v0.4.1

ℹ️ This minor release corrects a problem where the naming scheme of the binaries was reversed in v0.4.0, breaking the installer action. No code changes.

What's Changed

• Reverse platform+os naming cheme by @paulinayanez in #349

New Contributors

• @paulinayanez made their first contribution in #349

Full Changelog: v0.4.0...v0.4.1

v0.4.0

What's Changed

• upgrade to go1.23 by @cpanato in #245
• Bump sigs.k8s.io/release-utils from 0.8.4 to 0.8.5 in the all group by @dependabot[bot] in #246
• Bump actions/checkout from 4.1.7 to 4.2.0 in the all group by @dependabot[bot] in #247
• Bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 in the all group by @dependabot[bot] in #249
• Bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 in the all group by @dependabot[bot] in #248
• Bump sigstore/cosign-installer from 3.6.0 to 3.7.0 in the all group by @dependabot[bot] in #250
• Bump the all group with 2 updates by @dependabot[bot] in #251
• Bump actions/upload-artifact from 4.4.1 to 4.4.2 in the all group by @dependabot[bot] in #252
• Bump actions/upload-artifact from 4.4.2 to 4.4.3 in the all group by @dependabot[bot] in #253
• Bump github.com/sigstore/sigstore from 1.8.9 to 1.8.10 in the all group by @dependabot[bot] in #254
• Bump kubernetes-sigs/release-actions from 0.2.0 to 0.3.0 in the all group by @dependabot[bot] in #255
• Bump actions/checkout from 4.2.1 to 4.2.2 in the all group by @dependabot[bot] in #256
• Bump actions/setup-go from 5.0.2 to 5.1.0 in the all group by @dependabot[bot] in #257
• Bump softprops/action-gh-release from 2.0.8 to 2.0.9 in the all group by @dependabot[bot] in #258
• Bump goreleaser/goreleaser-action from 6.0.0 to 6.1.0 in the all group by @dependabot[bot] in #259
• Bump softprops/action-gh-release from 2.0.9 to 2.1.0 in the all group by @dependabot[bot] in #261
• Bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 in the go_modules group by @dependabot[bot] in #260
• Bump the all group with 2 updates by @dependabot[bot] in #263
• Bump golang.org/x/crypto from 0.28.0 to 0.31.0 in the go_modules group by @dependabot[bot] in #264
• Bump actions/upload-artifact from 4.4.3 to 4.5.0 in the all group by @dependabot[bot] in #266
• Bump softprops/action-gh-release from 2.2.0 to 2.2.1 in the all group by @dependabot[bot] in #267
• Bump actions/upload-artifact from 4.5.0 to 4.6.0 in the all group by @dependabot[bot] in #269
• Bump ko-build/setup-ko from 0.7 to 0.8 in the all group by @dependabot[bot] in #270
• Bump go dependencies manually by @puerco in #272
• Bump sigs.k8s.io/release-utils from 0.8.5 to 0.9.0 by @dependabot[bot] in #273
• Bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 in the all group by @dependabot[bot] in #274
• Bump actions/setup-go from 5.2.0 to 5.3.0 in the all group by @dependabot[bot] in #275
• Bump github.com/sigstore/rekor from 1.3.8 to 1.3.9 in the all group by @dependabot[bot] in #276
• Bump sigs.k8s.io/release-utils from 0.9.0 to 0.10.0 by @dependabot[bot] in #277
• Bump golangci/golangci-lint-action from 6.2.0 to 6.3.0 in the all group by @dependabot[bot] in #280
• Bump the all group with 2 updates by @dependabot[bot] in #279
• Bump sigstore/cosign-installer from 3.7.0 to 3.8.0 in the all group by @dependabot[bot] in #281
• Bump golangci/golangci-lint-action from 6.3.0 to 6.3.2 in the all group by @dependabot[bot] in #282
• Bump goreleaser/goreleaser-action from 6.1.0 to 6.2.1 in the all group by @dependabot[bot] in #283
• Bump golangci/golangci-lint-action from 6.3.2 to 6.3.3 in the all group by @dependabot[bot] in #284
• Bump github.com/sigstore/sigstore from 1.8.12 to 1.8.14 in the all group by @dependabot[bot] in #285
• Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by @dependabot[bot] in #286
• Bump golangci/golangci-lint-action from 6.3.3 to 6.5.0 in the all group by @dependabot[bot] in #287
• use go1.24 and update golangci-lint by @cpanato in #288
• Bump the all group with 2 updates by @dependabot[bot] in #289
• Bump sigstore/cosign-installer from 3.8.0 to 3.8.1 in the all group by @dependabot[bot] in #290
• Bump actions/upload-artifact from 4.6.0 to 4.6.1 in the all group by @dependabot[bot] in #291
• Bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 in the go_modules group by @dependabot[bot] in #292
• Bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4 in the go_modules group by @dependabot[bot] in #293
• Bump golang.org/x/net from 0.35.0 to 0.36.0 in the go_modules group by @dependabot[bot] in #297
• Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 in the all group by @dependabot[bot] in #296
• Bump golangci/golangci-lint-action from 6.5.1 to 6.5.2 in the all group by @dependabot[bot] in #299
• Bump the all group with 2 updates by @dependabot[bot] in #300
• Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 in the go_modules group by @dependabot[bot] in #301
• Bump github.com/sigstore/sigstore from 1.8.15 to 1.9.1 by @dependabot[bot] in #295
• Bump sigs.k8s.io/release-utils from 0.11.0 to 0.11.1 in the all group by @dependabot[bot] in #303
• Bump goreleaser/goreleaser-action from 6.2.1 to 6.3.0 in the all group by @dependabot[bot] in #304
• Bump ko-build/setup-ko from 0.8 to 0.9 in the all group by @dependabot[bot] in #308
• Bump github.com/sigstore/cosign/v2 from 2.4.3 to 2.5.0 by @dependabot[bot] in #306
• Bump kubernetes-sigs/release-actions from 0.3.0 to 0.3.1 in the all group by @dependabot[bot] in #309
• Bump softprops/action-gh-release from 2.2.1 to 2.2.2 in the all group by @dependabot[bot] in #310
• Bump sigstore/cosign-installer from 3.8.1 to 3.8.2 in the all group by @dependabot[bot] in #311
• Bump the all group across 1 directory with 2 updates by @dependabot[bot] in #307
• Bump github.com/sigstore/sigstore from 1.9.3 to 1.9.4 in the all group by @dependabot[bot] in #312
• Bump actions/setup-go from 5.4.0 to 5.5.0 in the all group by @dependabot[bot] in #314
• Bump github.com/google/go-containerregistry from 0.20.3 to 0.20.4 in the all group by @dependabot[bot] in #315
• Bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in the go_modules group by @dependabot[bot] in #318
• Bump softprops/action-gh-release from 2.2.2 to 2.3.0 in the all group by @dependabot[bot] in #317
• Bump softprops/action-gh-release from 2.3.0 to 2.3.2 in the all group by @dependabot[bot] in #319
• Bump the all group across 1 directory with 2 updates by @dependabot[bot] in #320
• Bump the all group with 2 updates by @dependabot[bot] in #322
• Bump sigstore/cosign-installer from 3.8.2 to 3.9.0 in the all group by @dependabot[bot] in #323
• Bump github.com/sigstore/cosign/v2 from 2.5.1 to 2.5.2 in the all group by @dependabot[bot] in #324
• Bump sigstore/cosign-installer from 3.9.0 to 3.9.1 in the all group by @dependabot[bot] in #325
• Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in the go_modules group by @dependabot[bot] in #326
• Bump github.com/sigstore/cosign/v2 from 2.5.2 to 2.5.3 in the all group by @dependabot[bot] in #327
• Bump sigstore/cosign-installer from 3.9.1 to 3.9.2 in the all group by @dependabot[bot] in #329
• Bump sigs.k8s.io/release-utils from 0.11.1 to 0.12.0 by @dependabot[bot] in #328
• Bump github.com/sigstore/rekor from 1.3.10 to 1.4.0 by @dependabot[bot] in #330
• Bump github.com/secure-systems-lab/go-securesystemslib from 0.9.0 to 0.9.1 in the all group by @dependabot[bot] in #331
• Bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #332
• update release-utils and fix pkg n...

