v0.2.0

Changelog

• d775c41 Merge pull request 'serve: keep setuid, setgid, and sticky bits on served files' (#13) from efs-mode-bits into main
• cdb8bc9 bootp: enable SO_BROADCAST on Windows
• cb5990e config: source/base/stand/sha256 layers and a credentials block
• 7b92398 efs: add read-only io/fs.FS view over an image
• 351a47f efs: carry the inode mode in the fs view's Stat
• a147ddb efs: report special-file types through the fs view
• 03503b9 efs: separate a missing entry from a read error, and sort dir entries
• 62fe0ae rcmd: match Winsock error codes on Windows
• 5b5a2e2 release: build macOS and Windows binaries
• 1cefb14 serve: hint at privilege when a bind is refused
• 9347504 serve: keep setuid, setgid, and sticky bits on served files
• eca0f7d serve: redact URL sources in logs and run.json
• ee62486 serve: resolve layer sources through a configured source resolver
• 5ca0f36 source: add fetch timeouts
• 768a2c9 source: bound the range reader's chunk cache
• 510497e source: check the cache file close before verifying
• 1fbbf97 source: chunk-caching byte-range reader with a consistency pin
• 2b18933 source: content-identity cache with atomic install
• bf14356 source: end-to-end test of a remote set served through Build
• f8b0e22 source: guard the range reader for concurrent reads
• 480cfba source: harden and test the tar extractor's symlink checks
• 741fc02 source: harden the credential redirect check and the fallback store
• c67f456 source: host-matched basic auth credentials from config
• a8d3e45 source: key the fetch cache on the full url
• 983196f source: prove ForceWhole takes the whole-file branch
• 72df917 source: reject a 200 to a ranged chunk GET instead of caching it
• 675fb64 source: remove dead ExpandEnv
• ac7951c source: replace buf-readerat with an owned concurrency-safe chunk cache
• 1619510 source: resolve a local or remote source to a read-only filesystem
• e9a27a8 source: rework fetch, extract and range reads onto libraries
• 82a2678 source: safe extractor for raw, gzip and tar archives
• 69b956b source: signal EOF only on a short range read
• 70d8f89 source: strip auth on cross-host redirect
• 322cf31 source: test the whole-file fetch fallback and cache reuse
• ea744af source: whole-file fetch with optional sha256 verification
• c665c16 vfs: assemble the tree through one io/fs.FS walker
• c5c31ae vfs: build install sets from a resolved source, with base and stand
• 798f7cc vfs: document the over-climbing-symlink divergence in resolveLink
• 2dc6b6c vfs: drop the dead source.closer field
• dacce88 vfs: fix ownerOf's comment on directory-layer permissions
• 6dfaa0b vfs: generalize Close's doc, fix a test that skipped its own check
• b646fd3 vfs: guard the directory-layer symlink origin invariant
• 0853a78 vfs: move the mkfifo test to a unix-tagged file
• bd32a9d vfs: open an image from any reader and add the resolver seam
• 1571f5d vfs: preserve setuid, setgid, and sticky bits on image files
• fc22ae5 vfs: verify a shared source against every layer's digest