Releases: zegit-zoo/zg
Release list
v0.0.174
Changelog
Documentation
- 4562722 docs(site): fix the GitHub App guide's dead link into the private source repo
Verifying this release
Signed with the Control Plane's artifact key, not with a keyless
Sigstore identity.
curl -fsSO https://zegit.io/signing/artifact-key
cosign verify-blob --key artifact-key \
--signature <checksums>.sig --insecure-ignore-tlog <checksums>
sha256sum -c <checksums> --ignore-missingThe signature covers the checksums file; the checksums cover every
archive. --insecure-ignore-tlog is required because a key-based
signature is not logged in Rekor. zg update runs the same check.
v0.0.173
Changelog
Bug Fixes
- 7946243 fix(web): credentials page — one row per installation, "last use", retire deleted GitHub App installations
Verifying this release
Signed with the Control Plane's artifact key, not with a keyless
Sigstore identity.
curl -fsSO https://zegit.io/signing/artifact-key
cosign verify-blob --key artifact-key \
--signature <checksums>.sig --insecure-ignore-tlog <checksums>
sha256sum -c <checksums> --ignore-missingThe signature covers the checksums file; the checksums cover every
archive. --insecure-ignore-tlog is required because a key-based
signature is not logged in Rekor. zg update runs the same check.
v0.0.172
Changelog
Bug Fixes
- 475be3a fix(audit): offline verify must accept a re-shipped batch
Verifying this release
Signed with the Control Plane's artifact key, not with a keyless
Sigstore identity.
curl -fsSO https://zegit.io/signing/artifact-key
cosign verify-blob --key artifact-key \
--signature <checksums>.sig --insecure-ignore-tlog <checksums>
sha256sum -c <checksums> --ignore-missingThe signature covers the checksums file; the checksums cover every
archive. --insecure-ignore-tlog is required because a key-based
signature is not logged in Rekor. zg update runs the same check.
v0.0.171
Changelog
Features
- 1c8fb52 feat(audit): scheduled offline verification of the shipped audit log
Bug Fixes
- b2d3d19 fix(audit): verify shipped roots in one snapshot, not two reads
- 0eca08e fix(forward): completion applies only to the sha it pushed; zg auth enroll --canary
CI / Ops
- 12e5f7f ci: api-compat gate — the contract cannot narrow between release tags
Verifying this release
Signed with the Control Plane's artifact key, not with a keyless
Sigstore identity.
curl -fsSO https://zegit.io/signing/artifact-key
cosign verify-blob --key artifact-key \
--signature <checksums>.sig --insecure-ignore-tlog <checksums>
sha256sum -c <checksums> --ignore-missingThe signature covers the checksums file; the checksums cover every
archive. --insecure-ignore-tlog is required because a key-based
signature is not logged in Rekor. zg update runs the same check.
v0.0.170
Changelog
Features
- 75726e9 feat(deploy): re-verify running images weekly against the Control Plane's current key
- 415347f feat(gateway): refuse a -dirty producer on the default branch and release tags
- cd59884 feat(metrics): measure gateway push decisions and their latency; make the SLO catalogue say what is measured
Bug Fixes
- 1851e9b fix(bundle): count and verify AoVs on the accepted-evidence clock, and record the first evidence-bundle drill
- 7dc211f fix(zg): evidence bundle exits 20 when commits in the range lack an AoV
CI / Ops
- 2fc6cc8 ci(image-gitea): build once and push the scanned layout byte for byte
- e59dfae ci: read the scheduled-run history with the read PAT, not the job token
- e015188 ci: run the tag-gate selftest on Gitea, alarm on stale scheduled controls, correct the re-scan record
Documentation
- 833e185 docs(records): retire the single-VPS infrastructure record, fix the as-built artifact path, add the trace-back runbook
- ab7cf49 docs: drills record directory and the corrective-action ledger
Verifying this release
Signed with the Control Plane's artifact key, not with a keyless
Sigstore identity.