v0.3.0

What's Changed

• Fix linter errors for the template by @shafeeqes in #151
• upgrade go to 1.22 / general housekeeping and lint fixes by @cpanato in #172
• run attest in prs to test the entire release flow by @cpanato in #179
• Add support for Golang GO-* vulnerability identifier by @ferozsalam in #182
• update installation methods with homebrew by @stephengroat in #205
• fix(create): support multiple --product flags by @felipecruz91 in #216
• Add support to vulnerability aliases by @macedogm in #220
• Fix Copyright in Boilerplates by @puerco in #223
• Improve the generated template README by @macedogm in #224
• Update go.mod and golanci-lint by @cpanato in #229
• Fix OCI repository URL resolution by @knqyf263 in #235

New Contributors

• @shafeeqes made their first contribution in #151
• @stephengroat made their first contribution in #205
• @felipecruz91 made their first contribution in #216
• @macedogm made their first contribution in #220
• @knqyf263 made their first contribution in #235

Full Changelog: v0.2.6...v0.3.0

v0.2.6

What's Changed

• revamp release job, cleanups and add snapshot job by @cpanato in #138
• Bump github.com/google/go-containerregistry from 0.16.1 to 0.17.0 by @dependabot in #140
• Move release actions to kubernetes-sigs by @puerco in #141
• Bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 by @dependabot in #142
• Update examples to v0.2.0 by @puerco in #145
• Fix bug when updating documents in place. by @puerco in #144
• Bump github.com/sigstore/cosign/v2 from 2.2.1 to 2.2.2 by @dependabot in #146
• Fix keyless verification of openvex attesatations by @puerco in #147
• Bump actions/setup-go from 4.1.0 to 5.0.0 by @dependabot in #148
• Bump sigstore/cosign-installer from 3.2.0 to 3.3.0 by @dependabot in #149
• vexctl generate by @puerco in #150

Full Changelog: v0.2.5...v0.2.6

v0.2.5

What's Changed

• Update vexctl to spec v0.2.0 by @puerco in #92
• show subcommand creation for review by @brandtkeller in #115
• Refactor commands and CLI options by @puerco in #110
• Update SARIF filtering examples by @puerco in #109
• upgrade to go1.21 by @cpanato in #121
• vexctl add subcommand by @puerco in #111
• Update README examples to v0.2.0 by @puerco in #127
• Update vexctl attest by @puerco in #126

New Contributors

• @brandtkeller made their first contribution in #115

Full Changelog: v0.2.3...v0.2.5

v0.2.3

What's Changed

• Add ko installer to release workflow by @puerco in #97
• Updates by @cpanato in #98

Full Changelog: v0.2.2...v0.2.3

v0.2.0

What's Changed

• vexctl: Forked repo kickstart by @puerco in #1
• Break dependency on old chainguard/vex module by @puerco in #2
• switch CVE to official 'sample' ID by @attritionorg in #5
• Restore attestation capability after repo split by @puerco in #6
• Update import paths to openvex/go-vex by @puerco in #7

New Contributors

• @puerco made their first contribution in #1
• @attritionorg made their first contribution in #5

Full Changelog: v0.1.0...v0.2.0