Skip to content

Releases: ratify-project/ratify

v1.3.0

17 Sep 00:11
@github-actions github-actions
v1.3.0
3ccccdb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.3.0 Latest
Latest

✨ New Features

  • Support keyless verification in trust policy of Cosign verifier in #1503
  • Support verifying Notary Project timestamped signature in #1538 and #1758
  • Support periodic retrieval of key and certificate from Key Management Providers based on the proposal in #1727 and #1773

✨ Other Enhancements

  • Improve error messages of artifact validation
    • Add more fields to verification response in #1671
    • refactor error message format in #1675
    • fill ErrorReason and Remediation during verifierReport generation in #1682
    • add timestamp and traceId to verification response in #1697
    • enhance CR status with clearer brief error message in #1734
    • refactor cosign verification error messages in #1750
  • Add namespace label to metrics to enhance observability in #1520
  • Ability to save errors happened during KMP/CertStore reconciliation which could be checked by verifiers during artifact validation in #1710

🔐 Security

  • Generate supply chain metadata for dev assets by adding SBOM & provenance Docker build attestations in #1596
  • Add image signing for dev images and add release sbom in #1629
  • Add openssf best practices badge by @susanshi in #1696
  • Setup scanners for Ratify releases by @susanshi in #1521

📄 Documentation

🐛 🩹 Bug Fixes

🎉 New Contributors

Changes since v1.2.2

  • 0ee96d8 Create ratify-weekly-notes-2023-Jun-2024-Jun.md
  • 3bafc56 Merge branch 'dev' into clean-package
  • 581be1e Merge branch 'dev' into dependabot/docker/alpine-0a4eaa0eecf5f8c050e5bba433f58c052be7587ee8af3e8b3910ef9ab5fbe9f5
  • 7e387db Merge branch 'dev' into dependabot/docker/dot-devcontainer/vscode/devcontainers/go-8cb4ef6
  • bd2f5ca Merge branch 'dev' into dependabot/docker/dot-devcontainer/vscode/devcontainers/go-dca0f2c
  • cca0a13 Merge branch 'dev' into dependabot/docker/httpserver/golang-b405b62
  • 72025fb Merge branch 'dev' into dependabot/github_actions/actions/upload-artifact-4.3.4
  • bb8d7f0 Merge branch 'dev' into dependabot/github_actions/actions/upload-artifact-4.3.6
  • 0447079 Merge branch 'dev' into dependabot/github_actions/anchore/sbom-action-0.17.1
  • e353f38 Merge branch 'dev' into dependabot/go_modules/github.com/google/go-containerregistry-0.20.2
  • 6ebd6f1 Merge branch 'dev' into dependabot/go_modules/github.com/owenrumney/go-sarif/v2-2.3.3
  • bb8516e Merge branch 'dev' into dependabot/go_modules/github.com/sigstore/sigstore-1.8.8
  • 52f92d1 Merge branch 'dev' into dev
  • 451390b Merge branch 'dev' into error-log-message
  • 220dfce Merge branch 'dev' into error-log-message
  • 5b7c4e0 Merge branch 'dev' into error-log-message
  • 18f071a Merge branch 'dev' into fix-codecov
  • 7e74e12 Merge branch 'dev' into ignore-experimental-test
  • 4cf6b6c Merge branch 'dev' into isolate-metrics
  • ec20d28 Merge branch 'dev' into isolate-metrics
  • 9c534dc Merge branch 'dev' into isolate-metrics
  • 50b334d Merge branch 'dev' into isolate-metrics
  • 0b58daf Merge branch 'dev' into notes
  • 4bbd9f1 Merge branch 'dev' into proposal_errorimprovements
  • 8549d91 Merge branch 'dev' into ratify-err-doc
  • 060c5a5 Merge branch 'dev' into ratify-err-doc
  • f510dd9 Merge branch 'dev' into remove-autorest-adal
  • 518ad3d Merge branch 'dev' into remove-autorest-adal
  • 6f92077 Merge branch 'dev' into template-result
  • e757310 Merge branch 'dev' into verification-response
  • 34fbf9f Merge branch 'main' into dev
  • 49201e9 Merge branch 'main' into staging
  • f201712 Merge branch 'main' into staging
  • 8c87951 Merge branch 'staging' into dependabot/github_actions/codecov/codecov-action-4.3.0
  • 73ef709 Merge branch 'staging' into multi-tenancy-pr-2
  • 6a93bbf Merge pull request #1358 from binbin-li/multi-tenancy-pr-2
  • 6daec5d Merge pull request #1376 from deislabs/staging
  • 9ac7d5a Merge pull request #1379 from deislabs/dependabot/github_actions/codecov/codecov-action-4.3.0
  • 6a5f10c Merge pull request #1388 from deislabs/staging
  • 6a26a56 Merge pull request #1424 from deislabs/dev
  • 194c2aa Merge pull request #1431 from akashsinghal/akashsinghal/fixCosignConfig
  • f0b1e6b Merge pull request #1444 from deislabs/dev
  • d78461a Merge pull request #1480 from deislabs/dev
  • c92687d Merge pull request #1499 from deislabs/dev
  • 61f7c60 Merge pull request #1520 from binbin-li/isolate-metrics
  • 340c4db Merge pull request #1521 from susanshi/dev
  • 8a6f018 Merge pull request #1532 from binbin-li/clean-package
  • b6a5701 Merge pull request #1533 from ratify-project/dev
  • 6443a65 Merge pull request #1539 from binbin-li/run-scorecard-on-dev
  • d9d46fe Merge pull request #1542 from binbin-li/fix-vulnerability
  • 5d4720f Merge pull request #1563 from ratify-project/dependabot/go_modules/github.com/Azure/azure-sdk-for-go/sdk/azidentity-1.6.0
  • 5e81022 Merge pull request #1581 from ratify-project/dev
  • 9bf9232 Merge pull request #1585 from ratify-project/dev
  • 47b3331 Merge pull request #1589 from ratify-project/dependabot/docker/httpserver/golang-b405b62
  • e4c58e2 Merge pull request #1590 from ratify-project/dependabot/docker/alpine-b89d9c93e9ed3597455c90a0b88a8bbb5cb7188438f70953fede212a0c4394e0
  • db3b86f Merge pull request #1597 from ratify-project/dev
  • 7f1ecfb Merge pull request #1608 from susanshi/notes
  • 357eb51 Merge pull request #1613 from ZAFT-Armored-Keeper-of-Unity/helmfile-update-1.13.2
  • db7e6ee Merge p...
Read more

