Skip to content

2026.7.19095256

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Jul 10:21
Immutable release. Only release title and notes can be modified.
2026.7.19095256
64542ff
This commit was signed with the committer’s verified signature.
sebhoss Sebastian Hoß
SSH Key Fingerprint: HYPNc428tkQaWk/2cqTJeiu6JQQGWlJ1J0/Eyvj6U3I
Verified
Learn about vigilant mode.

2026.7.19095256

Added

  • --image-verification-insecure-registry for HTTP registries
  • public-key cosign authorities
  • gate stages on image verification before apply
  • sigstore-go keyless image verifier
  • PinImages rewrites verified images to digests (TOCTOU)
  • ImageVerificationPolicy CRD + verification core (image-gate Phase 1a)

Changed

  • get cosign from the flake devShell, not cosign-installer
  • end-to-end image-verification kind scenario
  • exclude go.mod from the typos scan

Documentation

  • document the image-verification gate subsystem
  • image verification page

Fixed

  • correct cosign v3 signing in the image-verify scenario (#166)

Usage

Pull the container from ghcr.io/metio/stageset-controller:2026.7.19095256.
See Upgrading — https://stageset.projects.metio.wtf/reference/upgrading/ — for any required actions on your part.

Prebuilt binaries are attached below for both the controller
(stageset-controller_*) and the stagesetctl CLI (stagesetctl_*):

  • linux: amd64, arm (v7), arm64, ppc64le, riscv64, s390x
  • windows: amd64, arm64 (.zip)
  • darwin (macOS): amd64, arm64

The CLI doubles as a kubectl plugin: rename it to kubectl-stageset
on your PATH and run kubectl stageset ….

Verify

All release artifacts are signed with cosign keyless. See Verifying releases — https://stageset.projects.metio.wtf/reference/verifying-releases/ — for the verification commands.

Assets 25
Loading