Skip to content

v0.5.0 — Native delivery and portable evidence

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Sep 06:57
· 131 commits to main since this release
v0.5.0
c81fb9c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Rio v0.5.0 turns normalized SBOMs into verified deliveries and portable evidence. Configure intake and destinations in one rio.yaml, then run rio normalize --gate fail && rio deliver.

What’s new

  • Native Dependency-Track delivery. Upload the exact normalized bytes, with project name/version taken from the SBOM subject or an explicit selector. Preview destinations offline, inspect immutable journals, and reconcile receiver activity without uploading again.
  • One configuration and useful defaults. Plain rio deliver sends every indexed artifact to every eligible target. Collision checks and full batch preflight precede requests. Automatic journal paths guard unchanged reruns; partial and uncertain outcomes remain explicit.
  • OCI distribution. Publish a standalone CycloneDX SBOM or attach it to an existing image/index descriptor. Rio returns distinct SBOM, manifest and subject digests, verifies retrieved bytes and Referrers, and can recover intent-only history after a lost response or process crash without replaying uploads.
  • Portable record.json. Collect the exact index and selected committed journal bytes, readable facts and coverage. Inspect the file offline after the original workspace is gone. Receipts, activity, content verification and TLS facts remain separate.
  • Explicit Dependency-Track TLS control. Prefer caFile for a company CA. When necessary, opt in with insecureSkipVerify: true on an HTTPS target; the record shows that certificate verification was disabled and whether origin TLS was observed. Strict verification remains the default, and there is no automatic insecure fallback.
  • Faster onboarding. The README now includes complete minimal configurations, target-name explanations, private credential-file/environment setup, optional CA placement and output locations.

A minimal Dependency-Track configuration

Save this as rio.yaml beside your project. Supply DTRACK_API_KEY through your CI secret store or a private environment file outside the repository.

version: 1
artifacts:
  - id: app
    sbom: target/bom.json
delivery:
  targets:
    security:  # your chosen target name
      type: dependency-track
      url: https://dtrack.example.com
      apiKeyEnv: DTRACK_API_KEY
      autoCreate: true  # explicit permission to create the subject project
rio normalize --gate fail && rio deliver
# Replace JOURNAL_PATH with the path printed by deliver.
rio record --delivery-record JOURNAL_PATH --output target/rio/record.json
rio record inspect --file target/rio/record.json

Full first-delivery walkthrough · OCI configuration · Record format

Tested scope

Receiver Observed coverage
Dependency-Track 5.1.1 Native upload/activity behavior; HTTPS through a local test gateway with default refusal, supplied-CA verification and explicit bypass; portable TLS evidence
Nexus Community 3.94.0-12 Native OCI hosted path routing, standalone and image/index attachment, Referrers, read-back, scoped permission denial, tag immutability and crash recovery
zot 2.1.21 TLS/Basic auth, standalone and image/index attachment, Referrers, read-back and crash recovery
Distribution 3.1.2 TLS/Basic auth and standalone delivery; that version lacks the Referrers API, so attachment deliberately refuses before writes

Artifactory validation is deferred to #88; it is not advertised as tested. These results cover the documented versions/configurations, not every deployment or later version. OCI storage/discovery is separate from Xray, Lifecycle or vulnerability analysis.

Compatibility and evidence

Existing normalization manifests, index v1 data and old supported delivery journals remain readable. If you used an earlier development build with a separate delivery configuration, move its targets into rio.yaml; the retired --config/--delivery flags now provide migration errors. Project creation remains disabled unless explicitly enabled.

An accepted receipt is not proof of ingestion. Records remain unsigned consistency evidence; signing and complete workspace retention are separate work. Record export requires filesystem hard-link support and fails safely when unavailable. Native Linux, macOS and Windows checks, static binaries and installed-binary demonstrations are release gates.

Includes #82, #86, #87, and #89.

Full changelog

Assets 12
Loading