v1.3.1

Highlights

Security: built with Go 1.27.3. The binaries and the container image are built with Go 1.27.3 instead of 1.27.1. Go 1.27.3 makes crypto/x509 reject certificate chains that contain the compromised eMudhra intermediate certificates (CVE-2026-111943, golang/go#82345). This covers raybeam's TLS connection to the LDAP server. v1.3.0 was built with Go 1.27.1 and accepts those chains. Update to this release.

Changes

• Go toolchain moves to go1.27.3 (#288, #292), by @CybotTM.
• Go module dependencies are updated, among them gofiber/fiber/v3 3.6.1 (#291), go-ldap/ldap/v3 3.4.15 (#289), netresearch/simple-ldap-go 1.18.1 (#286), valyala/fasthttp 1.76.0 and the OpenTelemetry modules 1.47.0 (#293), by @CybotTM.
• No configuration key, endpoint or behaviour changes.

Full changelog: v1.3.0...v1.3.1

Container image

ghcr.io/netresearch/raybeam:1.3.1
ghcr.io/netresearch/raybeam:1.3
ghcr.io/netresearch/raybeam:1

Verify your download

Per-asset signatures are bundled. Verify any single file:

cosign verify-blob \
  --bundle raybeam-linux-amd64.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  raybeam-linux-amd64

Verify checksums against the signed manifest:

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
sha256sum -c checksums.txt --ignore-missing

Verify build provenance. Releases are built by a reusable
workflow, so the signing identity is that workflow rather than
this repository -- --signer-workflow is required and
verification fails without it:

gh attestation verify <artifact> \
  --repo netresearch/raybeam \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml

Verify container image:

cosign verify ghcr.io/netresearch/raybeam:1.3.1 \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
gh attestation verify oci://ghcr.io/netresearch/raybeam:1.3.1 \
  --repo netresearch/raybeam \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml