Skip to content

v1.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jul 01:26
· 36 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.1.0
This tag was signed with the committer’s verified signature.
CybotTM Sebastian Mendel
SSH Key Fingerprint: NOxv8dcZlMFz3wrLdHILVNSnF6xskqAjN3bnn0i7K30
Verified
Learn about vigilant mode.
c78730a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The first release in ten months. Almost nothing changed in the application itself — all twelve HTTP routes, all eight CLI flags and every response structure are byte-identical to v1.0.8. What changed is everything around it: the build, the release pipeline, the test infrastructure and the dependencies.

⚠️ Two things can break you

GET /info reports the release tag, not a commit SHA. Until now there were no build-time ldflags, so version always carried the 40-character VCS revision. The release pipeline now injects -X main.version=<tag>, so this release answers {"version":"v1.1.0", ...}. The JSON keys and structure are unchanged — only the value format. If you parse that field as a commit SHA, it will fail. raybeam --version changes the same way and now prints <tag> (<sha7>).

Building from source works differently. The Dockerfile no longer compiles Go. Its builder stage is gone; a binary-selector stage expects pre-built binaries via COPY bin/raybeam-linux-* /tmp/, produced by the release pipeline. A plain docker build -t raybeam . in a fresh checkout no longer works. This affects people who build raybeam themselves, not people who run the published image.

Building from source also needs Go 1.26 now (go.mod: go 1.26, toolchain go1.26.5). That was driven by standard-library advisories, not by language features.

Added

raybeam --version and GET /info surface the commit SHA alongside the version.

Under the hood

The LDAP dependency moved from simple-ldap-go v1.3.0 all the way to v1.14.0 — ten minor releases covering the entire library's evolution over ten months. Everything compiles and tests green and no signature changed for raybeam's usage, but that is a wide surface: if you see LDAP behaviour differ from v1.0.8, this is the first place to look.

Test fixtures no longer reach into the LDAP library's unexported fields through reflect and unsafe. v1.14.0 added a constructor for exactly this, so unsafe is now absent from the repository entirely.

The release pipeline, container build and CI were rebuilt on the shared netresearch/.github workflows: signed and attested binaries, SBOMs per artifact, and a container image built once and reused rather than recompiled.

Not included

golang.org/x/crypto/openpgp is flagged as unmaintained (GO-2026-5932) with no fix available. Nothing in raybeam calls it.

Full changelog: v1.0.8...v1.1.0

Assets 37
Loading