Skip to content

v1.10.0 — environment header, durable artifact references, index search

Choose a tag to compare

View all tags
@clem-field clem-field released this 30 Jun 17:46
v1.10.0
8aca843

SPARC v1.10.0

✨ Features

Configurable environment header bar (#682)
A site-wide header banner to label a deployment and its rules-of-use. Configure the text and colors per environment via SPARC_HEADER_TEXT, SPARC_HEADER_TEXT_COLOR, and SPARC_HEADER_HIGHLIGHT_COLOR (hex or rgb; special characters supported). Defaults are WCAG-passing and match the SPARC palette — operator-supplied colors are honored as-is.

Durable, version-aware artifact references (#680)
OSCAL back-matter URIs now stay intact across re-uploads, with full version history for audit and drift detection. Each evidence artifact resolves at a stable /artifacts/:uuid location, while a new content-version UUID is minted whenever the artifact materially changes (a re-upload, or an attestation re-reviewed on a new date). Every prior version's content is retained.

Why the UUID changes when the link does not: the link (rlinks[].href) is the artifact's stable home — where you always go to fetch the current version. The resource uuid identifies one specific content version. When an attestation is re-reviewed or a document re-uploaded, the location is unchanged (same link) but the content differs — so it gets a new UUID. That's deliberate: an external system comparing UUIDs can detect that an artifact drifted — and when it was last reviewed — without the link ever breaking. The full version history makes the audit trail complete.

Search on index views (#672)
Filter documents by title/identifier directly from the listing pages.

🔒 Security & supply chain

  • Least-privilege CI/publish role (#480, #688) — CI assumes a dedicated, scoped IAM role for ECR push, image signing, and S3 artifact emit, replacing the broad shared role.
  • Composed ECR registry (#689) — the registry URL is built in-code from account/region/repo secrets — better public-fork portability and one fewer configuration footgun.
  • Cosign signing hardening (#679) — verify-with-retry for registry referrers-API eventual consistency, and a pinned cosign release.
  • Single gated release approval (#692, #545) — build/sign/publish is gated behind one production-environment required-reviewer approval.

🧰 Maintenance

  • rubyzip bump (#681) + dependency updates.

Multi-arch (amd64/arm64) images are published to Docker Hub + ECR and signed with cosign (keyless). Verify:

cosign verify <image> \
  --certificate-identity-regexp 'https://github.com/risk-sentinel/sparc/.github/workflows/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
Assets 2
Loading