v0.5.0

Engine level 7: needs fleetlint 0.8.0 or newer (published artifacts as named instances, locate:; combine: and artifact_workflows() are gone).

Changed

• Published artifacts are instances with names. artifacts/image.yaml, helm-chart.yaml and oci-artifact.yaml say with instances: what tells one artifact of the kind from another (an image reference, a chart path, a registry reference), so two images in one repository are checked one by one and the report names the one that fails. The release implementations read the current artifact's workflows as artifact.workflows instead of artifact_workflows(kind).
• Rules whose finding is about one file say so with locate: (189 rules), a CEL string expression ('"README.md"', or computed from the task runner or the publishing workflow), so reports and SARIF point at the file.
• combine: is gone. changelog/generator-configured is one rule at the root with every generator as a satisfier (the per-stack implementations are aliases of it). release/reproducible-build is keyed by artifact: release-files (Go -trimpath with mod_timestamp, Cargo --locked with --remap-path-prefix, .NET ContinuousIntegrationBuild, or SOURCE_DATE_EPOCH), image (SOURCE_DATE_EPOCH or rewrite-timestamp=true), maven, nuget, pypi and gem; npm, crate and pub are source packages and do not apply, helm-chart, oci-artifact, android-app and apple-app are not checked. The stack-keyed ids are aliases of the capability.

Security

• The publish workflow passes the pushed digest to cosign through the environment instead of interpolating a step output into run:.

---

Engine level 7: needs fleetlint 0.8.0 or newer.

Pin this version in .fleetlint.yaml, by digest from the registry:

catalog: { oci: ghcr.io/fleetlint/catalog@sha256:8c5fd99c16db51642b31fce647772e945ef5947b260d3c10fe1820f6a4fe2a57 }

or by tag from git: catalog: { version: v0.5.0 }.

As a Go module: go get github.com/fleetlint/catalog@v0.5.0.

Verify the signature of the published artifact:

cosign verify ghcr.io/fleetlint/catalog@sha256:8c5fd99c16db51642b31fce647772e945ef5947b260d3c10fe1820f6a4fe2a57 \
  --certificate-identity-regexp '^https://github\.com/fleetlint/catalog/\.github/workflows/publish\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/fleetlint/catalog@sha256:8c5fd99c16db51642b31fce647772e945ef5947b260d3c10fe1820f6a4fe2a57 --repo fleetlint/catalog   # SLSA build provenance

The SPDX SBOM of the tree is attested to the same digest (cosign verify-attestation --type spdxjson).