Contributors

binbin-li, duffney, and 5 other contributors
Assets 13

v1.2.2

15 Aug 01:35
@github-actions github-actions
v1.2.2
0f2a6ad
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.2.2

Bug Fixes

Changelog

Assets 8
Loading

v1.2.1

05 Jul 08:13
@github-actions github-actions
v1.2.1
ac7c142
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.2.1

Bug Fixes

Changelog

  • ca750c7 Merge pull request #1609 from ZAFT-Armored-Keeper-of-Unity/release-1.2.1
  • ac7c142 Merge pull request #1611 from ZAFT-Armored-Keeper-of-Unity/ratify-1.13.2
  • ca7c358 chore: Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity
  • 2dfab79 chore: Bump github.com/aws/aws-sdk-go-v2/config from 1.27.16 to 1.27.18 (#1557)
  • 1472bfa chore: Bump github.com/aws/aws-sdk-go-v2/config from 1.27.18 to 1.27.21 (#1586)
  • 1f59f71 chore: Bump github.com/aws/aws-sdk-go-v2/config from 1.27.21 to 1.27.23 (#1602)
  • e21a23c chore: Bump github.com/aws/aws-sdk-go-v2/credentials from 1.17.21 to 1.17.22 (#1594)
  • c28d56b chore: Bump github.com/aws/aws-sdk-go-v2/credentials from 1.17.22 to 1.17.23 (#1600)
  • a9b89b5 chore: Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.28.3 to 1.28.5 (#1558)
  • bac0633 chore: Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.28.5 to 1.28.6 (#1587)
  • 9ec06c4 chore: Bump github.com/hashicorp/go-retryablehttp from 0.7.5 to 0.7.7 CVE GO-2024-2947 (#1595)
  • 2b19603 chore: Bump github.com/spf13/cobra from 1.8.0 to 1.8.1 (#1577)
  • 1afc81e chore: Bump k8s.io/client-go from 0.28.10 to 0.28.11 (#1573)
  • ca3f41b chore: cherry pick vuln scanner to release 1.2 (#1564)
  • ceffa17 chore: prepare release 1.2.1 charts update 2
  • 8e173a4 chore: prepare release 1.2.1 charts update 3
  • 975ac96 chore: update deislabs.github.io to ratify-project.github.io (#1566)
  • bf8e96d chore: update helm charts
  • bf227cf chore:add no-lint config
  • 78c3fbc ci: switch region from eastus to westus2 (#1591)
  • 19f55c4 fix go.mod
Assets 8
Loading

