Skip to content

Releases: telekom/sutura

Release list

v0.10.0

v0.10.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 06:28
Immutable release. Only release title and notes can be modified.
v0.10.0
22e6c36

0.10.0 - 2026-10-22

Breaking changes

  • docs: Generate the API reference on main, not in git (#1529)
  • catalog: A metric lists one shared calendar per source (#1523)
  • exec-bigquery: Run a domain_delegation caller as their address (#1457)
  • exec-datafusion: Merge the arms of a drill-across plan (#1513)
  • federation: Carry a truncated crossing key into the fact leg (#1514)
  • federation: Name the refusals of a declared key cast (#1515)
  • federation: Carry up to three lookup legs in a plan (#1500)
  • domain: A plan key may truncate its column to a grain (#1496)
  • catalog: A relationship may declare how its two keys compare (#1495)
  • config: A direct workload-identity source needs a delegation hop (#1461)
  • identity: Stop verifying past a key set source's declared ceiling (#1497)

Features

  • domain: Declare the refusals for planning several lookup legs (#1535)
  • federation: Join a declared key pair through its cast (#1527)
  • domain: Declare the drill-across refusals and run a plan's legs (#1524)
  • domain: Add the drill-across plan for several metrics (#1498)

Fixes

  • examples: Run the cube and metrics-layer examples from their READMEs (#1520)
  • exec-clickhouse: Swap a reloaded fixture table in, never empty it (#1518)
  • examples: Run the federated example as its README documents (#1511)
  • xtask: Refuse a failed git call in the causality gate (#1509)

Documentation

  • slides: Add a why-sutura slide after the problem statement (#1533)
  • catalog-datahub: An endpoint joins only through the urn it names (#1526)
  • slides: Keep build steps off the public slides page (#1525)
  • slides: A meetup deck, and deck-only diffs skip the Rust legs (#1512)
  • examples: Add a settings example for an API gateway upstream (#1510)

Tests

  • xtask: Give the slow gate cells a load-tolerant nextest ceiling (#1507)

Build

  • deps: Unvendor utoipa-swagger-ui, use the published 10.0.2 (#1517)
  • deps: Bump webpki crates for RUSTSEC-2026-0381 and -0382 (#1506)

CI

  • examples: Run the runnable examples on change (#1519)
  • Bump the github-actions group with 2 updates (#1501)

Artifacts

Binaries

Binary Target Asset Size Linking
sutura x86_64-unknown-linux-gnu sutura-x86_64-unknown-linux-gnu.tar.gz 41.2MiB dynamic (glibc)
sutura aarch64-unknown-linux-gnu sutura-aarch64-unknown-linux-gnu.tar.gz 36.8MiB dynamic (glibc)
sutura x86_64-unknown-linux-musl sutura-x86_64-unknown-linux-musl.tar.gz 66.0MiB static, no libc
sutura aarch64-unknown-linux-musl sutura-aarch64-unknown-linux-musl.tar.gz 57.7MiB static, no libc

Images

Image Variant Tag Platforms
sutura glibc (the default) ghcr.io/telekom/sutura:0.10.0, ghcr.io/telekom/sutura:latest linux/amd64, linux/arm64
sutura static musl ghcr.io/telekom/sutura:0.10.0-musl, ghcr.io/telekom/sutura:latest-musl linux/amd64, linux/arm64
Variant Pull by digest
glibc docker pull ghcr.io/telekom/sutura@sha256:d0253104149fa716152bf55fa92a208d9d5142507c03b849cc4181f4d18a24d4
musl docker pull ghcr.io/telekom/sutura@sha256:320df1786c2f9e58de3b395b99d321608090712abf0c9fda61ecedc4488a3034
Leaf Tag Pull by digest
x86_64-unknown-linux-gnu ghcr.io/telekom/sutura:0.10.0-x86_64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:4bc0e0ab0ebbbdf57a1c3ad796219c154bca8aa69915a606f5dd99aeadc21f77
aarch64-unknown-linux-gnu ghcr.io/telekom/sutura:0.10.0-aarch64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:e43faf941c6ab6521ba595494461876ada7b9cc23b197ff26f1323ca0a0de80d
x86_64-unknown-linux-musl ghcr.io/telekom/sutura:0.10.0-x86_64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:b0f94ae8018297154c39058b2774d34d5b8d3e78f9b1168c41404ff1e401a9bd
aarch64-unknown-linux-musl ghcr.io/telekom/sutura:0.10.0-aarch64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:e10886df3d9e89b29c7418c12a96dbf129427a9bb9c2004922523fa63e85182c
Loadable image tarball Size
sutura-oci-aarch64-unknown-linux-musl.tar.gz 58.4MiB
sutura-oci-x86_64-unknown-linux-musl.tar.gz 66.5MiB

Software bill of materials

Image CycloneDX SPDX
x86_64-unknown-linux-gnu sutura-oci-x86_64-unknown-linux-gnu.cdx.json sutura-oci-x86_64-unknown-linux-gnu.spdx.json
aarch64-unknown-linux-gnu sutura-oci-aarch64-unknown-linux-gnu.cdx.json sutura-oci-aarch64-unknown-linux-gnu.spdx.json
x86_64-unknown-linux-musl sutura-oci-x86_64-unknown-linux-musl.cdx.json sutura-oci-x86_64-unknown-linux-musl.spdx.json
aarch64-unknown-linux-musl sutura-oci-aarch64-unknown-linux-musl.cdx.json sutura-oci-aarch64-unknown-linux-musl.spdx.json
Covers Read from
the files in the image: the binary, CA certificates, tzdata the image layers
the crates the binary was compiled from a cargo auditable section inside the binary, not from Cargo.lock

Licence

Document Covers
sutura-attribution.md every third-party crate this workspace resolves and the licence it declares; generated by cargo metadata from the Cargo.lock of this tag, never committed

Provenance and signatures

Artefact Sigstore bundle SLSA provenance Registry signature
binaries, image tarballs, SBOMs, the two licence documents, image-digests.txt <asset>.sigstore.json, attached yes n/a
the .sha256 sidecars no: the bundle above already commits to the digest yes n/a
images, four leaves and two manifest lists n/a the two manifest lists cosign, all six references
each leaf image's CycloneDX SBOM n/a n/a cosign attest --type cyclonedx
Check Command
an asset is the bytes a release workflow of this repository produced, offline cosign verify-blob --bundle <asset>.sigstore.json --certificate-identity-regexp '^https://github\.com/telekom/sutura/\.github/workflows/release(-performance)?\.yml@refs/tags/' --certificate-oidc-issuer https://token.actions.githubusercontent.com <asset>
the same, against this forge gh attestation verify <asset> --repo telekom/sutura
an image is the one a release workflow of this repository pushed cosign verify ghcr.io/telekom/sutura@<digest> --certificate-identity-regexp '^https://github\.com/telekom/sutura/\.github/workflows/release(-performance)?\.yml@refs/tags/' --certificate-oidc-issuer https://token.actions.githubusercontent.com
what is inside an image cosign verify-attestation --type cyclonedx ghcr.io/telekom/sutura@<digest> --certificate-identity-regexp '^https://github\.com/telekom/sutura/\.github/workflows/release(-performance)?\.yml@refs/tags/' --certificate-oidc-issuer https://token.actions.githubusercontent.com
the licence statement is the release's, offline cosign verify-blob --bundle sutura-attribution.md.sigstore.json --certificate-identity-regexp '^https://github\.com/telekom/sutura/\.github/workflows/release(-performance)?\.yml@refs/tags/' --certificate-oidc-issuer https://token.actions.githubusercontent.com sutura-attribution.md
what any of it means Verifying a release
Assets 50

v0.9.0

v0.9.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Oct 20:04
Immutable release. Only release title and notes can be modified.
v0.9.0
1cca42e

