Skip to content

v0.36.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Oct 08:03
· 65 commits to main since this release
v0.36.2
This tag was signed with the committer’s verified signature.
tmatens Todd Matens
SSH Key Fingerprint: osV/HmharyjeoCfWCOUKD87D7O5kF+mTbDgqtfs9ezc
Verified
Learn about vigilant mode.
dbe32d8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixed

  • The release SBOM names the package. The SPDX document attached to
    each GitHub Release as the bill of materials for the wheel and sdist
    listed one package, the dist/ directory, because syft's directory scan
    does not open an archive; every release through 0.36.1 shipped that. It
    is now generated from the unpacked distributions with syft's Python
    catalogers, so it carries compose-lint at the released version, its
    licence, its PyPI purl and the dependencies the wheel declares, and the
    release fails if that record is missing. Earlier releases' SBOM assets
    are unchanged.
Assets 10
Loading