff8457157c61810b3c93 --repo fleetlint/catalog   # SLSA build provenance

The SPDX SBOM of the tree is attested to the same digest (cosign verify-attestation --type spdxjson).