cloudfieldcz/shieldoo-gate v0.19.10

on GitHub

Docker images

Pull the matching ghcr.io tag:

docker pull ghcr.io/cloudfieldcz/shieldoo-gate:0.19.10
docker pull ghcr.io/cloudfieldcz/scanner-bridge:0.19.10

Image pages:

• shieldoo-gate
• scanner-bridge

shdg CLI

Push-from-CI client. Pre-built for Linux, macOS, and Windows:

shdg version reports 0.19.10 to match the Docker tag.
Verify archive integrity with SHA256SUMS (also attached).

Supply-chain security

All artifacts are signed and carry SLSA build provenance (keyless, via GitHub OIDC + Sigstore).

• Images — cosign signature + SLSA provenance + CycloneDX SBOM attached as OCI referrers:

  cosign verify ghcr.io/cloudfieldcz/shieldoo-gate:0.19.10 \
    --certificate-identity-regexp 'https://github.com/cloudfieldcz/.+' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com
  gh attestation verify oci://ghcr.io/cloudfieldcz/shieldoo-gate:0.19.10 --repo cloudfieldcz/shieldoo-gate

• shdg binaries — SLSA provenance: gh attestation verify shdg-0.19.10-linux-amd64.tar.gz --repo cloudfieldcz/shieldoo-gate
• Detached signatures — each archive and SHA256SUMS also ships a keyless *.sig + *.pem cert (recognised by OpenSSF Scorecard):

  cosign verify-blob \
    --signature shdg-0.19.10-linux-amd64.tar.gz.sig \
    --certificate shdg-0.19.10-linux-amd64.tar.gz.pem \
    --certificate-identity-regexp 'https://github.com/cloudfieldcz/.+' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com shdg-0.19.10-linux-amd64.tar.gz

  The same provenance is also attached as shdg-0.19.10.intoto.jsonl.
• SBOMs — the CycloneDX SBOMs dogfooded through the gate are attached (*.cdx.json) with a detached cosign bundle (*.cdx.json.cosign.bundle):

  cosign verify-blob --bundle sbom-gate.cdx.json.cosign.bundle \
    --certificate-identity-regexp 'https://github.com/cloudfieldcz/.+' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com sbom-gate.cdx.json

Changes (v0.19.9…v0.19.10)

• fix: remediate the 2026-09-03 dogfood vulnerability snapshot (#236) (15dad3b)
• fix(scanner-bridge): remove ssrf_guard.safe_get, which never worked (#235) (868385e)
• chore(deps): golang 1.27.1 across all seven locations + grpcio/grpcio-tools lockstep (#234) (a41cbd9)
• chore(deps): bump google.golang.org/api (#232) (653d37c)
• build(ci): bump softprops/action-gh-release from 3.0.2 to 3.0.3 (#229) (966b0bc)
• chore(deps): bump the npm-minor-patch group in /ui with 3 updates (#227) (d47cea7)
• build(docker): bump python in /scanner-bridge (#226) (4741ae0)
• chore: x/crypto 0.56.0 + fix ADR-015's tag→SHA recipe for annotated tags (#233) (046a60d)
• build(trivy): 0.74.0 in both pins, plus a CI guard so they can't drift again (#231) (6814f72)
• chore(deps): recreate the orphaned gomod-minor-patch group (10 modules) (#230) (30f4701)
• chore(deps): scanner-bridge python deps incl. openai 3.x major + record the python 3.14 hold (#223) (4c71482)
• chore(deps): bump browserslist from 4.28.4 to 4.28.8 in /ui (#220) (ef8bcb9)
• build(ci): bump codeql-action init/autobuild/analyze/upload-sarif to v4.37.9 (#221) (2197bfe)
• fix(deps): Go toolchain 1.27.0 lockstep + grpc 1.83.2 (8 CVEs) (#219) (505a5f5)
• build(ci): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#206) (aca09eb)
• chore(deps): bump the npm-minor-patch group across 1 directory with 10 updates (#213) (dc171d2)