v0.1.0
What's Changed
- Bump github.com/klauspost/compress from 1.18.7 to 1.19.1 in the go group by @dependabot[bot] in #1
- Cover security-critical paths; parameterize tar expansion limit for fast tests by @joshuadavidthomas in #2
- Enforce the host allowlist across asset-download redirects by @joshuadavidthomas in #3
- Stop the 60-second client timeout from aborting large asset downloads by @joshuadavidthomas in #4
- Bind attestation verification to the source repository via Fulcio extensions by @joshuadavidthomas in #6
- Make staged executables inert until complete and reclaim abandoned stages by @joshuadavidthomas in #7
- Declare the minimum Go language version instead of a patch pin by @joshuadavidthomas in #11
- Split Sigstore verification into an opt-in subpackage by @joshuadavidthomas in #12
- Report asset-download progress through an optional callback by @joshuadavidthomas in #14
- Stream asset downloads to disk and extract without buffering by @joshuadavidthomas in #15
- ci: add release workflow by @joshuadavidthomas in #16
New Contributors
- @dependabot[bot] made their first contribution in #1
- @joshuadavidthomas made their first contribution in #2
Full Changelog: https://github.com/joshuadavidthomas/go-selfupdate/commits/v0.1.0
Contributors
joshuadavidthomas and dependabot