Skip to content

chore(release): prepare Registry Stack v0.11.0 beta-13 #412

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jeremi merged 1 commit into from
Jul 18, 2026
Merged

chore(release): prepare Registry Stack v0.11.0 beta-13 #412

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@ These checks require Python 3.11 or later.
```bash
python3 -m unittest release/scripts/test_registry_release.py
python3 -m unittest release/scripts/test_openid_conformance_runner.py
release/scripts/registry-release validate release/manifests/registry-stack-beta-12.yaml
release/scripts/registry-release validate release/manifests/registry-stack-beta-13.yaml
release/scripts/registry-release audit release/manifests/import-map-2026-06-24.yaml
REGISTRY_RELEASE_SOURCE_MODE=monorepo release/scripts/check-release-source-model.sh
python3 -m unittest release/scripts/test_check_release_source_model.py
Expand Down
52 changes: 26 additions & 26 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

48 changes: 24 additions & 24 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ exclude = [
resolver = "2"

[workspace.package]
version = "0.10.0"
version = "0.11.0"
edition = "2021"
rust-version = "1.95"
license = "Apache-2.0"
Expand All @@ -51,29 +51,29 @@ repository = "https://github.com/registrystack/registry-stack"
unsafe_code = "forbid"

[workspace.dependencies]
registry-config-report = { path = "crates/registry-config-report", version = "0.10.0" }
registry-language-server = { path = "crates/registry-language-server", version = "0.10.0" }
registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.10.0" }
registry-notary-client = { path = "crates/registry-notary-client", version = "0.10.0" }
registry-notary-core = { path = "crates/registry-notary-core", version = "0.10.0" }
registry-relay = { path = "crates/registry-relay", version = "0.10.0" }
registry-notary-server = { path = "crates/registry-notary-server", version = "0.10.0", default-features = false }
registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.10.0" }
registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.10.0" }
registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.10.0" }
registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.10.0" }
registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.10.0" }
registry-platform-config = { path = "crates/registry-platform-config", version = "0.10.0" }
registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.10.0" }
registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.10.0" }
registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.10.0" }
registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.10.0" }
registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.10.0" }
registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.10.0" }
registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.10.0" }
registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.10.0" }
registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.10.0" }
registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.10.0" }
registry-config-report = { path = "crates/registry-config-report", version = "0.11.0" }
registry-language-server = { path = "crates/registry-language-server", version = "0.11.0" }
registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.11.0" }
registry-notary-client = { path = "crates/registry-notary-client", version = "0.11.0" }
registry-notary-core = { path = "crates/registry-notary-core", version = "0.11.0" }
registry-relay = { path = "crates/registry-relay", version = "0.11.0" }
registry-notary-server = { path = "crates/registry-notary-server", version = "0.11.0", default-features = false }
registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.11.0" }
registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.11.0" }
registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.11.0" }
registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.11.0" }
registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.11.0" }
registry-platform-config = { path = "crates/registry-platform-config", version = "0.11.0" }
registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.11.0" }
registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.11.0" }
registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.11.0" }
registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.11.0" }
registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.11.0" }
registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.11.0" }
registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.11.0" }
registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.11.0" }
registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.11.0" }
registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.11.0" }

crosswalk-core = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" }
crosswalk-functions = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" }
Expand Down
10 changes: 5 additions & 5 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,14 +44,14 @@ include cosign signatures without SLSA provenance.

For each signed release asset, download three files from the GitHub Release:

- The asset, for example `registryctl-v0.10.0-linux-amd64`
- The matching signature, for example `registryctl-v0.10.0-linux-amd64.sig`
- The matching certificate, for example `registryctl-v0.10.0-linux-amd64.pem`
- The asset, for example `registryctl-v0.11.0-linux-amd64`
- The matching signature, for example `registryctl-v0.11.0-linux-amd64.sig`
- The matching certificate, for example `registryctl-v0.11.0-linux-amd64.pem`

Then verify the asset:

```bash
asset=registryctl-v0.10.0-linux-amd64
asset=registryctl-v0.11.0-linux-amd64

cosign verify-blob \
--certificate "${asset}.pem" \
Expand All @@ -69,7 +69,7 @@ For releases with SLSA provenance, download the provenance asset and verify the
artifact against the release tag:

```bash
tag=v0.10.0
tag=v0.11.0
asset=registryctl-${tag}-linux-amd64
provenance=registry-stack-${tag}-release-provenance.intoto.jsonl

Expand Down
10 changes: 10 additions & 0 deletions crates/registry-relay/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

## Unreleased

## 0.11.0 - 2026-07-18

- Relay now publishes a reproducible, product-owned Draft 2020-12 schema for
the complete runtime configuration. `registry-relay schema --format json`
prints the committed artifact byte for byte, and local CI checks schema drift,
Expand All @@ -18,6 +20,14 @@
`audit.chain.inconsistent` after detecting a retained-chain verification
failure or a write-time foreign append. Transient audit I/O failures retain
their existing request-level policy and do not poison readiness.
- Script authoring diagnostics now reject unknown `source` and Crosswalk host
calls, unsupported arities, and invalid entrypoints before execution. The
bounded diagnostic identifies the first authored call, its source location,
and the closest valid signatures without retaining authored argument values.
- Requests that present both `Authorization` and `x-api-key` are rejected
before either credential is parsed or validated with the candidate-neutral
`auth.multiple_credentials` code. Relay does not fall back to one credential
or reveal whether either candidate was valid.

## 0.10.0 - 2026-07-17

Expand Down
9 changes: 9 additions & 0 deletions crates/registry-relay/docs/release-notes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

## Unreleased

## 0.11.0

- BREAKING: Configuration `${VAR}` expansion now rejects environment variables
that are unset or empty. `${VAR:-fallback}` uses its fallback for either
state, `${VAR:-}` explicitly expands to empty, and `${VAR:?message}` reports
Expand All @@ -10,6 +12,13 @@
`audit.chain.inconsistent` code after retained-audit-chain verification or
write-time fork detection. Transient audit I/O failures do not change
readiness.
- Relay reports bounded authoring diagnostics for unknown or incorrectly
called Script host functions, including the first call location and closest
valid signatures. Diagnostic output does not include authored argument
values.
- Sending both `Authorization` and `x-api-key` now fails before credential
parsing with `auth.multiple_credentials`. The response and audit outcome do
not disclose whether either candidate credential was valid.

## 0.10.0

Expand Down
2 changes: 1 addition & 1 deletion crates/registry-relay/openapi/registry-relay.openapi.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2903,7 +2903,7 @@
},
"summary": "Read-only data gateway exposing entity records, catalog metadata, and SHACL/DCAT-AP shapes for governed datasets.",
"title": "Registry Relay API",
"version": "0.10.0"
"version": "0.11.0"
},
"openapi": "3.1.0",
"paths": {
Expand Down
Loading
Loading