v1.2.0

31 May 06:05
@github-actions github-actions
v1.2.0
da2cdca
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.2.0

🚨 Deprecations

  • CertificateStore is deprecated in favor of KeyManagementProvider. Please migrate to KeyManagementProvider by following guide here. Support will be removed in Ratify v2.0.0
  • Certain helm values have been deprecated in favor of new ones. (Note: deprecated values will continue to be supported)
    • .Values.notationCert is deprecated. Use .Values.notationCerts[*] to provide a list certificates to configure with notation verifier
    • .Values.akvCertConfig.* section has been deprecated. Use the equivalent .Values.azurekeyvault.* section for configuring keys + certificates from Azure Key Vault

✨ New Features

📄 Documentation

🎉 New Contributors

🐛 🩹 Bug Fixes

Changes since v1.2.0-rc.1

Contributors

binbin-li, duffney, and 6 other contributors
Assets 8
Loading

v1.2.0-rc.1

22 May 00:27
@github-actions github-actions
v1.2.0-rc.1
280494f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.2.0-rc.1 Pre-release
Pre-release

🚨 Deprecations

  • CertificateStore is deprecated in favor of KeyManagementProvider. Please migrate to KeyManagementProvider by following guide here. Support will be removed in Ratify v2.0.0

✨ New Features

📄 Documentation

🎉 New Contributors

🐛 🩹 Bug Fixes

What's Changed

  • fix: bump dev helmfile ratify chart versions by @akashsinghal in #1216
  • feat: add namespace to external data request key by @binbin-li in #1201
  • chore: Bump github.com/aws/aws-sdk-go-v2/credentials from 1.16.9 to 1.16.12 by @dependabot in #1224
  • chore: Bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.9.0 to 1.9.1 by @dependabot in #1225
  • chore: Bump github.com/aws/aws-sdk-go-v2/config from 1.25.11 to 1.25.12 by @dependabot in #1226
  • build: bump up upload-artifact action to v4.0.0 by @binbin-li in #1227
  • chore: Bump golang.org/x/crypto from 0.16.0 to 0.17.0 by @dependabot in #1229
  • feat: add version to CRD spec by @susanshi in #1215
  • fix: surface plugin error in exec.go by @susanshi in #1228
  • chore: Bump github.com/aws/aws-sdk-go-v2/credentials from 1.16.12 to 1.16.13 by @dependabot in #1235
  • chore: Bump k8s.io/client-go from 0.28.4 to 0.28.5 by @dependabot in #1232
  • chore: Bump apache/skywalking-eyes from ee81ff786927ea6ffa48b1e29c48e5289f4753aa to ed436a5593c63a25f394ea29da61b0ac3731a9fe by @dependabot in #1231
  • feat: add cache isolation by @binbin-li in #1213
  • chore: update codecov config by @junczhu in #1237
  • docs: updated docs with the latest verifier report format by @junczhu in #1236
  • fix: SBOM verifier license match support for deprecated license by @susanshi in #1230
  • docs: add multi-tenancy support discussions by @binbin-li in #1175
  • fix: differentiate aks logs from e2e log by @susanshi in #1243
  • ci: add cache cleanup post merge by @akashsinghal in #1242
  • docs: Update log format in doc by @junczhu in #1240
  • ci: switch to fail-fast from continue-on-error by @binbin-li in #1245
  • ci: add dev helm chart publishing workflow by @akashsinghal in #1209
  • fix: update constraint templates to work with new type field by @akashsinghal in #1217
  • fix: improve vuln report verifier report messages by @akashsinghal in #1238
