VEXViper 0.8.0

Install

helm install vexviper oci://ghcr.io/seebom-labs/charts/vexviper --version 0.8.0
docker pull ghcr.io/seebom-labs/vexviper:0.8.0

Binaries, checksums and the SPDX SBOM are attached below. The image is signed with cosign keyless signing.

What's Changed

Other Changes

• Align with BOMHort 0.8: aliases, dependency scope, human verdicts, Hex/Swift by @mfahlandt in #30
• Pin E2E to BOMHort v0.8.0 and reference the 0.8.0 chart by @mfahlandt in #31

Full Changelog: v0.1.0-rc.1...v0.8.0

VEXViper 0.8.0-rc.1

Warning

Release candidate for v0.8.0-rc.1 — for testing, not for production.
The image is not tagged latest or with the stable minor tag, and Helm installs this chart only when asked for --version 0.8.0-rc.1 explicitly.

Install

helm install vexviper oci://ghcr.io/seebom-labs/charts/vexviper --version 0.8.0-rc.1
docker pull ghcr.io/seebom-labs/vexviper:0.8.0-rc.1

Binaries, checksums and the SPDX SBOM are attached below. The image is signed with cosign keyless signing.

What's Changed

Other Changes

• Align with BOMHort 0.8: aliases, dependency scope, human verdicts, Hex/Swift by @mfahlandt in #30
• Pin E2E to BOMHort v0.8.0 and reference the 0.8.0 chart by @mfahlandt in #31

Full Changelog: v0.1.0-rc.1...v0.8.0-rc.1

VEXViper 0.1.0-rc.1

Warning

Release candidate for v0.1.0-rc.1 — for testing, not for production.
The image is not tagged latest or with the stable minor tag, and Helm installs this chart only when asked for --version 0.1.0-rc.1 explicitly.

Install

helm install vexviper oci://ghcr.io/seebom-labs/charts/vexviper --version 0.1.0-rc.1
docker pull ghcr.io/seebom-labs/vexviper:0.1.0-rc.1

Binaries, checksums and the SPDX SBOM are attached below. The image is signed with cosign keyless signing.

What's Changed

Other Changes

• Add VEXViper: LLM-assisted OpenVEX generation sidecar for BOMHort by @mfahlandt in #1
• Token discipline: --force vs --regenerate, AGENTS.md, assessment cache + usage tracking by @mfahlandt in #2
• Add assessment cache and provider usage tracking (TokenOps) by @mfahlandt in #3
• Add provider budget, upload verification, watch concurrency and metrics by @mfahlandt in #4
• Release readiness: seebom-labs paths, release workflow, Dependabot by @mfahlandt in #5
• evidence: manifest, lockfile and import evidence for non-Go ecosystems by @mfahlandt in #12
• ci: run the BOMHort end-to-end test in GitHub Actions by @mfahlandt in #14
• gitops: review-first publishing of VEX documents via git branches and PRs by @mfahlandt in #13
• Adopt BOMHort VEX scoping and add GitOps publishing by @mfahlandt in #15
• ci: pin the E2E test to BOMHort v0.7.0 by @mfahlandt in #17
• ci: pin the E2E test to BOMHort v0.7.1 by @mfahlandt in #18
• Add lockfile-graph and Rust symbol evidence for non-Go ecosystems by @mfahlandt in #19
• Use github.com/seebom-labs/bomhort-go instead of internal/bomhort by @mfahlandt in #20
• Emit spec-shape VEX statements: product = SBOM, subcomponent = purl by @mfahlandt in #21
• Cut releases from release branches with RCs and backports by @mfahlandt in #22
• Bump GitHub Actions, Go toolchain and golang.org/x/mod by @mfahlandt in #23

New Contributors

• @mfahlandt made their first contribution in #1

Full Changelog: https://github.com/seebom-labs/VEXViper/commits/v0.1.0-rc.1