Supply chain
Releases now ship verification material alongside the jar:
| Asset | Purpose |
|---|---|
keycloak-home-idp-discovery.jar
| The extension |
SHA256SUMS
| SHA-256 checksum of the jar |
bom.json
| CycloneDX 1.6 SBOM |
Builds are also attested with GitHub build provenance. To verify a download:
sha256sum -c SHA256SUMS
gh attestation verify keycloak-restrict-client-auth.jar -R sventorben/keycloak-restrict-client-auth
The jar published to GitHub Packages, the jar attached to this release, SHA256SUMS and the
provenance attestation all describe the same build.
Note
The SBOM lists no components. This is expected: the extension bundles no third-party code.
Everything it needs at runtime is supplied by the Keycloak server and covered by Keycloak's own SBOM.
What's Changed
✨ New Features
- Add display and help text for "Try another way" selection dialog by @sventorben in #482
- chore: add SBOM, checksums, and build provenance to releases by @sventorben in #501
⬆️ Dependency Updates
- chore(deps): Update Keycloak dependencies to 26.7.0 by @sventorben in #510
Full Changelog: v26.1.0...v26.1.1