curl -fsSO https://zegit.io/signing/artifact-key
cosign verify-blob --key artifact-key \
--signature <checksums>.sig --insecure-ignore-tlog <checksums>
sha256sum -c <checksums> --ignore-missingThe signature covers the checksums file; the checksums cover every
archive. --insecure-ignore-tlog is required because a key-based
signature is not logged in Rekor. zg update runs the same check.
v0.0.169
Changelog
Features
- 380fdc9 feat(audit): shipped-root re-verification — the check a database-only rewrite cannot pass
- 4f35f42 feat(cp): server-side sessions — revocable per session, audited, attributed
- cc26d6b feat(forward): propagate branch deletions to the mirrors
Verifying this release
Signed with the Control Plane's artifact key, not with a keyless
Sigstore identity.
curl -fsSO https://zegit.io/signing/artifact-key
cosign verify-blob --key artifact-key \
--signature <checksums>.sig --insecure-ignore-tlog <checksums>
sha256sum -c <checksums> --ignore-missingThe signature covers the checksums file; the checksums cover every
archive. --insecure-ignore-tlog is required because a key-based
signature is not logged in Rekor. zg update runs the same check.
v0.0.168
Changelog
Bug Fixes
- fae374c fix(gateway): push decisions for the legacy repository were refused (400)
Verifying this release
Signed with the Control Plane's artifact key, not with a keyless
Sigstore identity.
curl -fsSO https://zegit.io/signing/artifact-key
cosign verify-blob --key artifact-key \
--signature <checksums>.sig --insecure-ignore-tlog <checksums>
sha256sum -c <checksums> --ignore-missingThe signature covers the checksums file; the checksums cover every
archive. --insecure-ignore-tlog is required because a key-based
signature is not logged in Rekor. zg update runs the same check.
v0.0.167
Changelog
Features
- 2e67eb9 feat(auditlog): security signals — registry, counter, WARN log, critical flush, alerts
- 1453a2e feat(cp): canary automation identities — the first honeytoken
- ace3049 feat(cp): canary enrolment tokens — a leaked invitation that enrols nobody
- 665f4a2 feat(cp): canary forward tokens — a planted token trips wherever it is presented
- 2dbd25d feat(cp): client attribution — trusted-proxy X-Forwarded-For, stamped on security signals
- 8a724c3 feat(cp): credential.rejected — refused credentials become a security signal
- 8588a96 feat(gateway): push verdicts reach the server — hook log tee + gateway.push_* audit events
Documentation
- 9699a05 docs: deception and tripwire design brief (honeytoken audit 2026-09-16)
Verifying this release
Signed with the Control Plane's artifact key, not with a keyless
Sigstore identity.
curl -fsSO https://zegit.io/signing/artifact-key
cosign verify-blob --key artifact-key \
--signature <checksums>.sig --insecure-ignore-tlog <checksums>
sha256sum -c <checksums> --ignore-missingThe signature covers the checksums file; the checksums cover every
archive. --insecure-ignore-tlog is required because a key-based
signature is not logged in Rekor. zg update runs the same check.
v0.0.166
Changelog
Bug Fixes
- 65388bc fix(scripts): integration-rerun-ok in python3 — the runner's awk disagreed with the workstation's
Verifying this release
Signed with the Control Plane's artifact key, not with a keyless
Sigstore identity.
curl -fsSO https://zegit.io/signing/artifact-key
cosign verify-blob --key artifact-key \
--signature <checksums>.sig --insecure-ignore-tlog <checksums>
sha256sum -c <checksums> --ignore-missingThe signature covers the checksums file; the checksums cover every
archive. --insecure-ignore-tlog is required because a key-based
signature is not logged in Rekor. zg update runs the same check.
v0.0.165
Changelog
Bug Fixes
- fce0e51 fix(zg): replace the running binary by rename, never by writing over it
Verifying this release
Signed with the Control Plane's artifact key, not with a keyless
Sigstore identity.
curl -fsSO https://zegit.io/signing/artifact-key
cosign verify-blob --key artifact-key \
--signature <checksums>.sig --insecure-ignore-tlog <checksums>
sha256sum -c <checksums> --ignore-missingThe signature covers the checksums file; the checksums cover every
archive. --insecure-ignore-tlog is required because a key-based
signature is not logged in Rekor. zg update runs the same check.