v0.1.0

First release of release-ledger: EU Cyber Resilience Act evidence for every release, and a daily watch of the releases you still support.

• record (keelinfra/release-ledger): attaches an SBOM and cra-evidence.json (support period, hashes, attestation links) to the release, and signs build-provenance and SBOM attestations with GitHub's actions/attest.
• monitor (keelinfra/release-ledger/monitor): checks the SBOM of every release still in its support period against OSV, and opens an issue with the Article 14 checklist when CISA KEV or ENISA's EUVD lists a vulnerability as actively exploited.

Pin to this release's commit, not the tag:

- uses: keelinfra/release-ledger@931d70fd0c593209e8b524a26b23a106795ccc7e  # v0.1.0
- uses: keelinfra/release-ledger/monitor@931d70fd0c593209e8b524a26b23a106795ccc7e  # v0.1.0

This release is recorded by itself: cra-evidence.json, its SBOM and a source tarball are attached below. Check the tarball came unmodified from the release workflow:

gh attestation verify release-ledger-0.1.0.tar.gz --repo keelinfra/release-ledger

Supported until at least 31 December 2031 (SECURITY.md).