diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml index 04d9ad5..1ed15e7 100644 --- a/.github/workflows/release-artifacts.yml +++ b/.github/workflows/release-artifacts.yml @@ -123,6 +123,15 @@ jobs: - name: Install cosign if: startsWith(github.ref, 'refs/tags/v') uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + with: + # Pin the cosign CLI itself, not just the installer: without this + # the installer fetches latest cosign, and cosign v3 defaults to + # the new bundle format where --output-signature/--output-certificate + # are ignored ("create bundle file: open : no such file or + # directory" — broke the v0.3.1 tag build). Release assets and + # docs/verifying-releases.md use the .sig/.crt pair, so stay on + # cosign v2 until we migrate to bundles deliberately. + cosign-release: "v2.6.3" - name: Sign binary + SBOM (tag releases only) if: startsWith(github.ref, 'refs/tags/v') run: | diff --git a/CHANGELOG.md b/CHANGELOG.md index cd95a72..888d1d5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,16 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once a ## [Unreleased] +## [0.3.2] - 2026-07-16 + +### Fixed +- **Release pipeline: pin the cosign CLI to v2.** The v0.3.1 tag build failed + at the signing step because the cosign installer fetched the new cosign v3, + which ignores `--output-signature`/`--output-certificate` in favor of the + bundle format. As a result **v0.3.1 has no release binaries** — it remains a + valid Go module version, but Action/tag consumers should use v0.3.2, which + is content-identical plus this pipeline fix. + ## [0.3.1] - 2026-07-16 ### Added diff --git a/README.md b/README.md index 9c23f13..50a97e2 100644 --- a/README.md +++ b/README.md @@ -199,7 +199,7 @@ A complete, real example is [`examples/preload-gate`](examples/preload-gate): ![preload-gate.go — a real program using ValidateBeforeLoad](docs/images/library/library-code.png) ```sh -go get github.com/kernel-guard/bpfcompat@v0.3.1 +go get github.com/kernel-guard/bpfcompat@v0.3.2 go build -tags hostload -o preload-gate ./examples/preload-gate sudo ./preload-gate probe.bpf.o ``` @@ -315,7 +315,7 @@ guest-side validator binary and the kernel matrices that ship in this repo. the static validator, checksum-verified: ```bash -VER=v0.3.1 +VER=v0.3.2 base="https://github.com/Kernel-Guard/bpfcompat/releases/download/$VER" curl -fsSLO "$base/bpfcompat-linux-amd64" curl -fsSLO "$base/bpfcompat-validator-static-linux-amd64" @@ -561,7 +561,7 @@ or the Firecracker lane. See Suite mode (recommended — gates the whole collection): ```yaml -- uses: Kernel-Guard/bpfcompat@v0.3.1 +- uses: Kernel-Guard/bpfcompat@v0.3.2 with: suite: suites/project.yaml suite-out: reports/suite.json @@ -575,7 +575,7 @@ are alive and adds the result to the suite-level collection matrix. Single artifact: ```yaml -- uses: Kernel-Guard/bpfcompat@v0.3.1 +- uses: Kernel-Guard/bpfcompat@v0.3.2 with: artifact: path/to/program.bpf.o manifest: path/to/manifest.yaml @@ -591,7 +591,7 @@ per-kernel verdict is the loader's exit code), against the built-in [library of known-tricky vendor kernels](docs/kernel-quirk-library.md): ```yaml -- uses: Kernel-Guard/bpfcompat@v0.3.1 +- uses: Kernel-Guard/bpfcompat@v0.3.2 with: command: $BPFCOMPAT_BIN --self-test command-binary: build/myloader # static or fully self-contained binary diff --git a/docs/case-study-falco-modern-bpf.md b/docs/case-study-falco-modern-bpf.md index 94a3c9e..52e996f 100644 --- a/docs/case-study-falco-modern-bpf.md +++ b/docs/case-study-falco-modern-bpf.md @@ -67,7 +67,7 @@ keep in sync with the loader: the loader is the contract. ```bash # In CI (GitHub Action), against your kernel matrix: -- uses: Kernel-Guard/bpfcompat@v0.3.1 +- uses: Kernel-Guard/bpfcompat@v0.3.2 with: artifact: build/bpf_probe.o matrix: matrices/mvp.yaml diff --git a/docs/command-validation.md b/docs/command-validation.md index 63f6933..fd04b00 100644 --- a/docs/command-validation.md +++ b/docs/command-validation.md @@ -109,7 +109,7 @@ on its own loader with one step. A bare `matrix` name resolves to the to copy: ```yaml -- uses: Kernel-Guard/bpfcompat@v0.3.1 +- uses: Kernel-Guard/bpfcompat@v0.3.2 with: command: $BPFCOMPAT_BIN --self-test command-binary: build/myloader diff --git a/docs/ebpf-go-validation.md b/docs/ebpf-go-validation.md index bf75a2b..4750650 100644 --- a/docs/ebpf-go-validation.md +++ b/docs/ebpf-go-validation.md @@ -50,7 +50,7 @@ Or in CI with the GitHub Action: ```yaml - run: cd examples/ebpf-go-loader && CGO_ENABLED=0 go build -o ebpf-go-loader . -- uses: Kernel-Guard/bpfcompat@v0.3.1 +- uses: Kernel-Guard/bpfcompat@v0.3.2 with: command: $BPFCOMPAT_BIN $BPFCOMPAT_ARTIFACT command-binary: examples/ebpf-go-loader/ebpf-go-loader diff --git a/docs/quickstart.md b/docs/quickstart.md index 63c7d9b..c485847 100644 --- a/docs/quickstart.md +++ b/docs/quickstart.md @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest # exposes /dev/kvm for KVM acceleration steps: - uses: actions/checkout@v4 - - uses: Kernel-Guard/bpfcompat@v0.3.1 + - uses: Kernel-Guard/bpfcompat@v0.3.2 with: artifact: build/program.bpf.o # your compiled object matrix: matrices/mvp.yaml # the kernels you support @@ -57,7 +57,7 @@ What you get: Shipping a whole product? Use **suite mode** to gate a collection in one run: ```yaml - - uses: Kernel-Guard/bpfcompat@v0.3.1 + - uses: Kernel-Guard/bpfcompat@v0.3.2 with: suite: suites/project.yaml suite-out: reports/suite.json