SOW v0.4.0

SOW 0.4.0 is an integrity and recovery release for Managed repositories. It makes the
deep checker's I/O contract explicit, prevents RPM trust from being assembled across
unrelated keys, adds an audited way to correct mutable publication-target settings, and
closes the remaining v0.3 migration and interrupted-publication gaps.

Plain repository behavior and the public pool/ + dists/ layout do not change.

Full release notes: English · 中文

⚠️ Upgrading from 0.3 requires an explicit migration

Stop all Workspace writers, back up the Workspace, install 0.4.0, then run
sow repo migrate REPOSITORY once for each Repository before any ordinary read or
write. The schema transition is explicit and one-way — do not reopen a migrated database
with SOW 0.3.

cp -a /srv/sow /srv/sow.backup-before-0.4.0
sow repo migrate pigsty -C /srv/sow
sow check -r pigsty -C /srv/sow

Schema v11 repairs the v0.3 Dist lifecycle case that could leave a Repository marked
clean while another Dist remained dirty; Repository status is now derived in the same
transaction that changes its Dists. A signing identity that v0.3 never recorded stays
explicitly unverified rather than being guessed, and can never become a retained trust
assertion. Schema v12 backfills an append-only publication-target binding ledger.

Highlights

One authenticity pass per physical payload. Every sow check performs exactly one
authoritative content hash per unique physical package payload, even when the cached
fingerprint still matches. Evidence binds device, inode, size, mtime, ctime, and the
descriptor actually read, and is reused across retained-Generation validation, final
manifest traversal, and sow changes. Retaining more Generations or adding more Dists no
longer multiplies payload hashing. A warm 64 MiB build performs no package-body read.

Independent RPM trust rings. Embedded signatures verify against each candidate trust
ring independently: every recognized packet must verify inside one ring, and at least one
verified path must authenticate the payload. Historical CentOS v3/v4 signatures and
deliberately dual-signed packages stay supported, while a retained single-key claim can no
longer be assembled from packet-by-key successes across different rings.

Safe publication-target rebind. sow publish TARGET --rebind is the explicit,
operator-confirmed path for correcting a target's mutable configuration while preserving
its storage identity and recovery state. Target name, public_endpoint, and
max_cache_ttl may change; Repository identity, provider, storage endpoint, region,
bucket, and prefix require a new target. An ordinary publish reports the mismatch and
points to --rebind — it never silently adopts new values.

Hardened public delivery verification. Filesystem and R2 HTTP(S) endpoints share one
verifier with independent response-header and body-idle deadlines, so a large body may
stream past two minutes as long as it keeps making progress. Canonical GETs remain
authoritative, stale content and 404s honor max_cache_ttl, 408/425/429/5xx get a short
bounded retry window, and oversized responses fail closed. R2 remote deletion remains
deliberately disabled and report-only.

Recovery and CLI. Incremental publication recovery accepts only the exact old
checkpoint or target Generation bytes at each pointer. Routine publication verifies the
exact changed object set instead of downloading the full public Generation. Every Managed
command now has a human-readable renderer, and --json keeps the stable sow.cli/v1
envelope including committed partial and diagnostic results on failure.

Toolchain

Building from source now requires Go 1.27.0 or newer (up from 1.26.5 in 0.3). The AWS
SDK, SQLite, compression, and cryptography dependencies were refreshed alongside it, and
the quality gates pin staticcheck v0.8.1, deadcode v0.49.0, and govulncheck v1.7.0.

Verification

Release gates cover the full Go test suite, vet, staticcheck, dead-code reachability,
vulnerability and RPM-fork provenance checks, race tests, clean source delivery, Linux
amd64/arm64 package builds, and the deterministic payload/facts I/O contracts above.

The release set contains four Linux/macOS archives, two RPMs, two DEBs, and SHA256SUMS.
Every archive contains sow, README.md, CHANGELOG.md, and LICENSE; native Linux
packages install the Apache-2.0 license with the binary. Verified digests and
platform-specific install commands are on the download page.

Changelog

• 19114a0 fix: harden managed repository recovery
• ae6471d fix(managed): harden mutation recovery and remove previews
• 89cf00e feat(publication): add safe target rebind and HTTP verification
• 30aa035 perf(managed): deduplicate payload audits and scope facts
• 4bdb869 build: raise the toolchain to Go 1.27.0
• 6f618be chore(release): prepare v0.4.0

Full Changelog: v0.3.0...v0.4.0