0.9.0 - 2026-10-19

Breaking changes

  • exec-bigquery: Run a google_login caller as their Google login (#1445)
  • federation: Refuse a cross-source relationship with truncated key (#1488)
  • http: Read the inbound key set from an https URL (#1483)
  • app: Refuse run_sql over an unserved source shape as a 409 (#1469)
  • http: Build the request state only from settings /v1 may serve (#1465)
  • chart: Refuse an inbound block with no mode and extraEnv security names; fix stale /v1 prose (#1459)
  • config: Read every Oracle source over verified TLS only (#1446)
  • config: Declare one of three BigQuery caller-identity modes (#1442)
  • chart: Musl image default, telemetry values, gateway refusal (#1431)
  • catalog-rdbms: Read an Oracle dictionary over verified TLS only (#1432)
  • config: Refuse /v1 start-up without inbound identity (#1420)
  • federation: Pin each table's schema from the catalog (#1389)
  • app: Refuse a federated leg that is not among the cut's legs (#1382)
  • http: Honour tools.run_sql.enabled on every agent route (#1384)
  • domain: Run a federated plan's legs through a cut and a runner (#1358)

Features

  • http: Admit a gateway assertion once when single use is declared (#1486)
  • xtask: Add a shard input to the claim-mutation-kills run (#1479)
  • http: Keep a rotated-out key set verifying behind a gateway (#1474)
  • http: Read a PEM key file with a thumbprint key id (#1460)
  • identity: Record the OAuth client a token names on each audit line (#1463)
  • identity: Accept a path or client-id audience, opt-in scp/roles, a gateway grant (#1434)
  • exec-clickhouse: Run a federated leg (#1433)
  • mcp: Log and count /mcp questions as /v1 does (#1424)
  • chart: A values flag to run the performance image (#1418)
  • domain: A typed refusal for a run_sql plan over several sources (#1408)
  • identity: Accept a gateway assertion that replaced Authorization (#1410)
  • config: Let run_sql start over an acknowledged shared source (#1391)
  • app: Name a federated leg the charged cut did not give out (#1386)

Fixes

  • ci: Pass minimum-gb via env, seed the falsifier at the registry counts, keep the walk out of .sutura-dev (#1473)
  • deps: Vendor utoipa-swagger-ui to move zip off the yanked 8.x (#1472)
  • http: Name the tools.run_sql.enabled switch in the /v1 refusal (#1458)
  • xtask: Carry a test file moved between compiled paths as moved (#1454)
  • config: Name the hop position in a delegation refusal (#1453)
  • deps: Bump rustls to 0.23.46 for RUSTSEC-2026-0346..0349 (#1444)
  • xtask: Give causality's base run the head run's tier (#1438)
  • xtask: Read the causality diff as plain text (#1427)
  • xtask: Hold a test file deleted whole to the removed-test rule (#1406)
  • chart: Mirror the binary's token refusal; pin no UID by default (#1412)
  • mcp: Name the switch when the deployment turned a tool off (#1405)

Refactoring

  • domain: List every refusal beside the enum, not in a test file (#1487)
  • Move items out of five files near the line cap (#1485)
  • config: Name the inbound key source as a KeySetLocation (#1467)

Documentation

  • adr: Fan-in lookup legs also serve a chain that crosses twice (#1477)
  • Say what a key-set look logs; name every fixtures item (#1492)
  • adr: Decide a digest per metric for a remote leg (#1491)
  • adr: Decide the leg transport between two sutura nodes (#1478)
  • federation: Record the cut findings for PR 5b (#1476)
  • release: Pin the signer workflow in the verify commands (#1475)
  • examples: Start sutura and post the question in metrics-layer (#1449)
  • examples: A federated demo over Postgres, ClickHouse and DataHub (#1440)
  • Published-port record, gateway guide, pinned helm (#1416)
  • adr: Federated legs run as the caller (#1381)
  • cube: State which identity each Cube hop uses (#1378)

Tests

  • federation: Pin the exact compare of a text join key (#1484)
  • cli: No-echo cell for E19 over /mcp (#1480)
  • cli: No-echo cell for the Cube warehouse token and E19 (#1466)
  • federation: A key read as integer and as text is refused when run (#1468)
  • cli: No-echo cells for E14, E36 and E16 (#1451)
  • chart: Ask the /v1 start-up refusals in the chart cells (#1450)
  • http,tls: No-echo cells for E33, E2 and E7 (#1398) (#1415)
  • chart: Hold refusal cases to the binary's start-up refusals (#1419)
  • cube: Declare regions multi-valued; fail at the mint if no list (#1383)
  • serve: Pin the delegation refusal sentence (#1380)
  • app: Refuse a live bigquery cell outside CI (#1376)
  • Read live bigquery env through support modules (#1379)

Build

  • nix: Vendor BigQuery driver options for a caller's own credential (#1441)
  • Bump insta in / (#1430)
  • Pin the Keycloak image by digest (#1390)

CI

  • Bump the github-actions group with 3 updates (#1452)
  • deps: Group action bumps weekly, add a pin refresh task (#1448)
  • Run check-claim-mutation-kills on demand (#1396)

Artifacts

Binaries

Binary Target Asset Size Linking
sutura x86_64-unknown-linux-gnu sutura-x86_64-unknown-linux-gnu.tar.gz 41.1MiB dynamic (glibc)
sutura aarch64-unknown-linux-gnu sutura-aarch64-unknown-linux-gnu.tar.gz 36.7MiB dynamic (glibc)
sutura x86_64-unknown-linux-musl sutura-x86_64-unknown-linux-musl.tar.gz 65.9MiB static, no libc
sutura aarch64-unknown-linux-musl sutura-aarch64-unknown-linux-musl.tar.gz 57.6MiB static, no libc

Images

Image Variant Tag Platforms
sutura glibc (the default) ghcr.io/telekom/sutura:0.9.0, ghcr.io/telekom/sutura:latest linux/amd64, linux/arm64
sutura static musl ghcr.io/telekom/sutura:0.9.0-musl, ghcr.io/telekom/sutura:latest-musl linux/amd64, linux/arm64
Variant Pull by digest
glibc docker pull ghcr.io/telekom/sutura@sha256:2df96c7a1ce3c5e0774ece11f93bcfb1fba0d86bebbbd55d6a99089826bc7a0b
musl docker pull ghcr.io/telekom/sutura@sha256:faa96c12b07f2fd842b17980f1b82c2067a599f048522e4421d614d0fd6cb761
Leaf Tag Pull by digest
x86_64-unknown-linux-gnu ghcr.io/telekom/sutura:0.9.0-x86_64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:d14ee5bf21cf0a060c7b171c48b8bfb5cbf43b349b9c2c63bcbec356d1e4744a
aarch64-unknown-linux-gnu ghcr.io/telekom/sutura:0.9.0-aarch64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:95788617cf6b3f52a7ab7c888ddcc2522df50357704e68ab1f4f27af5c48ab94
x86_64-unknown-linux-musl ghcr.io/telekom/sutura:0.9.0-x86_64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:465da3bf055167750b1c2de018633958823e6720b2578eb0e9037ae914b7fc68
aarch64-unknown-linux-musl ghcr.io/telekom/sutura:0.9.0-aarch64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:2c69539d0cb96478d418de18da746e579a3a429030a679ee206a3fd081b258fc
Loadable image tarball Size
sutura-oci-aarch64-unknown-linux-musl.tar.gz 58.4MiB
sutura-oci-x86_64-unknown-linux-musl.tar.gz 66.4MiB

