v0.7.2

Rio v0.7.2

Consumed → enriched → delivered → acknowledged, with a patched Go build and stronger release checks.

The compact receipt remains the same. This excerpt is from the existing released Rio v0.7.0
synthetic two-SBOM demonstration, using a local HTTPS receiver and synthetic tokens;
digests are shortened only in this display:

api.cdx.json     1d2b04c0df45… → 55e46a63a8b3…  (2307 output bytes)
worker.cdx.json  721bd8311e64… → 085265392b20…  (2316 output bytes)

Added to both: build.url = https://ci.example.org/runs/42
               build.id  = 42
TLS:           observed; certificate verification enforced
api:           HTTP 200, accepted
worker:        HTTP 200, accepted

Complete released sample JSON · Offline HTML · Runnable sample download

These are recorded observations, not proof of receiver retention or ingestion. The pipeline
and receipt contract shipped in v0.7.0; this maintenance release preserves that behavior.

Security maintenance

• Raise the required Go compiler from 1.27.0 to 1.27.2 in Rio and the security-tool module,
  addressing the ten reachable standard-library advisories detected by CI on October 12.
• Update golang.org/x/text from 0.39.0 to 0.41.0 for GO-2026-6629. The affected package was
  not imported by Rio, but the vulnerable version is removed from its module inventory.
• Keep scanner exceptions limited to the Commons Lang metadata in the captured synthetic
  example directories. Original receipt-bound bytes remain unchanged; real dependencies and
  the same advisory outside those directories remain scanned.

Existing downloaded static binaries are unchanged. Install this release to receive its rebuilt binary.

Supporting tools and examples

• Add local-key normalization-attestation signing and independent recipient verification helpers.
  They reject altered SBOMs/statements, wrong trusted keys, overwrite attempts and legacy/mixed
  bundle formats. Batch consistency is checked before success. Current helpers use cosign 3.1.3;
  the original synthetic sample remains independently verifiable.
• Add the source-built Juice Shop walkthrough with captured JSON receipts, offline HTML and
  build provenance. Its backend example is accepted; missing frontend package identities stop
  delivery at the quality gate. Juice Shop is intentionally vulnerable demonstration software.
• Restore README badges and practical guidance, clarify supported workflow scope, and update
  doublestar to 4.10.2 plus CodeQL/Syft Action references.

Signing demonstration · Juice Shop results · Supporting-tool documentation

Pipeline reliability

This is the published maintenance update after v0.7.0. The v0.7.1 tag remains
reserved: GitHub rejected its workflow before any release jobs or publication.
The reusable CodeQL workflow now requests only the permissions granted by its
release caller. A non-publishing release preflight exercises both reusable gates
before another tag is created.

Release publication now depends on complete CI and CodeQL execution for the tagged source,
followed by the existing verification of exact staged assets. Manual and scheduled CI run all
check groups. An aggregate result covers native Linux/macOS/Windows tests and real OCI and
Dependency-Track receivers. The security-update bot also requires that aggregate before merging.
CodeQL completion is not a new policy that treats every reported finding as a release refusal.

The hard-kill recovery test keeps its child alive until termination instead of racing Go's
runtime deadlock detection. Repeated tests preserve no-replay and crash-lock assertions.
Syft and GoReleaser versions are explicit; weekly version checks raise reviewable update work.
They do not automatically install, merge or publish updates.

Verification limits

The Rio source/module vulnerability scan is distinct from its third-party release tools.
Cosign, Syft and GoReleaser are now rebuilt from verified upstream modules with Go 1.27.2
and explicit patched dependency locks. Their symbols are retained for auditing. Unexpected
advisories fail the build; two legacy-feature advisories remain visible with narrowly reviewed
command-specific dispositions. Syft's OpenPGP finding is module-only, with no affected package
imports in the rebuilt tool.

Build recipe and scope · Original upstream-binary audit

The original stripped Syft/GoReleaser scans used module-level fallback, so their counts were
not proof that every listed vulnerable function was present. These dispositions apply only
to Rio's reviewed commands, not arbitrary use of the tools. Artifactory validation and Apple
notarization remain separate follow-ups.