v0.4.0 — Module discovery, enrichment and build context

Rio v0.4.0 adds automatic module SBOM discovery, product metadata enrichment, and producer-supplied build context. Existing explicit-artifact manifests continue to work.

Windows: AMD64 / x64 ZIP · ARM64 ZIP. Extract the archive and run .\rio.exe version from PowerShell.

Automatically include module SBOMs

Optional artifactSets selects module markers first, then requires exactly one SBOM from every selected module. Adding a matching module includes it without another manifest entry; a selected module with a missing SBOM makes both plan and normalize fail before normalization output is written.

For example, for Gradle projects using these marker and output conventions:

version: 1
artifactSets:
  - modules: "services/**/*server/{build.gradle,build.gradle.kts}"
    sbom: "build/reports/cyclonedx-direct/bom.json"
    idFrom: module-directory

Adjust the patterns to your project and SBOM producer. modules selects marker files relative to the manifest; sbom is relative to each selected module. Rio does not invoke Gradle/Maven or interpret build membership. Use forward slashes in YAML paths on every platform.

Each module remains a separate normalized SBOM and index entry. IDs come from module-directory names; exclusions and explicit artifacts handle exceptions. Discovery is deterministic, rejects ambiguous identities and overlapping inputs, and adds selection records to plans, indexes and optional statements. Explicit artifacts and sets can be mixed.

Artifact sets reference · Runnable demo

Supply product metadata and build context

• Manifest enrichment: shared defaults and per-artifact values for product identity, manufacturer, supplier, SBOM producer, contact URLs and SBOM data license. Existing conflicting values require explicit replacement, with before/after records. Dependency component membership stays unchanged.
• Build/source context: bind a local producer assertion to the artifact ID and the original SBOM's SHA-256. Required fields, conflicts, replacements and removal of previously owned claims are checked and recorded. Rio preserves original generator information and distinguishes these assertions from independently verified provenance.
• Generated artifacts can share transforms, enrichment and context. Auxiliary file paths stay manifest-relative. rio plan --json describes bindings without needing a context file or external p2 mapping table to exist yet.

Enrichment reference · Context reference

Easier onboarding

• A shorter README with focused command, manifest and output references; existing trust badges remain prominent.
• A small synthetic first-repair example that shows a p2 package URL becoming a Maven coordinate, with the original retained.
• A harness-independent “Integrate Rio into my project” guide, copyable configurations and CI examples, plus reproducible onboarding evaluation instructions.
• New installed-binary demos and regression coverage for artifact sets, enrichment, context and first-run onboarding.

Get started · Agent integration · Tools and examples

Downloads and compatibility

Release archives contain a self-contained Rio binary for Windows, macOS and Linux, on AMD64 and ARM64. Windows downloads are ZIP files; Bash is not required to run rio.exe. The optional shell demos are separate from the binary.

Windows binaries are cross-built; the automated runtime test suite currently runs on Linux. Native Windows execution of the new artifact-set workflow has not yet been validated in CI. A synthetic Gradle layout with both Groovy and Kotlin marker names was exercised on macOS; this does not substitute for testing your actual build.

Manifest, plan and index outer versions remain at v1. The new configuration sections and record fields are optional; binaries older than this release reject unsupported manifest keys. index.json defines the current run's members; use a fresh output directory or collect the index members, because older files can remain in a reused directory. A pre-existing SBOM is not proof that it came from the current build.

Checksums, the checksum signature bundle, the CycloneDX source SBOM and the release attestation bundle accompany the archives. The release workflow verifies staged assets and attestations before publishing. This release also updates Homebrew cask generation to the current postflight-step syntax and updates CI tooling.

Full changelog: v0.3.0...v0.4.0