Software bill of materials

Image CycloneDX SPDX
x86_64-unknown-linux-gnu sutura-oci-x86_64-unknown-linux-gnu.cdx.json sutura-oci-x86_64-unknown-linux-gnu.spdx.json
aarch64-unknown-linux-gnu sutura-oci-aarch64-unknown-linux-gnu.cdx.json sutura-oci-aarch64-unknown-linux-gnu.spdx.json
x86_64-unknown-linux-musl sutura-oci-x86_64-unknown-linux-musl.cdx.json sutura-oci-x86_64-unknown-linux-musl.spdx.json
aarch64-unknown-linux-musl sutura-oci-aarch64-unknown-linux-musl.cdx.json sutura-oci-aarch64-unknown-linux-musl.spdx.json
Covers Read from
the files in the image: the binary, CA certificates, tzdata the image layers
the crates the binary was compiled from a cargo auditable section inside the binary, not from Cargo.lock

Licence

Document Covers
sutura-attribution.md every third-party crate this workspace resolves and the licence it declares; generated by cargo metadata from the Cargo.lock of this tag, never committed

Provenance and ...

Read more
Loading

v0.8.0

v0.8.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Oct 11:22
Immutable release. Only release title and notes can be modified.
v0.8.0
e61fac9

0.8.0 - 2026-10-12

Breaking changes

  • config: Refuse a delegation key that is present with no value (#1371)

Fixes

  • fuzz: Bound the sql_expression ASAN memory growth (#1377)
  • runtime: Keep bound query values out of logs (#1374)
  • xtask: Refuse a causality trailer on a merge commit (#1370)

Documentation

  • chart: Describe sutura in plain words (#1375)

Artifacts

Binaries

Binary Target Asset Size Linking
sutura x86_64-unknown-linux-gnu sutura-x86_64-unknown-linux-gnu.tar.gz 41.0MiB dynamic (glibc)
sutura aarch64-unknown-linux-gnu sutura-aarch64-unknown-linux-gnu.tar.gz 36.6MiB dynamic (glibc)
sutura x86_64-unknown-linux-musl sutura-x86_64-unknown-linux-musl.tar.gz 65.8MiB static, no libc
sutura aarch64-unknown-linux-musl sutura-aarch64-unknown-linux-musl.tar.gz 57.5MiB static, no libc

Images

Image Variant Tag Platforms
sutura glibc (the default) ghcr.io/telekom/sutura:0.8.0, ghcr.io/telekom/sutura:latest linux/amd64, linux/arm64
sutura static musl ghcr.io/telekom/sutura:0.8.0-musl, ghcr.io/telekom/sutura:latest-musl linux/amd64, linux/arm64
Variant Pull by digest
glibc docker pull ghcr.io/telekom/sutura@sha256:a8d8ad5d4a0b00d4f75087f1eaf1d4ce11b83506652f37b95be5e1c12e3e72ca
musl docker pull ghcr.io/telekom/sutura@sha256:be7555f149f40d03fe7eacc3a9cb81d4b681f3c6f24d40bf82b6ed27b0119c57
Leaf Tag Pull by digest
x86_64-unknown-linux-gnu ghcr.io/telekom/sutura:0.8.0-x86_64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:8e67345faf02dbf17282214b34cf7d00edbfeaa26a077bdff253b0de0329c3d2
aarch64-unknown-linux-gnu ghcr.io/telekom/sutura:0.8.0-aarch64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:4cd187c0b466f2b087a64b3ba2553b16fe341221dea00d02a4daa8a71eac8c35
x86_64-unknown-linux-musl ghcr.io/telekom/sutura:0.8.0-x86_64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:38b9b61c8dac10c5942ef094978ccd7c8659c58676a392cd43e77570052412a1
aarch64-unknown-linux-musl ghcr.io/telekom/sutura:0.8.0-aarch64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:e17cbb1606d9c5784baab99bdafbc0b8f3c767e90a832ee701010caf6d1bde9a
Loadable image tarball Size
sutura-oci-aarch64-unknown-linux-musl.tar.gz 58.3MiB
sutura-oci-x86_64-unknown-linux-musl.tar.gz 66.3MiB

Software bill of materials

Image CycloneDX SPDX
x86_64-unknown-linux-gnu sutura-oci-x86_64-unknown-linux-gnu.cdx.json sutura-oci-x86_64-unknown-linux-gnu.spdx.json
aarch64-unknown-linux-gnu sutura-oci-aarch64-unknown-linux-gnu.cdx.json sutura-oci-aarch64-unknown-linux-gnu.spdx.json
x86_64-unknown-linux-musl sutura-oci-x86_64-unknown-linux-musl.cdx.json sutura-oci-x86_64-unknown-linux-musl.spdx.json
aarch64-unknown-linux-musl sutura-oci-aarch64-unknown-linux-musl.cdx.json sutura-oci-aarch64-unknown-linux-musl.spdx.json
Covers Read from
the files in the image: the binary, CA certificates, tzdata the image layers
the crates the binary was compiled from a cargo auditable section inside the binary, not from Cargo.lock

Licence

Document Covers
sutura-attribution.md every third-party crate this workspace resolves and the licence it declares; generated by cargo metadata from the Cargo.lock of this tag, never committed

Provenance and signatures

Artefact Sigstore bundle SLSA provenance Registry signature
binaries, image tarballs, SBOMs, the two licence documents, image-digests.txt <asset>.sigstore.json, attached yes n/a
the .sha256 sidecars no: the bundle above already commits to the digest yes n/a
images, four leaves and two manifest lists n/a the two manifest lists cosign, all six references
each leaf image's CycloneDX SBOM n/a n/a cosign attest --type cyclonedx
Check Command
an asset is the bytes this workflow produced, offline cosign verify-blob --bundle <asset>.sigstore.json --certificate-identity-regexp '^https://github.com/telekom/sutura/' --certificate-oidc-issuer https://token.actions.githubusercontent.com <asset>
the same, against this forge gh attestation verify <asset> --repo telekom/sutura
an image is the one this workflow pushed cosign verify ghcr.io/telekom/sutura@<digest> --certificate-identity-regexp '^https://github.com/telekom/sutura/' --certificate-oidc-issuer https://token.actions.githubusercontent.com
what is inside an image cosign verify-attestation --type cyclonedx ghcr.io/telekom/sutura@<digest> --certificate-identity-regexp '^https://github.com/telekom/sutura/' --certificate-oidc-issuer https://token.actions.githubusercontent.com
the licence statement is the release's, offline cosign verify-blob --bundle sutura-attribution.md.sigstore.json --certificate-identity-regexp '^https://github.com/telekom/sutura/' --certificate-oidc-issuer https://token.actions.githubusercontent.com sutura-attribution.md
what any of it means Verifying a release
Loading

v0.8.0-performance

v0.8.0-performance Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Oct 14:07
Immutable release. Only release title and notes can be modified.
v0.8.0-performance
e61fac9

The release-performance build of v0.8.0: the same commit, fat LTO and one codegen unit, no target-cpu=native. The change list, the licence statement and the chart are on that release.