  • feat: improve plugin config dependency by @junczhu in #1223
  • chore: Bump github.com/aws/aws-sdk-go-v2/credentials from 1.16.13 to 1.16.14 by @dependabot in #1250
  • chore: Bump github.com/AzureAD/microsoft-authentication-library-for-go from 1.2.0 to 1.2.1 by @dependabot in #1252
  • chore: Bump github.com/cloudflare/circl from 1.3.5 to 1.3.7 by @dependabot in #1253
  • chore: Bump azure/login from 1.5.1 to 1.6.0 by @dependabot in #1255
  • chore: rename func for readability by @junczhu in #1257
  • chore: Bump actions/upload-artifact from 4.0.0 to 4.1.0 by @dependabot in #1261
  • chore: Bump azure/login from 1.6.0 to 1.6.1 by @dependabot in #1266
  • chore: Bump actions/upload-artifact from 4.1.0 to 4.2.0 by @dependabot in #1270
  • chore: Bump k8s.io/client-go from 0.28.5 to 0.28.6 by @dependabot in #1273
  • chore: Bump github.com/aws/aws-sdk-go-v2/credentials from 1.16.14 to 1.16.16 by @dependabot in #1275
  • chore: Bump github.com/opencontainers/image-spec from 1.1.0-rc5 to 1.1.0-rc6 by @dependabot in #1271
  • chore: Bump actions/upload-artifact from 4.2.0 to 4.3.0 by @dependabot in #1279
  • chore: Bump codecov/codecov-action from 3.1.4 to 3.1.5 by @dependabot in #1281
  • chore: Bump github.com/docker/cli from 24.0.7+incompatible to 24.0.8+inco...
Read more

Contributors

binbin-li, duffney, and 7 other contributors
Assets 8
Loading
0 Join discussion

v1.1.1

02 May 23:12
@github-actions github-actions
v1.1.1
986b5b8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.1

Changelog

Bug Fixes

Assets 8
Loading

v1.1.0

12 Dec 02:35
@github-actions github-actions
v1.1.0
7725e46
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.0

💥 🚨 CRD BREAKING CHANGES 🚨 💥

  • Certificate Store is a namespaced CR. We have made a fix in this release so that Certificate Store CR can be uniquely referenced by Verifier CR. Please follow migration steps here

✨ New Features

  • Enables SBOM verifier improvements:
    • Add deny license and deny package properties to the existing SBOM verifier
    • Add SBOM verifier to Helm chart
  • Introduce new Vulnerability report verifier for Sarif reports generated by Trivy and Grype
    • Enforces report content to match Sarif schema
    • Enforces a MaximumAge duration (ex: '24h')
    • Enforces against existence of disallowedSeverity levels (ex: 'critical')
    • Enforces against existence of denylistCVEs (ex: CVE-2021-44228 log4shell)
    • Introduce a passthrough flag which will bypass all checks and append sarif content in verifier report
    • Adds vulnerability report verifier to Helm chart
    • For documentation on how to use refer to the docs
  • Introduce a verifier name and a verifier type (specName) to the existing VerifierConfig and VerifierPlugin. This enables support for multiple verifiers of the same verifier type. You can find more info here.
  • Introduce new –debug flag to Ratify CLI that sets the logger level to DEBUG.
  • Introduce support for notation-go logs with trace-id support

📄 Documentation

Note: We’ve moved most of our feature documentation to the Ratify Website.

🧪 Tests

  • Added new E2E CLI test for SBOM verifier
  • Added unit tests and E2E tests for vulnerability report verifier
  • Add more unit tests to increase the test coverage for authProvider.

