v0.3.6

v0.3.6: linux/arm64 CLI binary + multi-arch container image

- Publishes bpfcompat-linux-arm64 (checksummed, provenance-attested) alongside amd64.
- ghcr.io/kernel-guard/bpfcompat is now a multi-arch (amd64+arm64) manifest.
- install.sh installs the arm64 CLI; the static validator stays amd64-only (#103).

v0.3.5

v0.3.5: one-command installer + GHCR image + validator discovery

- scripts/install.sh: curl | sh installer (checksum + cosign verified) that
  installs the CLI and the guest validator to a discoverable location.
- internal/runner: discover the validator via $BPFCOMPAT_VALIDATOR_BIN and
  installed libexec paths, so a prebuilt/installed CLI runs the VM flow from any
  directory.
- ghcr.io/kernel-guard/bpfcompat container image, cosign-signed + SLSA
  provenance.

v0.3.4

v0.3.4: --disk-resize for in-guest build lanes

Adds a --disk-resize flag (and matching action input) that grows each guest
overlay before boot, so command-mode lanes that install a toolchain or build
eBPF inside near-full cloud images no longer fail with ENOSPC. Enables
build-on-target compatibility lanes (build the artifact against each kernel's
own BTF, then load it). See commit fff95a4.

v0.3.3

v0.3.3: action accepts remote OCI references for the artifact input

Fixes the composite action rejecting OCI artifact references (ghcr.io/...) as
missing local files, which blocked gadget-by-OCI-reference lanes (Inspektor
Gadget). Adds a regression guard. See CHANGELOG/commits cbbcf4f, a91b255.

v0.3.2

fix(release): pin cosign CLI to v2.6.3; prepare v0.3.2 (#85)

The v0.3.1 tag build failed at the signing step: cosign-installer
fetches latest cosign by default and cosign v3 ignores
--output-signature/--output-certificate in favor of the new bundle
format ('create bundle file: open : no such file or directory'). Pin
cosign-release v2.6.3 so the .sig/.crt assets documented in
docs/verifying-releases.md keep being produced; migrate to bundles
deliberately later.

v0.3.1 is already cached by the Go module proxy, so the tag must not
move — it stays a valid module version with no release binaries.
Prepare v0.3.2 instead (content-identical plus this pipeline fix):
changelog entry + bump usage examples to @v0.3.2.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

v0.3.0

v0.3.0: command/binary validation mode, kernel quirk library, Action …

v0.2.0

bpfcompat v0.2.0

The biggest release since the project went public: a new embeddable library API, a new OS family (OpenShift/CoreOS), and aarch64 VM support.

Highlights

• Embeddable library mode — pkg/bpfcompat. ValidateBeforeLoad does a real bpf() load against the node's own running kernel (no VM, no network) for a pre-load gate such as bpfman's; Validate exposes the full VM matrix engine. Host loading is gated behind the hostload build tag with an embedded static validator. See pkg/bpfcompat/README.md. (Pre-1.0 / experimental.)
• OpenShift / CoreOS support (Ignition boot). Fedora CoreOS is runnable out of the box (make vm-image-fcos); RHEL CoreOS is opt-in with an operator-supplied image (BPFCOMPAT_ENABLE_RHCOS=1). Backed by a real, recorded evidence matrix — 3 OpenShift releases × 6 artifacts on x86_64 plus a real aarch64 boot (docs/evidence-rhcos.md), including a BPF-LSM backport boundary (rejected on RHEL 9.2, loads+attaches on 9.4).
• aarch64 VM boot fixed. The executor now supplies aarch64 UEFI firmware (AAVMF pflash) and uses TCG when the guest arch differs from the host — so aarch64 cloud-image profiles actually boot.
• Zero-config gadget validation. --artifact accepts an OCI gadget reference; --quick needs no matrix file; runtime-sized maps are auto-sized; programs libbpf can't classify are auto-typed, with a manifest program-type override; generic inner-map (map-in-map) fixup.

Verify the release

cosign verify-blob \
  --certificate SHA256SUMS.crt --signature SHA256SUMS.sig \
  --certificate-identity-regexp 'github.com/Kernel-Guard/bpfcompat' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

Full changelog: CHANGELOG.md. SBOM attached (bpfcompat.sbom.cdx.json); build provenance + SBOM attestations via Sigstore.

v0.1.6

bpfcompat v0.1.6 — enterprise/backported-kernel coverage (14/14), SLS…

v0.1.5

v0.1.5: fix invalid action.yml YAML shipped in v0.1.4

v0.1.4

v0.1.4: manifest map fixups, collection-first workflow, prebuilt acti…