Skip to content

SOW v0.6.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 12:29
v0.6.1
8d80434

SOW v0.6.1

Changes since v0.6.0 · Changelog

English

SOW 0.6.1 refreshes the build toolchain and dependencies and includes two small maintenance fixes.

  • Require and build with Go 1.27.3.
  • Update dependencies to their latest stable releases, including ProtonMail go-crypto 1.5.2, AWS SDK 1.47.3 / S3 1.114.4, klauspost/compress 1.20.3, modernc SQLite 1.61.0 / libc 1.79.0, and Debian package parsing 0.21.1. Keep the existing hardened RPM parser replacement.
  • Switch YAML parsing to the YAML organization's maintained go.yaml.in/yaml/v3 3.0.5 module. The configuration format stays the same.
  • Fix diagnostics for invalid paths and OpenPGP armor in log export, RPM metadata generation, and workspace validation: show the offending path or armor type instead of %!w(<nil>).
  • Update pinned GitHub Actions, GoReleaser 2.18.3, deadcode 0.52.0, and govulncheck 1.9.0. CI snapshot packages now read their version from the Makefile.
  • Regenerate third-party notices for all four release platforms and include them in every archive and Linux package.

Schema v13, configuration sow/v3, the CLI, and the public repository layout are unchanged. Existing v0.5.0 and v0.6.0 workspaces need no schema migration. Upgrade/rollback checks covered a v0.6.0 RPM/DEB workspace opened by v0.6.1 and then reopened by v0.6.0.

Source analysis and a symbol-preserving control build found no affected symbols or imported packages. GO-2026-5932 concerns the unused legacy golang.org/x/crypto/openpgp package. Because release binaries are stripped, govulncheck -mode=binary falls back to module-level precision and reports that notice as affecting the binary. All four release-target import graphs exclude the legacy package; SOW uses the maintained ProtonMail fork.

Assets: four Linux/macOS amd64/arm64 tarballs, two RPMs, two DEBs, and SHA256SUMS.

中文

SOW 0.6.1 是一次工具链与依赖更新，同时包含两项小修复。

  • 构建要求及发布二进制统一升级到 Go 1.27.3。
  • 更新加密、AWS SDK、压缩、SQLite、Debian 包解析等依赖，保留现有 RPM 解析器安全补丁。
  • YAML 解析切换到 YAML 官方团队维护的 go.yaml.in/yaml/v3 3.0.5，配置格式保持兼容。
  • 修复日志导出、RPM 元数据、签名及工作区校验的错误信息：显示具体的无效路径或签名类型，不再出现 %!w(<nil>)。
  • 更新 CI 与发布工具；快照包版本直接读取 Makefile，避免版本号遗漏。
  • 更新四个平台的第三方许可清单，并随归档和安装包分发。

数据库 schema v13、配置 sow/v3、命令接口与公开仓库布局保持不变。v0.5.0 / v0.6.0 工作区无需迁移数据库。已验证由 v0.6.0 创建的 RPM/DEB 工作区可以用 v0.6.1 操作，再由 v0.6.0 重新打开。

源码分析及保留符号的对照构建均未发现可达漏洞或受影响的导入包。GO-2026-5932 提示对应未使用的旧 golang.org/x/crypto/openpgp 包。发布二进制移除了符号表，govulncheck -mode=binary 会退回模块级判断并报告此提示；已确认四个平台的导入图均不包含该旧包，实际使用的是维护中的 ProtonMail 分支。

发布附件包含四个平台归档、两个 RPM、两个 DEB 及 SHA256SUMS。

Assets 11
Loading