CLI

  • Verifier Scenarios
    • Notation
    • Cosign
      • Keyed
      • Keyless
    • SBOM
    • License Checker
    • JSON Schema Validation
    • All verifier types in one
    • Vulnerability Report
  • Dynamic OCI Plugins
    • Verifier Plugin
    • Store Plugin

Kubernetes

  • Verifier Scenarios
    • Notation
    • Cosign
    • SBOM
    • License Checker
    • JSON Schema Validation
    • All verifier types in one
    • Vulnerability Report
  • ORAS Store Authentication Providers
    • Docker
    • Kubernetes Secrets
    • Azure Workload Identity
    • Azure Managed Identity
  • Certificate Store Providers
    • Inline Certificate
    • Azure Key Vault Certificate
  • Mutation Provider
  • Dynamic OCI Plugins
    • Verifier Plugin
  • CertificateProvider CRD Status
  • TLS Certificate
    • TLS Certificate Watcher
    • TLS Certificate Rotation
  • High Availability Tests
    • 2 Replicas, Redis + Dapr, Notation
  • Quick Start helmfile.yaml test

🐛 🩹 Bug Fixes

  • fix: update auth cache miss error handling by @akashsinghal in #1105
  • fix: rename error for verifier plugins to be more generic by @akashsinghal in #1129
  • fix: set default certstore namespace in notation verifier to uniquely identify certificate store resource by @susanshi in #1134
  • fix: allow multiple notationCert in default chart by @susanshi in #1151
  • fix: add certificates to chart value by @susanshi in #1172
  • fix: remove trailing hyphen in notation template by @akashsinghal in #1197

🎉 New Contributors

📝 Changelog

Read more

Contributors

bspaans, binbin-li, and 5 other contributors
Assets 8
Loading

v1.0.0

26 Sep 20:22
@github-actions github-actions
v1.0.0
6cceec1
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0

Ratify v1

Ratify is a verification engine available as a binary executable and on Kubernetes that enables customers to author policies to verify security artifact metadata, such as image signatures and SBOMs, and allows deployment of only those that comply with these policies. This is the first stable release v1.0.0🎉.

Important

Experimental features are only intended for testing in a development environment and should not be used in production. Please adhere to the specified feature and performance limits for production workloads. More information can be found in the ratify documentation.

Key Features

  • Ratify as a CLI binary for verifying artifacts stored in a registry
  • Out-of-box support in published helm chart for running Ratify as an External Data Provider for Gatekeeper admission controller
  • Native Kubernetes support for managing and running Ratify as a scalable & reliable service
    • Verifier, Store, Certificate Store, and Policy CRDs for simple Ratify configuration
    • TLS certificate management and rotation for mTLS service-to-service communication
    • Standardized logging and prometheus metrics support + Grafana dashboard.
  • Extensible plugin model to support new verifier and referrer store plugins
    • 1st party support for Notation verifier and registry interaction via ORAS referrer store.
    • External verifiers such as Cosign, SBOM, SPDX, Licensechecker, etc.
  • Built-in policy evaluation engine support using embedded OPA engine or config-based policies.
  • Built-in certificate stores makes interacting with Key Management Systems (KMS) simple.

Experimental Features

  • Ratify in High Availability (HA) mode using a distributed cache (dapr + redis)

✨ What's Changed since v1.0.0-rc8

  • Add end-to-end test for init containers and ephemeral container mutation/verification. See #1086
  • Update Policy CRD to contain a type instead of metadata for determing policy provider. See #1079

💥 🚨 BREAKING CHANGES 🚨 💥

  • Policy CRD now REQUIRES crd's metadata.name to be ratify-policy. spec.type must be rego-policy or config-policy ONLY.
    • See #1079 for more information

📄 Documentation

🧪 Tests

CLI

  • Verifier Scenarios
    • Notation
    • Cosign
      • Keyed
      • Keyless
    • SBOM
    • License Checker
    • JSON Schema Validation
    • All verifier types in one
  • Dynamic OCI Plugins
    • Verifier Plugin
    • Store Plugin

