Skip to content

v0.8.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Oct 10:26
· 47 commits to main since this release
v0.8.0
e45f3a0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Rio v0.8.0

Consumed → enriched → delivered → acknowledged, on a smaller baseline.

The compact receipt is unchanged. This excerpt is from the released Rio v0.7.0 synthetic
two-SBOM demonstration, using a local HTTPS receiver and synthetic tokens; digests are
shortened only in this display:

api.cdx.json     1d2b04c0df45… → 55e46a63a8b3…  (2307 output bytes)
worker.cdx.json  721bd8311e64… → 085265392b20…  (2316 output bytes)

Added to both: build.url = https://ci.example.org/runs/42
               build.id  = 42
TLS:           observed; certificate verification enforced
api:           HTTP 200, accepted
worker:        HTTP 200, accepted

Complete released sample JSON · Offline HTML · Runnable sample download

These are recorded observations, not proof of receiver retention or ingestion.

What changed

v0.8.0 is a baseline release. Rio's commands, flags, manifest, receipt format and runtime
behavior are the same as v0.7.2; the binary is rebuilt from the same Go source and
dependencies. The repository around it is smaller:

  • Removed the feature-video authoring tooling and the Juice Shop walkthrough. The synthetic
    client-record demo above covers the same consumed → enriched → delivered → acknowledged
    workflow without building intentionally vulnerable software or resolving unpinned npm
    dependencies.
  • The release-tool build no longer refuses to run when a workflow or release script changes
    by a single byte. Cosign, Syft and GoReleaser are still rebuilt from authenticated upstream
    modules with locked dependencies, scanned with symbols, and refused on any unreviewed
    advisory. Routine GitHub Actions updates no longer fail CI on that check.
  • Removed a one-off workflow that only smoke-tested the release App token.
  • Updated CodeQL, upload-artifact and download-artifact action pins.

Every remaining feature demonstration still runs against the built binary in CI. The seven
delivery and receipt demonstrations run on Linux, macOS and Windows; the repair, enrichment,
context, artifact-set, agent-integration and signing demonstrations and the real OCI and
Dependency-Track receivers run on Linux.

Supporting-tool documentation · Build recipe and advisory scope

Verification limits

Artifactory validation and Apple notarization remain separate follow-ups.

Assets 12
Loading