v1.1.0

A small release: a fix for a malformed PNG picture, and release files you can verify. Nothing to change in a
deployment; the image and the chart upgrade in place from 1.0.0.

Features

• Every file attached to a GitHub release (the SBOMs, the chart's archive, the compose examples and the Helm
  repository's index.yaml) has a Sigstore bundle beside it, <file>.sigstore.json, and the release carries their
  SLSA build provenance, docx-to-pdf-<version>.intoto.jsonl: cosign verify-blob and gh attestation verify check
  them, as the installation guide's "Verifying a release" shows. (release, 91f640f)
• The chart is described for Artifact Hub: its category, links to the documentation, the benchmarks and the issues,
  and a changelog of each chart version written from the release's notes. (chart, 813e500)

Bug fixes

• A PNG picture too large to decode in memory whose palette is malformed (its length not a multiple of 3, or more
  entries than its bit depth can index) is refused before it is decoded and replaced by a placeholder, as any picture
  that cannot be scaled down safely is. The PDF is the same as before, when the PNG decoder panicked on it and the
  service caught the panic. (pictures, 0c34312)

Install

docker run --rm -p 8080:8080 quay.io/oxidestack/docx-to-pdf:1.1.0
helm install docx-to-pdf oci://quay.io/oxidestack/charts/docx-to-pdf --version 1.1.0

The image (sha256:c9310c7258f9f0a06787bc381c42a5dc78a4df8ac1fe89e8ccbbab4b4b875053) and the chart are published to quay.io and mirrored, with the same digests, signatures and attestations, to ghcr.io/oxidestack. The SBOMs (SPDX and CycloneDX, one per architecture), the chart and the compose examples are attached below.

Verify

cosign verify quay.io/oxidestack/docx-to-pdf:1.1.0 --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v1.1.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://quay.io/oxidestack/docx-to-pdf:1.1.0 --repo oxidestack/docx-to-pdf
cosign verify quay.io/oxidestack/charts/docx-to-pdf:1.1.0 --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v1.1.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each file below is signed the same way, its Sigstore bundle beside it (<file>.sigstore.json), and docx-to-pdf-1.1.0.intoto.jsonl is the build provenance of them all. The bundles are in Sigstore's current bundle format: cosign verify-blob needs cosign 3 or later (cosign 2 needs --new-bundle-format added, or it answers bundle does not contain cert for verification). For the chart's archive, as for any other:

cosign verify-blob docx-to-pdf-1.1.0.tgz --bundle docx-to-pdf-1.1.0.tgz.sigstore.json --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v1.1.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify docx-to-pdf-1.1.0.tgz --repo oxidestack/docx-to-pdf

v1.1.0-rc.1

A pre-release of 1.1.0, for testing: the changes since the last release are the commits after its tag. latest stays on the last release.

Install

docker run --rm -p 8080:8080 quay.io/oxidestack/docx-to-pdf:1.1.0-rc.1
helm install docx-to-pdf oci://quay.io/oxidestack/charts/docx-to-pdf --version 1.1.0-rc.1

The image (sha256:a9b743c08c86e42787075e5578e5c6e2a28b7b13310a58d2584214f5ffdbbce6) and the chart are published to quay.io and mirrored, with the same digests, signatures and attestations, to ghcr.io/oxidestack. The SBOMs (SPDX and CycloneDX, one per architecture), the chart and the compose examples are attached below.

Verify

cosign verify quay.io/oxidestack/docx-to-pdf:1.1.0-rc.1 --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v1.1.0-rc.1 --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://quay.io/oxidestack/docx-to-pdf:1.1.0-rc.1 --repo oxidestack/docx-to-pdf
cosign verify quay.io/oxidestack/charts/docx-to-pdf:1.1.0-rc.1 --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v1.1.0-rc.1 --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each file below is signed the same way, its Sigstore bundle beside it (<file>.sigstore.json), and docx-to-pdf-1.1.0-rc.1.intoto.jsonl is the build provenance of them all. For the chart's archive, as for any other:

cosign verify-blob docx-to-pdf-1.1.0-rc.1.tgz --bundle docx-to-pdf-1.1.0-rc.1.tgz.sigstore.json --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v1.1.0-rc.1 --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify docx-to-pdf-1.1.0-rc.1.tgz --repo oxidestack/docx-to-pdf

v1.0.0

The first release. docx-to-pdf is an HTTP service that turns office documents (DOCX, DOC, ODT and RTF) into PDF with
LibreOffice. A pool of LibreOffice instances, each in a process of its own, converts one document at a time. Every
conversion has a timeout and a memory limit, and a document that runs past either is stopped without touching the
other conversions. Documents are checked before LibreOffice sees them: a format outside the allowlist, a deflate or
picture bomb, or a document past the size limit is refused with an RFC 9457 problem answer, and no document can make
LibreOffice reach the network. Health checks, Prometheus metrics and OpenTelemetry traces and logs come built in.