Images

Variant Tag Platforms
glibc ghcr.io/telekom/sutura:0.8.0-performance linux/amd64, linux/arm64
static musl ghcr.io/telekom/sutura:0.8.0-performance-musl linux/amd64, linux/arm64 
# kind name reference@digest
# list = multi-arch manifest list; pin this unless you want one architecture
# leaf = single-arch image, named by its binary key and rust target triple
leaf x86_64-unknown-linux-gnu-performance ghcr.io/telekom/sutura@sha256:c95838fa714c01cb50b86546578f3e43d8544760668d093bd512e3cad37c3142
leaf aarch64-unknown-linux-gnu-performance ghcr.io/telekom/sutura@sha256:6984169f5701b3435167456a595033bdfe0ada55f86818616bf07febd1e86f4a
leaf x86_64-unknown-linux-musl-performance ghcr.io/telekom/sutura@sha256:7d63a6ffa00c2e3b254441ff19081c651b1f45bfa8b4a9908bb8f3b6c87ffeb4
leaf aarch64-unknown-linux-musl-performance ghcr.io/telekom/sutura@sha256:579bc125532448b7fafbbe05d49fb9a73e2af46ab67b6907ef367a411011978c
list glibc ghcr.io/telekom/sutura@sha256:0cf81efc26add4a327090966fce0ffa9d88f1450bf9cc0b006d5a1dad8f5ea68
list musl ghcr.io/telekom/sutura@sha256:2026549a792ea9c77a6d1ea7bc7feecc4ccc1056af66ccce1342d6425bb6df5c

The binaries, image tarballs, SBOMs, their .sha256 sidecars and image-digests.txt each have a <asset>.sigstore.json bundle and SLSA provenance in sutura-provenance.intoto.jsonl; the images are signed in the registry. Verifying a release says how to check each, and which identity an optimised asset carries.

Loading

v0.7.0

v0.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Oct 05:48
Immutable release. Only release title and notes can be modified.
v0.7.0
94bc67d

0.7.0 - 2026-10-12

Breaking changes

  • identity: Declare a BigQuery delegation as a list of hops (#1365)
  • exec-oracle: Read Oracle answers as streamed Arrow batches (#1366)
  • exec-clickhouse: Run each query as the verified caller (#1357)
  • cube: A Cube catalog and source, run as each caller (#1352)
  • identity: BigQuery runs as the caller's own WIF principal (#1353)
  • config: One off-host predicate for every caller-facing refusal (#1361)
  • identity: Exchange an Oracle caller's token through ordered hops (#1355)
  • exec-oracle: Vendor a patched Oracle driver and ship the Oracle source (#1330)
  • config: Delete two unread keys, make a dev knob dev-only (#1328)
  • federation: A distinct count across two sources is pulled up, not refused (#1313)
  • catalog-rdbms: The live reader dials through the ADBC connector (#1287)
  • exec-duckdb: Answer over the ADBC driver, delete duckdb-rs (#913) (#1289)
  • causality: Code-only scanning, plus the area-d gating batch (#1276)
  • exec-postgres: Answer every postgres source over ADBC (#913) (#1242)

Features

  • identity: Exchange a BigQuery caller's token through ordered hops (#1367)
  • exec: Read DuckDB and Postgres table schemas through ADBC (#1356)
  • domain: Add the table-schema port and pin its set by the bundle (#1354)
  • semantic: Refuse a federated join whose key types differ (#1349)
  • http: Count each refusal under its own reason (#1346)
  • catalog: Every catalog refreshes every 900 s by default (#1325)
  • semantic: A via chain may cross a data system at any hop (#1339)
  • serve: A question uses the catalog snapshot from the last refresh (#1331)
  • config: Federated answer row ceiling is a setting (#1316)
  • serve: The refresher offers each new bundle to Surface::adopt (#1329)
  • exec-clickhouse: Run each statement as the caller's declared user (#1322)
  • catalog: Page through OpenMetadata and DataHub catalogs (#1323)
  • catalog: A live OpenMetadata tier for the golden catalog (#1318)
  • config: /mcp counts a declared hop or host name as off-host (#1314)
  • Upgrade gh-stack (#1248)
  • config: /mcp without leg 1 on a declared single-user deployment (#1312)
  • A kind: duckdb source with raw SQL, stopped at the deadline (#1298)
  • examples: Multi-player with Keycloak, DataHub and BigQuery (#1302)
  • domain: Knowledge notes on models, columns and relationships (#1306)
  • adbc-postgres: One shared Postgres ADBC connector crate (#1283)
  • adbc: DuckDB as a third linked ADBC driver (#1245)
  • xtask: Causality reads a gate-checked Live-Cell trailer (#1272)
  • exec-postgres: Kerberos sign-in on the linked static libpq (#913) (#1244)
  • serve: Compose the delegation exchange in direct mode (#1258)
  • exec-postgres: The ADBC transport at parity with tokio-postgres (#913) (#1228)
  • identity: A delegation exchange port for direct mode (#1208) (#1219)
  • exec-postgres: The ADBC transport ships, channel enforced, not yet default (#913) (#1204)
  • catalog-local: A cube measure can be a cross-model ratio (#1148, PR 4) (#1201)
  • demo: Just demo-mcp serves /mcp behind the dev Keycloak tier (#63) (#1192)
  • exec: Link the PostgreSQL ADBC driver statically on musl (#913) (#1196)
  • catalog-wren: Convert_cubes emits kind: cube and refuses a dropped time dimension (#1148, PR 2) (#1193)
  • domain: Refuse an anchor on a cross-model ratio at load (#780, PR 5) (#1194)
  • catalog-local: A cube document expands to one metric per measure (#1148, PR 1) (#1189)
  • exec: PostgreSQL over the shared ADBC crate, behind a default-off feature (#913) (#1182)
  • catalog: Read an Oracle documentation schema (#972, PR 2) (#1165)
  • exec: The raw SQL path carries the caller's per-request deadline (#1144) (#1162)
  • semantic: A cross-model ratio plans as two fact statements through one calendar (#780) (#1158)
  • catalog: Parse an Oracle dictionary connection (#972, PR 1) (#1160)
  • mcp: List the scoped physical schema when enabled (#1145)
  • exec: One shared ADBC crate holds every unsafe FFI call (#913) (#1146)

Fixes

  • runtime: Keep source passwords out of every reply and log line (#1368)
  • http: Spend one rate-limit bucket across /v1 and /mcp (#1363)
  • exec-oracle: Keep the time of day of a DATE (#1362)
  • xtask: Read compound amendment ordinals (#1360)
  • ci: Ship-check and ci-aggregate gate what they skipped (#1327)
  • xtask: Report a failing and an unstartable docker apart (#1315)
  • http: The catalog carries the caller's knowledge, as MCP does (#1305)
  • http: /mcp gets the same layers as /v1, and one Host list (#1308)
  • One CLI digest per catalog, quiet EPIPE, a sutura-dev package (#1300)
  • nix: Link BigQuery and preset PostgreSQL drivers on darwin (#1299)
  • gates: Ban tokio-postgres from the shipped binary, one falsifier cell per gate, Kerberos on one thread (#1303)
  • catalog-local: A tree states its declaration, wren writes one (#1288)
  • exec-bigquery: A driver error never renders its console job link (#1284)
  • xtask: Causality refuses an added test with no base result (#1268)
  • http-client: Show refused endpoints without userinfo (#1265)
  • ci: Judge the PR title in a required pr-title workflow (#1257)
  • xtask: Causality proves each added test red on base (#1243)
  • xtask: Hold shipped adapter requirements in required list (#1252)
  • http-client: Route loopback requests directly (#1235)
  • xtask: Derive catalog scope from workspace members (#1221)
  • xtask: Guidance absences read through the census text (#414) (#1226)
  • causality: Tier-backed claim cells are attested against a nix Postgres (#1195)
  • causality: Rolling cluster B part 2 - manifest restore, NoTier, refuse untrailered claim patches, name a cfg gate, modified-test Claim-Cell prose (#1188)
  • tls: A refused client key names only what was checked, and exec-area cells (#1183)
  • gates: Rolling cluster B - Oracle tier, push ci, cachix refusal (#1171)
  • gates: Rolling cluster - orphaned claim patches refused, dev tooling, adapter mutation attribution, ignored helpers (#1161)
  • release: A version bump cannot drift the fuzz lock or publish an unformatted changelog (#1157)

