v0.76.0

What's Changed

• copy: say what it is NOT, because v0.75.0 shipped it claiming to be the registry move by @tannevaled in #448
• sourcepin stops suggesting a sig field, and lint refuses one: the tool and the gate for the same defect by @tannevaled in #449
• sourcepin: accept the long key id GNU tar's maintainer publishes, and keep refusing a short one by @tannevaled in #450

Full Changelog: v0.75.0...v0.76.0

v0.75.0

What's Changed

• zbk copy: move published bottles between OCI namespaces, verified at the destination by @tannevaled in #447

Full Changelog: v0.74.0...v0.75.0

v0.74.0

What's Changed

• sourcepin: --fingerprint, because a keyring is a set and not a choice by @tannevaled in #445

Full Changelog: v0.73.0...v0.74.0

v0.73.0

What's Changed

• sourcepin: verify the upstream signature AT PIN TIME, and record where the key came from by @tannevaled in #444

Full Changelog: v0.72.0...v0.73.0

v0.72.0

What's Changed

• venvlaunch: the entry point becomes a Go binary, because a script has no $ORIGIN by @tannevaled in #440
• release: ship venvlaunch beside zbk, so a recipe can pin a stored asset by @tannevaled in #441
• git: stop tracking the 19 MB bk binary, and gate the next one by @tannevaled in #442
• bkpyvenv: seal installs the venvlaunch BINARY, and deletes three script launchers by @tannevaled in #443

Full Changelog: v0.71.0...v0.72.0

v0.71.0

What's Changed

• sourcepin: the author's digest comes from the builder's own fetcher by @tannevaled in #438

Full Changelog: v0.70.1...v0.71.0

v0.70.1

What's Changed

• launcher: the lock could not work on an NFS home, by construction by @tannevaled in #436
• launcher: the temporary file followed a symlink anyone could plant by @tannevaled in #437

Full Changelog: v0.70.0...v0.70.1

v0.70.0

What's Changed

• schema: ask which keys a pantry really uses, and enumerate the two the code honours by @tannevaled in #422
• schema: close the five containers that were measured, and prove they stay closed by @tannevaled in #423
• build: a source digest pinned in the recipe, keyed by version by @tannevaled in #424
• README: stop describing this in pkgx's terms by @tannevaled in #425
• overrides: whose fault a schema refusal is depends on when it happens by @tannevaled in #426
• schema: reopen it — closing it stopped us reading the toolchain by @tannevaled in #427
• provenance: a recipe says which of the project's own files its build came from by @tannevaled in #428
• provenance: consulted — writing the recipes does not mean not reading anyone by @tannevaled in #429
• lint: --require-standalone, because 197 of our 213 recipes are amendments by @tannevaled in #430
• lint: --max-fragments, a ratchet, so the check can be switched on unfinished by @tannevaled in #432
• bkpyvenv: the launcher we install names zpkgx, not upstream's pkgx by @tannevaled in #433
• bkpyvenv: a launcher of our own, with the lock and the idempotence check by @tannevaled in #434

Full Changelog: v0.69.0...v0.70.0

v0.69.0

What's Changed

• bottle v0.85.0: the rotated trust set by @tannevaled in #421

Full Changelog: v0.68.0...v0.69.0

v0.68.0

What's Changed

• say when the signing key is the public one by @tannevaled in #420

Full Changelog: v0.67.0...v0.68.0