Kubernetes

  • Verifier Scenarios
    • Notation
    • Cosign
    • SBOM
    • License Checker
    • JSON Schema Validation
    • All verifier types in one
  • ORAS Store Authentication Providers
    • Docker
    • Kubernetes Secrets
    • Azure Workload Identity
    • Azure Managed Identity
  • Certificate Store Providers
    • Inline Certificate
    • Azure Key Vault Certificate
  • Mutation Provider
  • Dynamic OCI Plugins
    • Verifier Plugin
  • CertificateProvider CRD Status
  • TLS Certificate
    • TLS Certificate Watcher
    • TLS Certificate Rotation
  • High Availability Tests
    • 2 Replicas, Redis + Dapr, Notation
  • Quick Start helmfile.yaml test

🐛 🩹 Bug Fixes

📝 Changelog

  • fix: update helmfile.yaml for rc8 by @susanshi in #1069
  • chore: Bump github.com/docker/cli from 24.0.0+incompatible to 24.0.6+incompatible by @dependabot in #1070
  • chore: Bump goreleaser/goreleaser-action from 4.6.0 to 5.0.0 by @dependabot in #1077
  • chore: Bump actions/upload-artifact from 3.1.2 to 3.1.3 by @dependabot in #1063
  • chore: Bump github.com/aws/aws-sdk-go-v2/config from 1.18.38 to 1.18.39 by @dependabot in #1073
  • chore: Bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.7.1 to 1.7.2 by @dependabot in #1071
  • chore: Bump docker/login-action from 2.2.0 to 3.0.0 by @dependabot in #1080
  • docs: create ratify-weekly-notes-2023-Jan-2023-Jul.md by @susanshi in #1081
  • chore: update local build doc by @junczhu in #1075
  • chore: Bump k8s.io/client-go from 0.27.5 to 0.27.6 by @dependabot in #1085
  • test: add constraint template e2e test for initContainers and ephemeralContainers by @junczhu in #1086
  • chore: Bump github.com/opencontainers/image-spec from 1.1.0-rc4 to 1.1.0-rc5 by @dependabot in #1082
  • fix: update e2e resource for initContainers and ephemeralContainers by @junczhu in #1088
  • feat: add type to policy CRD by @binbin-li in #1079
  • chore: Bump github.com/aws/aws-sdk-go-v2/config from 1.18.39 to 1.18.42 by @dependabot in #1094
  • chore: Bump actions/checkout from 4.0.0 to 4.1.0 by @dependabot in #1092
  • docs: redirect to website by @susanshi in #1087
  • fix: update errors doc reference links by @akashsinghal in #1098
  • chore: prepare for v1.0.0 release by @akashsinghal in #1097

Full Changelog: v1.0.0-rc.8...v1.0.0

Contributors

binbin-li, susanshi, and 3 other contributors
Assets 8
Loading

v1.0.0-rc.8

11 Sep 08:56
@github-actions github-actions
v1.0.0-rc.8
98408ae
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.8 Pre-release
Pre-release

✨ New Features

  • User agent header by Ratify now includes OS/Arch and version.
  • Introducing new health probe.
    • Add liveness probes to deployment files
    • Allows probe port to be configured
  • Updated oras-go to v2.3.0 and GK 3.13 support

📄 Documentation

🧪 Tests

  • Added new automated test for quick start test.

CLI

  • Verifier Scenarios
    • Notation
    • Cosign
      • Keyed
      • Keyless
    • SBOM
    • License Checker
    • JSON Schema Validation
    • All verifier types in one
  • Dynamic OCI Plugins
    • Verifier Plugin
    • Store Plugin

Kubernetes

  • Verifier Scenarios
    • Notation
    • Cosign
    • SBOM
    • License Checker
    • JSON Schema Validation
    • All verifier types in one
  • ORAS Store Authentication Providers
    • Docker
    • Kubernetes Secrets
    • Azure Workload Identity
    • Azure Managed Identity
  • Certificate Store Providers
    • Inline Certificate
    • Azure Key Vault Certificate
  • Mutation Provider
  • Dynamic OCI Plugins
    • Verifier Plugin
  • CertifacteProvider CRD Status
  • TLS Certificate
    • TLS Certificate Watcher
    • TLS Certificate Rotation
  • High Availability Tests
    • 2 Replicas, Redis + Dapr, Notation