It ships as a multi-architecture image (linux/amd64, linux/arm64) on quay.io/oxidestack/docx-to-pdf, mirrored to
ghcr.io/oxidestack/docx-to-pdf, and as a Helm chart on oci://quay.io/oxidestack/charts/docx-to-pdf. Both are
signed with cosign and carry SLSA provenance; the image carries an SPDX SBOM for each architecture.

Performance

• An instance returns the memory a conversion freed to the system before it answers, so a pod converting
  picture-heavy documents sits about 50 MiB lower between conversions. Peak memory and the sizing formula are
  unchanged. (instance, 04ebdc7)

Install

docker run --rm -p 8080:8080 quay.io/oxidestack/docx-to-pdf:1.0.0
helm install docx-to-pdf oci://quay.io/oxidestack/charts/docx-to-pdf --version 1.0.0

The image (sha256:a752ca8f27bf24fc704c1ab078afa22c3616d78cf8913e655939ae2a63d60609) and the chart are published to quay.io and mirrored, with the same digests, signatures and attestations, to ghcr.io/oxidestack. The SBOMs (SPDX and CycloneDX, one per architecture), the chart and the compose examples are attached below.

Verify

cosign verify quay.io/oxidestack/docx-to-pdf:1.0.0 --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v1.0.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://quay.io/oxidestack/docx-to-pdf:1.0.0 --repo oxidestack/docx-to-pdf
cosign verify quay.io/oxidestack/charts/docx-to-pdf:1.0.0 --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v1.0.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com

v0.1.0-rc.6

A pre-release of 0.1.0, for testing: the changes since the last release are the commits after its tag. latest stays on the last release.

Install

docker run --rm -p 8080:8080 quay.io/oxidestack/docx-to-pdf:0.1.0-rc.6
helm install docx-to-pdf oci://quay.io/oxidestack/charts/docx-to-pdf --version 0.1.0-rc.6

The image (sha256:bfb4d421516f74b27f9d33a7e1c7a014bdbc931021250426e8d14dd52f140b3f) and the chart are published to quay.io and mirrored, with the same digests, signatures and attestations, to ghcr.io/oxidestack. The SBOMs (SPDX and CycloneDX, one per architecture), the chart and the compose examples are attached below.

Verify

cosign verify quay.io/oxidestack/docx-to-pdf:0.1.0-rc.6 --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v0.1.0-rc.6 --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://quay.io/oxidestack/docx-to-pdf:0.1.0-rc.6 --repo oxidestack/docx-to-pdf
cosign verify quay.io/oxidestack/charts/docx-to-pdf:0.1.0-rc.6 --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v0.1.0-rc.6 --certificate-oidc-issuer https://token.actions.githubusercontent.com

v0.1.0-rc.5

A pre-release of 0.1.0, for testing: the changes since the last release are the commits after its tag. latest stays on the last release.

Install

docker run --rm -p 8080:8080 quay.io/oxidestack/docx-to-pdf:0.1.0-rc.5
helm install docx-to-pdf oci://quay.io/oxidestack/charts/docx-to-pdf --version 0.1.0-rc.5

The image (sha256:997b5d0f986cbeb69c3cafaf3d82fa38543017789acbf7206c82f44e6a7c6b26) and the chart are published to quay.io and mirrored, with the same digests, signatures and attestations, to ghcr.io/oxidestack. The SBOMs (SPDX and CycloneDX, one per architecture), the chart and the compose examples are attached below.

Verify

cosign verify quay.io/oxidestack/docx-to-pdf:0.1.0-rc.5 --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v0.1.0-rc.5 --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://quay.io/oxidestack/docx-to-pdf:0.1.0-rc.5 --repo oxidestack/docx-to-pdf
cosign verify quay.io/oxidestack/charts/docx-to-pdf:0.1.0-rc.5 --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v0.1.0-rc.5 --certificate-oidc-issuer https://token.actions.githubusercontent.com

v0.1.0-rc.4

A pre-release of 0.1.0, for testing: the changes since the last release are the commits after its tag. latest stays on the last release.

Install

docker run --rm -p 8080:8080 quay.io/oxidestack/docx-to-pdf:0.1.0-rc.4
helm install docx-to-pdf oci://quay.io/oxidestack/charts/docx-to-pdf --version 0.1.0-rc.4

The image (sha256:83b9b2ba123b2af1940e839c516fafc4af80cd823221601ea52f55f433a7464d) and the chart are published to quay.io and mirrored, with the same digests, signatures and attestations, to ghcr.io/oxidestack. The SBOMs (SPDX and CycloneDX, one per architecture), the chart and the compose examples are attached below.

Verify

cosign verify quay.io/oxidestack/docx-to-pdf:0.1.0-rc.4 --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v0.1.0-rc.4 --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://quay.io/oxidestack/docx-to-pdf:0.1.0-rc.4 --repo oxidestack/docx-to-pdf
cosign verify quay.io/oxidestack/charts/docx-to-pdf:0.1.0-rc.4 --certificate-identity https://github.com/oxidestack/docx-to-pdf/.github/workflows/release.yml@refs/tags/v0.1.0-rc.4 --certificate-oidc-issuer https://token.actions.githubusercontent.com