Refactoring

  • oracle: One packet-trace refusal for source and catalog reader (#1351)
  • domain: A lookup leg reads a checked set of tables (#1338)
  • Allocation sweep, part 2 (#1214) (#1304)
  • cli: The refresher reads its digest from the watch channel (#1301)
  • cli: Log the old digest before replacing it (#1256)

Documentation

  • catalog: Show the refresh interval on each catalog page (#1359)
  • adr: Federate with DataFusion for the SQL tool and the metrics (#1350)
  • chart: Concise chart page and its Artifact Hub metadata (#1347)
  • Shorter SECURITY.md, the #140 record and docs fixes (#1345)
  • One deployment diagram (#1343)
  • Shorter serving and questions pages (#1337)
  • Logos, foldable integration groups, shorter worktrees section (#1333)
  • Drop proof and limit text from published pages (#1334)
  • Architecture identity legs and a deployment view (#1335)
  • ADRs off the site, integrations index, STE pages, embed check (#1324)
  • Tabs, one page per adapter, archify architecture diagram (#1317)
  • Sweep stale statements and add a log format how-to (#1309)
  • Concise install and single-player pages (#1296)
  • State each source's sign-in identity and its limit (#1262)
  • ADR citations and nextest ceiling clarity (#1241)
  • ADR current-state claims match what is built (#949) (#1234)
  • http: The trusted-proxy list is shared per request, not per connection (#1214) (#1223)
  • A README for what is built today (#1215) (#1225)
  • Per-request deadlines are described as built (#1216)
  • An ADR for cube documents (#1148, PR 3) (#1191)
  • Correct stale prose, ADR knowledge channels, the #1151 follow-up and a Claim-Cell guide (#1173)

Tests

  • http: Wait for the held question instead of sleeping (#1364)
  • http: Hold too_many_filters in the refusal table and counter (#1348)
  • bounds: A federated two-source bench beside answer_path (#1311)
  • Compound gates and postgres deadline cells prove their own rule (#1286)
  • app: The whole golden corpus runs on the live BigQuery dataset (#1282)
  • serve: The delegation exchange in a spawned sutura binary with the ADBC driver (#1281)
  • app: Run the golden bigquery row against a real dataset (#1264)
  • http-client: Bound FakeServer::finish so an undialled cell fails (#1275)
  • catalog-datahub: The golden catalog round trips a live DataHub (#1273)
  • serve: The delegation exchange behind the served HTTP surface (#1269)
  • conformance: Register wren in the METADATA catalog matrix (#1267)
  • catalog-datahub: Live dataset and relationship page cells (#1251) (#1260)
  • xtask: The falsifier sweep reaches check-catalog-opened-once (#1233)
  • catalog-rdbms: Live Oracle cells for the catalog reader (#1232)
  • Wall-clock cells wait on events, not speed (v2) (#1224)
  • catalog-rdbms: Golden the Oracle reader's assembled output (#972) (#1200)
  • conformance: The two-fact ratio per dialect and executed (#780) (#1184)
  • catalog-rdbms: Pin the conversion's content and the Oracle accessors (#1185)
  • Serialise the real-cargo fixtures and warm the demo xtask build (#1177)
  • served: A datahub catalog lists its declared version (#970) (#1176)
  • catalog: Provoke the catalog and bounded-read refusals no cell reached (#1174)
  • mcp: An rdbms catalog boots and lists over stdio (#970) (#1164)

Build

  • chart: Register the chart on Artifact Hub (#1336)
  • Ship the RDBMS catalog (#1321)
  • Tests leave the commit hook; nextest stopgap ceilings (#1297)
  • Ship the ClickHouse adapter (#1237)
  • Utoipa 6, utoipa-axum 0.3, utoipa-swagger-ui 10 (#1205)
  • Bump getrandom in / (#1207)
  • Bump rmcp in / (#1206)
  • ci: Group ...
Read more
Loading

v0.6.1

v0.6.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Sep 17:02
Immutable release. Only release title and notes can be modified.
v0.6.1
44f3f42

0.6.1 - 2026-09-28

Fixes

  • release: Keep fuzz/Cargo.lock and the changelog in step with the version bump (#1150)

Documentation

  • examples: Package the demo as an example, compose-first single-player, exempt the changelog (#1151)

Tests

  • served: An rdbms catalog boots and lists; two composition refusals name the field (#1147)

Artifacts

Binaries

Binary Target Asset Size Linking
sutura x86_64-unknown-linux-gnu sutura-x86_64-unknown-linux-gnu.tar.gz 41.7MiB dynamic (glibc)
sutura aarch64-unknown-linux-gnu sutura-aarch64-unknown-linux-gnu.tar.gz 37.6MiB dynamic (glibc)
sutura x86_64-unknown-linux-musl sutura-x86_64-unknown-linux-musl.tar.gz 42.6MiB static, no libc
sutura aarch64-unknown-linux-musl sutura-aarch64-unknown-linux-musl.tar.gz 36.5MiB static, no libc

Images

Image Variant Tag Platforms
sutura glibc (the default) ghcr.io/telekom/sutura:0.6.1, ghcr.io/telekom/sutura:latest linux/amd64, linux/arm64
sutura static musl ghcr.io/telekom/sutura:0.6.1-musl, ghcr.io/telekom/sutura:latest-musl linux/amd64, linux/arm64
Variant Pull by digest
glibc docker pull ghcr.io/telekom/sutura@sha256:910c59aa60f346d3adb6e14e690931a8c2c52da337783bdfa372e3f9215c8569
musl docker pull ghcr.io/telekom/sutura@sha256:e2356f115ab4470a5b44239ec650700b432bd91087d1738d70e0d73df94fa796
Leaf Tag Pull by digest
x86_64-unknown-linux-gnu ghcr.io/telekom/sutura:0.6.1-x86_64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:a8057bd094be3ae6d042b00520d155e3a1af685abd5fb1abb92e885c4663f344
aarch64-unknown-linux-gnu ghcr.io/telekom/sutura:0.6.1-aarch64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:93a8396e97afce820f24b826ea4bf59dbf75c89d7e55a717656d17633908e42a
x86_64-unknown-linux-musl ghcr.io/telekom/sutura:0.6.1-x86_64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:1609746e34f1e66ce995aeac0c2b61be0e6b6156b92178c984879f81ba976d56
aarch64-unknown-linux-musl ghcr.io/telekom/sutura:0.6.1-aarch64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:c303b5b15e66cf43b7a44e5158fbcd2f7820df03b869023e20b8fde2efa53448
Loadable image tarball Size
sutura-oci-aarch64-unknown-linux-musl.tar.gz 37.3MiB
sutura-oci-x86_64-unknown-linux-musl.tar.gz 43.2MiB

Software bill of materials

Image CycloneDX SPDX
x86_64-unknown-linux-gnu sutura-oci-x86_64-unknown-linux-gnu.cdx.json sutura-oci-x86_64-unknown-linux-gnu.spdx.json
aarch64-unknown-linux-gnu sutura-oci-aarch64-unknown-linux-gnu.cdx.json sutura-oci-aarch64-unknown-linux-gnu.spdx.json
x86_64-unknown-linux-musl sutura-oci-x86_64-unknown-linux-musl.cdx.json sutura-oci-x86_64-unknown-linux-musl.spdx.json
aarch64-unknown-linux-musl sutura-oci-aarch64-unknown-linux-musl.cdx.json sutura-oci-aarch64-unknown-linux-musl.spdx.json
Covers Read from
the files in the image: the binary, CA certificates, tzdata the image layers
the crates the binary was compiled from a cargo auditable section inside the binary, not from Cargo.lock