🐛 🩹 Bug Fixes

📝 Changelog

Full Changelog: v1.0.0-rc.7...v1.0.0-rc.8

Contributors

binbin-li, duffney, and 5 other contributors
Assets 8
Loading

v1.0.0-rc.7

25 Aug 22:01
@github-actions github-actions
v1.0.0-rc.7
3e5256a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0-rc.7 Pre-release
Pre-release

✨ New Features

  • Introducing OPA engine integration to support Rego Policy
    • Embeds OPA engine in Ratify so that service can make verifications using the OPA engine for Rego Policies.
    • Adds support for multiple verifiers against the same artifact.
    • Users can still provide a configuration Policy which is the default option.
    • Introduces new Policy controller and CRD that allows switching between configuration policy and Rego Policy at runtime
    • More information here
  • Introducing support to enable High Availability (HA) for Ratify
    • Unifies all existing in-memory caches through a new cache interface that allows registering and specifying new cache providers
    • Implements Ristretto as the default cache provider
    • Implements support for Dapr cache provider
    • More info here
  • Introducing integration with Helmfile Tool
    • Simplifies helm install for upgrade scenarios to HA support
    • Simplifies helm install for quick start experience
  • Introducing Terraform configs for Azure
    • Adds Terraform configs to simplify the deployment of Azure Resources for Ratify
  • Enable optional image mutation in Helm chart
    • Allows image mutation to be optional in helm chart since there might be scenarios where OPA Gatekeeper constraints are based on image tags.
  • Introduce graceful shutdown for http server
    • Adds support for ‘Shutdown’ command to be invoked on SIGTERM signal or interrupt OS command
    • Adds channel to wait on shutdown process to complete (6 second context timeout)
  • Introducing improved error handling
    • Refactor most errors to a custom error struct
    • Introduce error codes for faster searching
    • Adds stacks to improve debuggability
    • Adds a configurable internal logger utility that initializes the logger for Ratify and configures the context with a trace-id from requests
    • More info here
  • Introducing new Ratify arm64 & arm/v7 images
  • Introducing new Ratify Logo
    • We are improving the project branding. Check out the new Ratify Logo here

💥 🚨 BREAKING CHANGES 🚨 💥

  • Notation signature verifier name now registered using name notation instead of notaryv2
    • More information here
  • logLevel helm chart value now found at logger.level
    • More information here
  • TLS certs are NOT auto generated by Ratify chart. It's recommended to set featureFlags.RATIFY_CERT_ROTATION to true.
  • PKCS12 certs with Azure Key Vault setup is NOT supported

📄 Documentation

🧪 Tests

CLI

  • Verifier Scenarios
    • Notation
    • Cosign
      • Keyed
      • Keyless
    • SBOM
    • License Checker
    • JSON Schema Validation
    • All verifier types in one
  • Dynamic OCI Plugins
    • Verifier Plugin
    • Store Plugin

Kubernetes

  • Verifier Scenarios
    • Notation
    • Cosign
    • SBOM
    • License Checker
    • JSON Schema Validation
    • All verifier types in one
  • ORAS Store Authentication Providers
    • Docker
    • Kubernetes Secrets
    • Azure Workload Identity
    • Azure Managed Identity
  • Certificate Store Providers
    • Inline Certificate
    • Azure Key Vault Certificate
  • Mutation Provider
  • Dynamic OCI Plugins
    • Verifier Plugin
  • CertifacteProvider CRD Status
  • TLS Certificate
    • TLS Certificate Watcher
    • TLS Certificate Rotation
  • High Availability Tests
    • 2 Replicas, Redis + Dapr, Notation

🐛 🩹 Bug Fixes

🎉 New Contributors

📝 Changelog

Read more

Contributors

binbin-li, duffney, and 9 other contributors
Assets 8
Loading