v0.1.5

What's Changed

Other Changes

• Add quickstart integration tests by @saschagrunert in #70
• Security hardening: audit logging, metrics warning, threat documentation by @saschagrunert in #73
• Improve code quality, observability, and type safety by @saschagrunert in #71
• Use consistent glob matching and misc improvements by @saschagrunert in #74
• Add VEX attestation to release pipeline and bump to v0.1.5 by @saschagrunert in #75

Full Changelog: v0.1.4...v0.1.5

v0.1.4

What's Changed

Other Changes

• Bump version to 0.1.4 by @saschagrunert in #69

Full Changelog: v0.1.3...v0.1.4

v0.1.3

What's Changed

Other Changes

• Support keyless VSA verifiers by @saschagrunert in #68

Full Changelog: v0.1.2...v0.1.3

v0.1.2

What's Changed

Other Changes

• Fix attestation discovery for GHCR and config log level by @saschagrunert in #62
• Add VSA attestation to release pipeline by @saschagrunert in #63
• Add manifest list support for digest resolution by @saschagrunert in #65
• Rename slsa_provenance check type to slsa by @saschagrunert in #64
• Bump version to 0.1.2 by @saschagrunert in #66
• Look up attestations on manifest list digest for multi-arch images by @saschagrunert in #67

Full Changelog: v0.1.1...v0.1.2

v0.1.1

What's Changed

Other Changes

• Improve release notes and fix quickstart image tag by @saschagrunert in #60
• Add SLSA provenance attestation and bump to v0.1.1 by @saschagrunert in #61

Full Changelog: v0.1.0...v0.1.1

v0.1.0

Initial release of the Supply Chain NRI Plugin, an NRI plugin that verifies container image supply chain attestations at the runtime level.

Highlights

• Runtime-level enforcement: Intercepts container creation on CRI-O and containerd, so verification cannot be bypassed by misconfigured admission webhooks or direct kubelet API calls
• Attestation verification: Verifies SLSA provenance, VEX advisories, and VSA attestations using Sigstore bundle verification
• Policy-based rules: Configurable per namespace and image pattern with glob matching and regex support
• Cosign compatibility: Tag-based attestation discovery with OCI registry fallback
• Standalone CLI: Verify images outside of a cluster with nri-supply-chain --verify-image
• Live config reloading: Watches config files via fsnotify, applies policy changes without restart
• Observability: Prometheus metrics for verification latency, cache hit rates, and error counts; structured audit logging
• Verification result caching: In-memory TTL cache with pre-warming support to reduce registry round-trips

Installation

Method	Artifact
Container image	ghcr.io/saschagrunert/nri-supply-chain:0.1.0
Binary	nri-supply-chain_0.1.0_linux_{amd64,arm64}
Debian package	nri-supply-chain_0.1.0_linux_{amd64,arm64}.deb
RPM package	nri-supply-chain_0.1.0_linux_{amd64,arm64}.rpm
Kubernetes	daemonset.yaml
systemd	nri-supply-chain.service

All binaries are signed with cosign and include SBOM artifacts. See Verifying Releases for verification steps.

Full Changelog: https://github.com/saschagrunert/nri-supply-chain/commits/v0.1.0