v0.3.0

Highlights

• Unsigned normalization attestations: rio normalize --attest now writes an in-toto Statement v1 beside each normalized SBOM, recording its digest, tool and manifest details, transformations, and gate results. The subject is the normalized SBOM; signing and verification tooling for these statements remains planned.
• Reliable SBOM discovery: normalize and plan now refuse incomplete searches, including unreadable symlinked directories, with exit code 2 rather than accepting an unproven single match.
• Verified release publication: Rio's release workflow verifies staged asset bytes, signatures, and provenance/SBOM attestations before publication, then compares downloaded draft assets. Homebrew updates only after successful publication.
• Security maintenance and demos: Verified patch/minor security-update automation, a pinned vulnerability scanner, and an offline release-gate demo with an optional video renderer.

Changelog

• bed3d64 Align README with rio's evidence compiler direction
• 3dbc6e8 Authenticate merge-trigger events and scan the scanner (Fixes #48)
• 2e9b142 Automatically merge verified patch and minor security fixes (Fixes #48)
• 188ff3a Correct Dependabot metadata and check-reading permissions (Fixes #48)
• 8fc4b06 Correct rebaze website link in README
• 4add180 Emit unsigned normalization attestations (Fixes #13)
• 2b46944 Gate release publication on verified staged assets (Fixes #51)
• a79a109 Pin the security scanner and verify all workflow changes (Fixes #48)
• 5525f07 Refuse to assert exactly one SBOM over a tree rio could not read
• 14bcdbd Revalidate Dependabot body metadata before merging (Fixes #48)
• 31d9edd Revalidate all PR state immediately before merge (Fixes #48)
• ae03ac0 Use immediate REST merges and isolate scheduled scans (Fixes #48)
• 04526c2 Verify dependency security updates and scope fixture findings (Fixes #48)