v0.12.0-beta.1

What's Changed

• feat: add envelope type config by @JeyJeyGao in #159
• update: clean up main branch by @patrickzheng200 in #172
• update: further clean up on notation-go by @patrickzheng200 in #173
• fix: rename envelopeType to signatureFormat by @JeyJeyGao in #175
• update: bump up notation-core-go by @patrickzheng200 in #177
• updating notation-core-go to v0.2.0-beta.1 by @priteshbandi in #180

Full Changelog: v0.11.0-alpha.4...v0.12.0-beta.1

v0.11.0-alpha.4

New features

• Plugin integration with verification workflow
• Update go library
• Support COSE envelope

Bug fixes

• fix the certs validation in trust store by @binbin-li in #147
• fix the certs validation in trust store by @priteshbandi in #151

Other changes

• Refactor to support new signature interface

Detail Commits

• Plugin integration with verification workflow by @rgnote in #101
• feat: update to go 1.18 by @JeyJeyGao in #124
• Bump oras.land/oras-go/v2 from 2.0.0-rc.2 to 2.0.0-rc.3 by @dependabot in #135
• fix: fix the certs validation in trust store by @binbin-li in #147
• fix the certs validation in trust store by @priteshbandi in #151
• refactor: refactor pluginSigner to support new signature interface by @chloeyin in #131
• refactor: support cose envelope by @chloeyin in #146
• build: bump dependencies by @yizha1 in #165

New Contributors

• @yizha1 made their first contribution in #165

Full Changelog: v0.10.0-alpha.3...v0.11.0-alpha.4

v0.10.0-alpha.3

New Features:

• Implement basic signature verification
• Implement Notation directory structure
• Add config package & optimize directory package
• Add support for trust store parsing

Bug Fixes

• Fix #104: optimizes directory package
• Fix #58: trust store test issue on Windows
• Fix #98: fix hash function name according to the plugin spec

Other Changes:

• Add unit tests
• Add CodeQL security scanning
• Refactor registry interface

Detail Commits

• Add support for trust store parsing by @rgnote in #44
• Add GetApplicableTrustPolicy function by @rgnote in #51
• Verify X509 trusted identities by @rgnote in #54
• Fix trust store tests issue on Windows by @rgnote in #58
• Add CodeQL Security Scanning by @Wwwsylvia in #56
• feat: move pkg/registry from notaryproject/notation by @binbin-li in #63
• Add SignatureVerificationLevel type by @rgnote in #55
• chore: move registry directory under root by @binbin-li in #64
• refactor: refactor registry interface by @binbin-li in #67
• Bump github.com/golang-jwt/jwt/v4 from 4.4.1 to 4.4.2 by @dependabot in #68
• Bump actions/cache from 3.0.2 to 3.0.4 by @dependabot in #53
• Run unit tests in Github workflow by @Wwwsylvia in #60
• add to project template by @dtzar in #66
• Verification helpers by @rgnote in #72
• Refactor to use notation-core-go's SignatureEnvelope by @priteshbandi in #77
• Add command shapes for verify-signature and get-plugin-metadata by @jondonas in #76
• Implementing Notation directory structure by @JeyJeyGao in #73
• feat: Use PackArtifact to push signature manifest by @binbin-li in #87
• Migrate to codecov.io by @junczhuMSFT in #92
• resolving remote signature envelope digest as blob instead of manifest by @patrickzheng200 in #89
• Add more badges to README.md by @shizhMSFT in #94
• feat: add config package & optimize dir package by @JeyJeyGao in #90
• Basic Signature Verification by @rgnote in #79
• Implement custom signature verification level by @rgnote in #84
• Use Notation's PathManager in verification workflow by @rgnote in #100
• hash name fix by @chloeyin in #98
• test: add registry unit test by @binbin-li in #96
• Updates based on signing scheme update in notation-go-core by @priteshbandi in #85
• fix: dir package optimize by @JeyJeyGao in #104
• Bump github.com/go-ldap/ldap/v3 from 3.4.3 to 3.4.4 by @dependabot in #97
• build: bump dependencies by @shizhMSFT in #112

New Contributors

• @Wwwsylvia made their first contribution in #56
• @binbin-li made their first contribution in #63
• @dtzar made their first contribution in #66
• @priteshbandi made their first contribution in #77
• @jondonas made their first contribution in #76
• @JeyJeyGao made their first contribution in #73
• @junczhuMSFT made their first contribution in #92
• @patrickzheng200 made their first contribution in #89

Full Changelog: v0.9.0-alpha.1...v0.10.0-alpha.3

v0.9.0-alpha.1

Documentation 📘

notation-go provides the libraries for notation sign|push|validate capabilities. The notation CLI is implemented based on notation-go. However, notation-go may be used in other CLIs.

• Getting started with notation

What's Changed

• Implement generate-envelope workflow #47 by @qmuntal
• Add more validations to trust-policy parsing #43 by @rgnote
• Implement built-in JWS signer in terms of an in-process plugin #46 by @qmuntal
• Implement generate signature plugin workflow #42 by @qmuntal
• Load and Validate Trust policy documents #39 by @rgnote
• Implement plugin manager #37 by @qmuntal

Dependency updates via dependabot

• #32
• #31
• #29
• #41

New Contributors

• Special thank you to @qmuntal with first and then numerous contributions after this as noted above.

Full Changelog: v0.8.0-alpha.1...v0.9.0-alpha.1

v0.8.0-alpha.1

Documentation 📘

notation-go provides the libraries for notation sign|push|validate capabilities. The notation CLI is implemented based on notation-go. However, notation-go may be used in other CLIs.

• Getting started with notation

What's Changed

• Timestamp per signing by @shizhMSFT in #15
• Restrict TSA verify options by @shizhMSFT in #18
• Bump github.com/golang-jwt/jwt/v4 from 4.1.0 to 4.3.0 by @dependabot in #26
• Bump actions/checkout from 2 to 3 by @dependabot in #27
• Rename go module by @shizhMSFT in #34

New Contributors

• @dependabot made their first contribution in #26

Full Changelog: v0.7.0-alpha.1...v0.8.0-alpha.1

v0.7.0-alpha.1

Documentation 📘

notation-go-lib provides the libraries for notation sign|push|validate capabilities. The notation cli implements notation-go-lib, however notation-go-lib may be used in other clis.

• Getting started with notation
• Installing notation with linux and wsl2

  curl -Lo notation.tar.gz https://github.com/notaryproject/notation/releases/download/v0.7.0-alpha.1/notation_0.7.0-alpha.1_linux_amd64.tar.gz
  tar xvzf notation.tar.gz -C ~/bin notation

What's Changed

• Add codeowners by @terencet-dev in #7
• Adding information and links to README.md by @terencet-dev in #6
• Notation library baseline by @shizhMSFT in #5
• JWS-based Notation Go Library by @shizhMSFT in #11
• Conform to the signature specification by @shizhMSFT in #21

New Contributors

• @terencet-dev made their first contribution in #7

Full Changelog: https://github.com/notaryproject/notation-go-lib/commits/v0.7.0-alpha.1