Licence

Document Covers
sutura-attribution.md every third-party crate this workspace resolves and the licence it declares; generated by cargo metadata from the Cargo.lock of this tag, never committed

Provenance and signatures

Artefact Sigstore bundle SLSA provenance Registry signature
binaries, image tarballs, SBOMs, the two licence documents, image-digests.txt <asset>.sigstore.json, attached yes n/a
the .sha256 sidecars no: the bundle above already commits to the digest yes n/a
images, four leaves and two manifest lists n/a the two manifest lists cosign, all six references
each leaf image's CycloneDX SBOM n/a n/a cosign attest --type cyclonedx
Check Command
an asset is the bytes this workflow produced, offline cosign verify-blob --bundle <asset>.sigstore.json --certificate-identity-regexp '^https://github.com/telekom/sutura/' --certificate-oidc-issuer https://token.actions.githubusercontent.com <asset>
the same, against this forge gh attestation verify <asset> --repo telekom/sutura
an image is the one this workflow pushed cosign verify ghcr.io/telekom/sutura@<digest> --certificate-identity-regexp '^https://github.com/telekom/sutura/' --certificate-oidc-issuer https://token.actions.githubusercontent.com
what is inside an image cosign verify-attestation --type cyclonedx ghcr.io/telekom/sutura@<digest> --certificate-identity-regexp '^https://github.com/telekom/sutura/' --certificate-oidc-issuer https://token.actions.githubusercontent.com
the licence statement is the release's, offline cosign verify-blob --bundle sutura-attribution.md.sigstore.json --certificate-identity-regexp '^https://github.com/telekom/sutura/' --certificate-oidc-issuer https://token.actions.githubusercontent.com sutura-attribution.md
what any of it means Verifying a release
Loading

v0.5.1

v0.5.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Sep 09:06
Immutable release. Only release title and notes can be modified.
v0.5.1
7b69cd4

0.5.1 - 2026-09-11

Fixes

  • release: Read the image-record header and untagged list reference (#596)

Performance

  • ci: Read the cachix stores in docs, and free two paid jobs (#594)

Artifacts

Binaries

Binary Target Asset Size Linking
sutura x86_64-unknown-linux-gnu sutura-x86_64-unknown-linux-gnu.tar.gz 20.7MiB dynamic (glibc)
sutura aarch64-unknown-linux-gnu sutura-aarch64-unknown-linux-gnu.tar.gz 18.6MiB dynamic (glibc)
sutura x86_64-unknown-linux-musl sutura-x86_64-unknown-linux-musl.tar.gz 21.2MiB static, no libc
sutura aarch64-unknown-linux-musl sutura-aarch64-unknown-linux-musl.tar.gz 18.2MiB static, no libc
sutura-serve x86_64-unknown-linux-gnu sutura-serve-x86_64-unknown-linux-gnu.tar.gz 21.2MiB dynamic (glibc)
sutura-serve aarch64-unknown-linux-gnu sutura-serve-aarch64-unknown-linux-gnu.tar.gz 19.0MiB dynamic (glibc)
sutura-serve x86_64-unknown-linux-musl sutura-serve-x86_64-unknown-linux-musl.tar.gz 21.7MiB static, no libc
sutura-serve aarch64-unknown-linux-musl sutura-serve-aarch64-unknown-linux-musl.tar.gz 18.6MiB static, no libc

Images

Image Variant Tag Platforms
sutura glibc (the default) ghcr.io/telekom/sutura:0.5.1, ghcr.io/telekom/sutura:latest linux/amd64, linux/arm64
sutura static musl ghcr.io/telekom/sutura:0.5.1-musl, ghcr.io/telekom/sutura:latest-musl linux/amd64, linux/arm64
sutura-serve glibc (the default) ghcr.io/telekom/sutura:0.5.1-serve, ghcr.io/telekom/sutura:latest-serve linux/amd64, linux/arm64
sutura-serve static musl ghcr.io/telekom/sutura:0.5.1-serve-musl, ghcr.io/telekom/sutura:latest-serve-musl linux/amd64, linux/arm64
Variant Pull by digest
glibc docker pull ghcr.io/telekom/sutura@sha256:306fd95b5d4dc2f8607296e4828a39747ac306c9f44631f58173a56801bfa2c5
musl docker pull ghcr.io/telekom/sutura@sha256:8caedf63f9e4513d47985c6e7d1a6d162af3b7e4f660009a33a05f3ce4b01e13
serve-glibc docker pull ghcr.io/telekom/sutura@sha256:9a93ae3c3d96d3e6f4ae87bd32dfc3448f9f6b7204aaa143266db535823c159b
serve-musl docker pull ghcr.io/telekom/sutura@sha256:c1a2922d3209e250657dfd9b76fe9702a7c92ebcac57e907efc1419e52ec9ffd
Leaf Tag Pull by digest
x86_64-unknown-linux-gnu ghcr.io/telekom/sutura:0.5.1-x86_64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:68d5e03f12531d5d4488d0dd52fcb4009ddc3d83faf4ef6fce4c377fbfbabf57
serve-x86_64-unknown-linux-gnu ghcr.io/telekom/sutura:0.5.1-serve-x86_64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:2cb7860cac967f136f2f6e4762327954edc904fc3183ae6aee8e7711902ac5fa
aarch64-unknown-linux-gnu ghcr.io/telekom/sutura:0.5.1-aarch64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:89d51086750de53d4f14354dbd0f4d269fd20f6bad8572acb0e4391dcfce8479
serve-aarch64-unknown-linux-gnu ghcr.io/telekom/sutura:0.5.1-serve-aarch64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:33ecdb12b1fafa6da414a754fa1c98274414b9651adf3fd72b7870532f26f9b6
x86_64-unknown-linux-musl ghcr.io/telekom/sutura:0.5.1-x86_64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:81492ffef7b815db6c0a6d7856c5b230bf64d1f16ede865a8af3e30c16e4d83e
serve-x86_64-unknown-linux-musl ghcr.io/telekom/sutura:0.5.1-serve-x86_64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:8060ebdaa5189510c6ab049960f634e070f95aea06df2a7b3978e45c8a701d72
aarch64-unknown-linux-musl ghcr.io/telekom/sutura:0.5.1-aarch64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:8bc5f8f9c2dae9fb04ba3d312ac7f863796655ca3611940074d3f13b12b183c5
serve-aarch64-unknown-linux-musl ghcr.io/telekom/sutura:0.5.1-serve-aarch64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:2a1527707cb8ebc15856d75c0230de4cee340a780a5da8e77dd6b4d1b23db9fd
Loadable image tarball Size
sutura-oci-aarch64-unknown-linux-musl.tar.gz 18.9MiB
sutura-oci-serve-aarch64-unknown-linux-musl.tar.gz 19.3MiB
sutura-oci-serve-x86_64-unknown-linux-musl.tar.gz 22.3MiB
sutura-oci-x86_64-unknown-linux-musl.tar.gz 21.8MiB

