v1.8.1

Highlights

Security: built with Go 1.27.3. The binaries and the container image are built with Go 1.27.3 instead of 1.27.1. Go 1.27.3 makes crypto/x509 reject certificate chains that contain the compromised eMudhra intermediate certificates (CVE-2026-111943, golang/go#82345). This covers the TLS connection to the LDAP server. v1.8.0 was built with Go 1.27.1 and accepts those chains. Update to this release.

Changes

• Go module dependencies are updated, among them gofiber/fiber/v3 3.6.1 (#708), go-ldap/ldap/v3 3.4.15 (#704), a-h/templ 0.3.1070 (#702), gofiber/storage/bbolt/v2 (#709) and valyala/fasthttp 1.76.0 (#713), by @CybotTM.
• The companion fixture server answers a malformed escape with 400 (#700), by @CybotTM.
• No configuration option, endpoint or behaviour changes.

Full changelog: v1.8.0...v1.8.1

Container image

ghcr.io/netresearch/ldap-manager:1.8.1
ghcr.io/netresearch/ldap-manager:1.8
ghcr.io/netresearch/ldap-manager:1

Verify your download

Per-asset signatures are bundled. Verify any single file:

cosign verify-blob \
  --bundle ldap-manager-linux-amd64.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ldap-manager-linux-amd64

Verify checksums against the signed manifest:

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
sha256sum -c checksums.txt --ignore-missing

Verify build provenance. Releases are built by a reusable
workflow, so the signing identity is that workflow rather than
this repository -- --signer-workflow is required and
verification fails without it:

gh attestation verify <artifact> \
  --repo netresearch/ldap-manager \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml

Verify container image:

cosign verify ghcr.io/netresearch/ldap-manager:1.8.1 \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
gh attestation verify oci://ghcr.io/netresearch/ldap-manager:1.8.1 \
  --repo netresearch/ldap-manager \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml