cloudfieldcz/shieldoo-gate v0.19.9

on GitHub

Docker images

Pull the matching ghcr.io tag:

docker pull ghcr.io/cloudfieldcz/shieldoo-gate:0.19.9
docker pull ghcr.io/cloudfieldcz/scanner-bridge:0.19.9

Image pages:

• shieldoo-gate
• scanner-bridge

shdg CLI

Push-from-CI client. Pre-built for Linux, macOS, and Windows:

shdg version reports 0.19.9 to match the Docker tag.
Verify archive integrity with SHA256SUMS (also attached).

Supply-chain security

All artifacts are signed and carry SLSA build provenance (keyless, via GitHub OIDC + Sigstore).

• Images — cosign signature + SLSA provenance + CycloneDX SBOM attached as OCI referrers:

  cosign verify ghcr.io/cloudfieldcz/shieldoo-gate:0.19.9 \
    --certificate-identity-regexp 'https://github.com/cloudfieldcz/.+' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com
  gh attestation verify oci://ghcr.io/cloudfieldcz/shieldoo-gate:0.19.9 --repo cloudfieldcz/shieldoo-gate

• shdg binaries — SLSA provenance: gh attestation verify shdg-0.19.9-linux-amd64.tar.gz --repo cloudfieldcz/shieldoo-gate
• Detached signatures — each archive and SHA256SUMS also ships a keyless *.sig + *.pem cert (recognised by OpenSSF Scorecard):

  cosign verify-blob \
    --signature shdg-0.19.9-linux-amd64.tar.gz.sig \
    --certificate shdg-0.19.9-linux-amd64.tar.gz.pem \
    --certificate-identity-regexp 'https://github.com/cloudfieldcz/.+' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com shdg-0.19.9-linux-amd64.tar.gz

  The same provenance is also attached as shdg-0.19.9.intoto.jsonl.
• SBOMs — the CycloneDX SBOMs dogfooded through the gate are attached (*.cdx.json) with a detached cosign bundle (*.cdx.json.cosign.bundle):

  cosign verify-blob --bundle sbom-gate.cdx.json.cosign.bundle \
    --certificate-identity-regexp 'https://github.com/cloudfieldcz/.+' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com sbom-gate.cdx.json

Changes (v0.19.8…v0.19.9)

• fix(scanner): use a CodeQL-recognized zip-slip guard in trivy extraction (#182) (6e8e2ee)
• fix(scanner-bridge): version-independent venv layout, hash-pinned pip, ship vuln_drafter.py (#181) (05fe2e7)
• build(ci): bump github/codeql-action/upload-sarif from 4.37.4 to 4.37.6 (#177) (3961479)
• fix(deps): cryptography 50.0.0 (GHSA-g6cj-pr64-35w5) + openai 2.53.0, lockfile recompiled with uv (#180) (495ced5)
• build(ci): bump codeql-action init/autobuild/analyze to v4.37.6 (#179) (16c0a5b)
• build(ci): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 (#176) (a96d062)
• chore(deps): bump the gomod-minor-patch group with 6 updates (#178) (b2815ad)
• chore(deps): bump the npm-minor-patch group in /ui with 5 updates (#172) (74b08af)
• build(docker): bump aquasec/trivy from 0.72.0 to 0.73.0 in /docker (#169) (06855ae)