Software bill of materials

Image CycloneDX SPDX
x86_64-unknown-linux-gnu sutura-oci-x86_64-unknown-linux-gnu.cdx.json sutura-oci-x86_64-unknown-linux-gnu.spdx.json
aarch64-unknown-linux-gnu sutura-oci-aarch64-unknown-linux-gnu.cdx.json sutura-oci-aarch64-unknown-linux-gnu.spdx.json
x86_64-unknown-linux-musl sutura-oci-x86_64-unknown-linux-musl.cdx.json sutura-oci-x86_64-unknown-linux-musl.spdx.json
aarch64-unknown-linux-musl sutura-oci-aarch64-unknown-linux-musl.cdx.json sutura-oci-aarch64-unknown-linux-musl.spdx.json
serve-x86_64-unknown-linux-gnu sutura-oci-serve-x86_64-unknown-linux-gnu.cdx.json sutura-oci-serve-x86_64-unknown-linux-gnu.spdx.json
serve-aarch64-unknown-linux-gnu sutura-oci-serve-aarch64-unknown-linux-gnu.cdx.json sutura-oci-serve-aarch64-unknown-linux-gnu.spdx.json
serve-x86_64-unknown-linux-musl sutura-oci-serve-x86_64-unknown-linux-musl.cdx.json sutura-oci-serve-x86_64-unknown-linux-musl.spdx.json
serve-aarch64-unknown-linux-musl sutura-oci-serve-aarch64-unknown-linux-musl.cdx.json sutura-oci-serve-aarch64-unknown-linux-musl.spdx.json
Covers Read from
the files in the image: the binary, CA certificates, tzdata the image layers
the crates the binary was compiled from a cargo auditable section inside the binary, not from Cargo.lock

Licence

Document Covers
sutura-attribution.md every third-party crate this workspace resolves and the licence it declares; generated by cargo metadata from the Cargo.lock of this tag, never committed

Provenance and signatures

Artefact Sigstore bundle SLSA provenance Registry signature
binaries, image tarballs, SBOMs, the two licence documents, image-digests.txt <asset>.sigstore.json, attached yes n/a
the .sha256 sidecars no: the bundle above already commits to the digest yes n/a
images, eight leaves and four manifest lists n/a the four manifest lists cosign, all twelve references
each leaf image's CycloneDX SBOM n/a n/a cosign attest --type cyclonedx
Check Command
an asset is the bytes this workflow produced, offline `cosign verify-blob --bundle .sigstore.json...
Read more
Loading

v0.4.1

v0.4.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Sep 19:55
Immutable release. Only release title and notes can be modified.
v0.4.1
59ae629

0.4.1 - 2026-09-01

Fixes

  • release: Create the licence artifact directory (#188)

Artifacts

Binaries

Binary Target Asset Size Linking
sutura x86_64-unknown-linux-gnu sutura-x86_64-unknown-linux-gnu.tar.gz 19.8MiB dynamic (glibc)
sutura aarch64-unknown-linux-gnu sutura-aarch64-unknown-linux-gnu.tar.gz 17.7MiB dynamic (glibc)
sutura x86_64-unknown-linux-musl sutura-x86_64-unknown-linux-musl.tar.gz 20.4MiB static, no libc
sutura aarch64-unknown-linux-musl sutura-aarch64-unknown-linux-musl.tar.gz 17.5MiB static, no libc
sutura-serve x86_64-unknown-linux-gnu sutura-serve-x86_64-unknown-linux-gnu.tar.gz 21.1MiB dynamic (glibc)
sutura-serve aarch64-unknown-linux-gnu sutura-serve-aarch64-unknown-linux-gnu.tar.gz 18.9MiB dynamic (glibc)
sutura-serve x86_64-unknown-linux-musl sutura-serve-x86_64-unknown-linux-musl.tar.gz 21.7MiB static, no libc
sutura-serve aarch64-unknown-linux-musl sutura-serve-aarch64-unknown-linux-musl.tar.gz 18.6MiB static, no libc

Images

Image Variant Tag Platforms
sutura glibc (the default) ghcr.io/telekom/sutura:0.4.1, ghcr.io/telekom/sutura:latest linux/amd64, linux/arm64
sutura static musl ghcr.io/telekom/sutura:0.4.1-musl, ghcr.io/telekom/sutura:latest-musl linux/amd64, linux/arm64
sutura-serve glibc (the default) ghcr.io/telekom/sutura:0.4.1-serve, ghcr.io/telekom/sutura:latest-serve linux/amd64, linux/arm64
sutura-serve static musl ghcr.io/telekom/sutura:0.4.1-serve-musl, ghcr.io/telekom/sutura:latest-serve-musl linux/amd64, linux/arm64
Variant Pull by digest
glibc docker pull ghcr.io/telekom/sutura@sha256:64605745ff9125c7f10196cd5518ecfb3913b4140255975aa9957a50c2fa066e
musl docker pull ghcr.io/telekom/sutura@sha256:c993f326f4f3355688681a24c1714678895c5d6a5e12e8aada7b55c45d05df7d
serve-glibc docker pull ghcr.io/telekom/sutura@sha256:f5a7dc92ce5a4cf2dfd5448245bb5293eb3faa2fded55b86b261987349751863
serve-musl docker pull ghcr.io/telekom/sutura@sha256:1fe1747b243cfd61c05cacf7d84c6e79f259fca0ce5fc87859c97ee5363d6fbf
Leaf Tag Pull by digest
x86_64-unknown-linux-gnu ghcr.io/telekom/sutura:0.4.1-x86_64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:64068dfbf4b30128e37af850df8d74a9a73b718b03b37b83b88fa64cb70b0a23
serve-x86_64-unknown-linux-gnu ghcr.io/telekom/sutura:0.4.1-serve-x86_64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:a7adbf0fd33208eeb2a2ab562e7d8301d0541576e490288578f548b6f9b9e46c
aarch64-unknown-linux-gnu ghcr.io/telekom/sutura:0.4.1-aarch64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:2aeb5b6b7937d50df1816a759cf7ed737ca2fd08a6c45d94c72e28c9f6d3c3c1
serve-aarch64-unknown-linux-gnu ghcr.io/telekom/sutura:0.4.1-serve-aarch64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:3730923447e606b3838acdafe7e7b13473b5cecee86cf68eed77ae9ef54b6224
x86_64-unknown-linux-musl ghcr.io/telekom/sutura:0.4.1-x86_64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:b441e10c8b1f9f5a1d76411c594f706308d10c6d0f636f04196282070803f5c3
serve-x86_64-unknown-linux-musl ghcr.io/telekom/sutura:0.4.1-serve-x86_64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:4875db7def2b7e984af363661ae3c6710c77b2d2e27c377811d46b2c39157809
aarch64-unknown-linux-musl ghcr.io/telekom/sutura:0.4.1-aarch64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:e15fd4502f51e5e1d173a5d89790c031584685349ba92b6a5a702c4f6c3a2603
serve-aarch64-unknown-linux-musl ghcr.io/telekom/sutura:0.4.1-serve-aarch64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:0de358bff214bb484a364505597c0a1959f3fad44d67f6c600c8edb2e5a75092
Loadable image tarball Size
sutura-oci-aarch64-unknown-linux-musl.tar.gz 18.2MiB
sutura-oci-serve-aarch64-unknown-linux-musl.tar.gz 19.2MiB
sutura-oci-serve-x86_64-unknown-linux-musl.tar.gz 22.3MiB
sutura-oci-x86_64-unknown-linux-musl.tar.gz 21.0MiB

Software bill of materials

Image CycloneDX SPDX
x86_64-unknown-linux-gnu sutura-oci-x86_64-unknown-linux-gnu.cdx.json sutura-oci-x86_64-unknown-linux-gnu.spdx.json
aarch64-unknown-linux-gnu sutura-oci-aarch64-unknown-linux-gnu.cdx.json sutura-oci-aarch64-unknown-linux-gnu.spdx.json
x86_64-unknown-linux-musl sutura-oci-x86_64-unknown-linux-musl.cdx.json sutura-oci-x86_64-unknown-linux-musl.spdx.json
aarch64-unknown-linux-musl sutura-oci-aarch64-unknown-linux-musl.cdx.json sutura-oci-aarch64-unknown-linux-musl.spdx.json
serve-x86_64-unknown-linux-gnu sutura-oci-serve-x86_64-unknown-linux-gnu.cdx.json sutura-oci-serve-x86_64-unknown-linux-gnu.spdx.json
serve-aarch64-unknown-linux-gnu sutura-oci-serve-aarch64-unknown-linux-gnu.cdx.json sutura-oci-serve-aarch64-unknown-linux-gnu.spdx.json
serve-x86_64-unknown-linux-musl sutura-oci-serve-x86_64-unknown-linux-musl.cdx.json sutura-oci-serve-x86_64-unknown-linux-musl.spdx.json
serve-aarch64-unknown-linux-musl sutura-oci-serve-aarch64-unknown-linux-musl.cdx.json sutura-oci-serve-aarch64-unknown-linux-musl.spdx.json
Covers Read from
the files in the image: the binary, CA certificates, tzdata the image layers
the crates the binary was compiled from a cargo auditable section inside the binary, not from Cargo.lock

Licence

Document Covers
sutura-attribution.md every third-party crate this workspace resolves and the licence it declares; committed, generated from cargo metadata

Provenance and signatures

Artefact Sigstore bundle SLSA provenance Registry signature
binaries, image tarballs, SBOMs, the two licence documents, image-digests.txt <asset>.sigstore.json, attached yes n/a
the .sha256 sidecars no: the bundle above already commits to the digest yes n/a
images, eight leaves and four manifest lists n/a the four manifest lists cosign, all twelve references
each leaf image's CycloneDX SBOM n/a n/a cosign attest --type cyclonedx
Check Command
an asset is the bytes this workflow produced, offline cosign verify-blob --bundle <asset>.sigstore.json --certificate-identity-regexp '^https://github.com/telekom/sutura/' --certificate-oidc-issuer https://token.actions.githubusercontent.com <asset>...
Read more
Loading

v0.2.4

v0.2.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Aug 12:03
Immutable release. Only release title and notes can be modified.
v0.2.4
aa99937

0.2.4 - 2026-08-25

Fixes

  • ci: The prune's own display line failed the workflow

Performance

  • ci: A profile for the link check, tuned for compile speed

CI

  • Delete the caches of closed pull requests, weekly
  • release: Cut releases on request, not on every push

Artifacts

Binaries

Target Asset Size Linking
x86_64-unknown-linux-gnu sutura-x86_64-unknown-linux-gnu.tar.gz 213.8KiB dynamic (glibc)
aarch64-unknown-linux-gnu sutura-aarch64-unknown-linux-gnu.tar.gz 208.5KiB dynamic (glibc)
x86_64-unknown-linux-musl sutura-x86_64-unknown-linux-musl.tar.gz 264.0KiB static, no libc
aarch64-unknown-linux-musl sutura-aarch64-unknown-linux-musl.tar.gz 254.1KiB static, no libc

Images

Variant Tag Platforms
glibc (the default) ghcr.io/telekom/sutura:0.2.4, ghcr.io/telekom/sutura:latest linux/amd64, linux/arm64
static musl ghcr.io/telekom/sutura:0.2.4-musl, ghcr.io/telekom/sutura:latest-musl linux/amd64, linux/arm64
Variant Pull by digest
glibc docker pull ghcr.io/telekom/sutura@sha256:ef0d68d5f5767ff762007db97ea3c9a56e82a230464de57d4dec243589b5af79
musl docker pull ghcr.io/telekom/sutura@sha256:8915b66c1d415faeaf0627f05eb4093a1ad645c68b0bbc5b3fac57ac77250da7
Target Tag Pull by digest
x86_64-unknown-linux-gnu ghcr.io/telekom/sutura:0.2.4-x86_64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:59882d6d3325eb5855be5f24160fa75304a7d8da6dfdd8ffe92073fb69a87ec7
aarch64-unknown-linux-gnu ghcr.io/telekom/sutura:0.2.4-aarch64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:322fdcbdfaf6a7f24fcaeec64d1e596a452f2b4f9bf1c6713301a1de8c4ccaba
x86_64-unknown-linux-musl ghcr.io/telekom/sutura:0.2.4-x86_64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:00e2dc8db883336de7a72e742bfbd82b2888e268fc2b21403bb7e5fb9467bdfa
aarch64-unknown-linux-musl ghcr.io/telekom/sutura:0.2.4-aarch64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:d78bf4487a4f66c02b30f8ad0665008641337f621da3deaebd8c258c73851bf2
Loadable image tarball Size
sutura-oci-aarch64-unknown-linux-musl.tar.gz 1014.5KiB
sutura-oci-x86_64-unknown-linux-musl.tar.gz 1023.6KiB
Loading

v0.2.3

v0.2.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Aug 10:35
Immutable release. Only release title and notes can be modified.
v0.2.3
ce17a28

0.2.3 - 2026-08-25

Documentation

  • The end-user pages stop routing contributors
  • release: The notes are tables, and nothing else

Artifacts

Binaries

Target Asset Size Linking
x86_64-unknown-linux-gnu sutura-x86_64-unknown-linux-gnu.tar.gz 213.8KiB dynamic (glibc)
aarch64-unknown-linux-gnu sutura-aarch64-unknown-linux-gnu.tar.gz 208.5KiB dynamic (glibc)
x86_64-unknown-linux-musl sutura-x86_64-unknown-linux-musl.tar.gz 264.0KiB static, no libc
aarch64-unknown-linux-musl sutura-aarch64-unknown-linux-musl.tar.gz 254.1KiB static, no libc

Images

Variant Tag Platforms
glibc (the default) ghcr.io/telekom/sutura:0.2.3, ghcr.io/telekom/sutura:latest linux/amd64, linux/arm64
static musl ghcr.io/telekom/sutura:0.2.3-musl, ghcr.io/telekom/sutura:latest-musl linux/amd64, linux/arm64
Variant Pull by digest
glibc docker pull ghcr.io/telekom/sutura@sha256:97e62248cf3326f40158dceed481a1cbd404db5bbb36929fef3f9d6fd9540a21
musl docker pull ghcr.io/telekom/sutura@sha256:752120081c80f668b6dc5861b1bdb46d741f055bfe50c962c284cc8a9a3c08eb
Target Tag Pull by digest
x86_64-unknown-linux-gnu ghcr.io/telekom/sutura:0.2.3-x86_64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:843abf30243abca7b79a57bceded35e0d4ef4aaeb74f7b191ad1721de071b9e6
aarch64-unknown-linux-gnu ghcr.io/telekom/sutura:0.2.3-aarch64-unknown-linux-gnu docker pull ghcr.io/telekom/sutura@sha256:ed9247c6ffc79581f0d29ed1f44d577fd62fa88ba199171a7d3e93319443aaf7
x86_64-unknown-linux-musl ghcr.io/telekom/sutura:0.2.3-x86_64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:0f8f0326e9b941e7ad0c2bc8a5ee0a3c1c1c9a9be407b0c5cd9919da320954d0
aarch64-unknown-linux-musl ghcr.io/telekom/sutura:0.2.3-aarch64-unknown-linux-musl docker pull ghcr.io/telekom/sutura@sha256:4b93bc33f6e8d6c8697da5b64ae55be0a5a6558d9fd41480aebf42dc78265d65
Loadable image tarball Size
sutura-oci-aarch64-unknown-linux-musl.tar.gz 1014.5KiB
sutura-oci-x86_64-unknown-linux-musl.tar.gz 1023.6KiB
Loading