Releases: ko-build/ko
Releases · ko-build/ko
v0.14.0
Merge pull request #1079 from ko-build/dependabot/github_actions/slsa…
v0.13.0
What's Changed
- SPDX: Fix package manager label by @puerco in #801
- SPDX 2.3 support by @puerco in #803
- ci: build and test using 1.18 and 1.19 (drop 1.17) by @imjasonh in #812
- removes repo move message by @mchmarny in #814
- feat: write sbom result to disk by @developer-guy in #822
- feat: adding support for using multiple keychain for sending sbom results to a different repository by @developer-guy in #821
- Move docs to ko.build by @imjasonh in #749
- Update setup-ko version by @ianlewis in #836
- Add -- usage in readme by @jwcesign in #840
- add CONTRIBUTING, code of conduct, roadmap by @imjasonh in #837
- attempt to fix GH Pages publishing by @imjasonh in #843
- doc: fix link to Installation page in Getting Started by @antoineco in #846
- .ko.yaml: bump golang 1.18 -> 1.19 by @srenatus in #848
- truncate -image-refs file by @imjasonh in #855
- update docs: fix broken links, align with README by @imjasonh in #854
- Handle KO_DOCKER_REPO=ko.local/repo and --bare correctly by @imjasonh in #820
- another docs update by @imjasonh in #856
- ko.build: support some common shortlinks by @imjasonh in #872
- install: fail with 404 instead of gzip error when url was wrong by @grosser in #879
- feat: deduplicate tags by @bluebrown in #884
- install mkdocs-redirect when publishing site by @imjasonh in #873
- nit: replace one-item slice with const by @imjasonh in #885
- Temp fix for SLSA generators by @laurentsimon in #886
- Fix verifier by @laurentsimon in #891
- Fix link in static-assets.md by @yuryu in #893
- add KO_DEFAULTBASEIMAGE usage to docs by @developer-guy in #895
- Publish an tagged image on release by @vdemeester in #868
- Add option to configure default platforms by @ReToCode in #897
- Fix broken SLSA link by @imjasonh in #899
- add MAINTAINERS.md by @imjasonh in #905
- fix: possible race condition when applying templates to flags/ldflags by @caarlos0 in #913
- update docs to reflect actual default base image by @imjasonh in #903
- remove repeated error message on failure by @imjasonh in #921
- website: update CNCF announcement by @imjasonh in #920
- fix KO_CONFIG_PATH pointing to a file by @imjasonh in #923
- upgrade to cosign v2.0.0-rc.0 by @imjasonh in #933
- Feature: Add ECR presubmit testing. by @mattmoor in #934
- remove 'ko deps' by @imjasonh in #937
- feat: Add KO_GO_PATH env var by @embano1 in #930
- add ko.build/slack short link by @imjasonh in #945
- update link to ko goreleaser docs by @imjasonh in #936
- add ko community meeting details by @developer-guy in #938
- fix cosign by adding --yes by @imjasonh in #973
- fix: handle docker's unknown/unknown platform in index manifests by @imjasonh in #975
- fix file extension for cyclonedx by @developer-guy in #974
New Contributors
- @ianlewis made their first contribution in #836
- @jwcesign made their first contribution in #840
- @srenatus made their first contribution in #848
- @grosser made their first contribution in #879
- @bluebrown made their first contribution in #884
- @yuryu made their first contribution in #893
- @vdemeester made their first contribution in #868
- @ReToCode made their first contribution in #897
- @embano1 made their first contribution in #930
Full Changelog: v0.12.0...v0.13.0
Contributors
vdemeester, grosser, and 15 other contributors
Assets 15
v0.12.0
What's Changed
- Bump github.com/docker/docker from 20.10.13+incompatible to 20.10.14+incompatible by @dependabot in #673
- Add purls to SPDX sbom by @puerco in #677
- Bump actions/setup-go from 2 to 3 by @dependabot in #680
- Bump sigstore/cosign-installer from 2.1.0 to 2.2.0 by @dependabot in #683
- Bump codecov/codecov-action from 2.1.0 to 3.0.0 by @dependabot in #682
- Bump actions/upload-artifact from 2 to 3 by @dependabot in #681
- Bump ecr-login dep and update WithLogger callsite by @imjasonh in #658
- check and use the latest go available for the defined version by @cpanato in #690
- Bump k8s.io/apimachinery from 0.23.5 to 0.23.6 by @dependabot in #691
- Bump codecov/codecov-action from 3.0.0 to 3.1.0 by @dependabot in #692
- Bump github.com/spf13/viper from 1.10.1 to 1.11.0 by @dependabot in #686
- Bump github.com/containerd/stargz-snapshotter/estargz from 0.11.3 to 0.11.4 by @dependabot in #685
- Bump github.com/google/go-cmp from 0.5.7 to 0.5.8 by @dependabot in #695
- Bump sigstore/cosign-installer from 2.2.1 to 2.3.0 by @dependabot in #697
- Bump github/codeql-action from 1 to 2 by @dependabot in #696
- Fix texts regarding SBOM by @otms61 in #698
- Bump k8s.io/apimachinery from 0.23.6 to 0.24.0 by @dependabot in #701
- Bump github.com/docker/docker from 20.10.14+incompatible to 20.10.15+incompatible by @dependabot in #700
- Bump sigs.k8s.io/kind from 0.12.0 to 0.13.0 by @dependabot in #703
- Bump github.com/docker/docker from 20.10.15+incompatible to 20.10.16+incompatible by @dependabot in #704
- Bump sigs.k8s.io/kind from 0.13.0 to 0.14.0 by @dependabot in #708
- Bump goreleaser/goreleaser-action from 2.9.1 to 3.0.0 by @dependabot in #709
- Use sync.Map to cache base image lookups by @imjasonh in #712
- Bump k8s.io/apimachinery from 0.24.0 to 0.24.1 by @dependabot in #714
- Bump github.com/spf13/viper from 1.11.0 to 1.12.0 by @dependabot in #715
- add warning when using both --local and KO_DOCKER_REPO to ko.local by @cpanato in #629
- Bump gopkg.in/yaml.v3 from 3.0.0 to 3.0.1 by @dependabot in #719
- Bump deps to silence security alerts by @imjasonh in #667
- check if have all and other platforms set in the --platform flag by @cpanato in #630
- Bump github.com/sigstore/cosign from 1.8.0 to 1.9.0 by @dependabot in #721
- docs(readme): add sbom section by @developer-guy in #710
- allow refs-file to be read by other users by @seankhliao in #723
- Bump golang.org/x/tools from 0.1.10 to 0.1.11 by @dependabot in #724
- Bump github.com/docker/docker from 20.10.16+incompatible to 20.10.17+incompatible by @dependabot in #725
- Bump sigstore/cosign-installer from 2.3.0 to 2.4.0 by @dependabot in #726
- build: Imply current import path by @imjasonh in #717
- Allow KO_CONFIG_PATH to be a file by @benmoss in #731
- Bump k8s.io/apimachinery from 0.24.1 to 0.24.2 by @dependabot in #732
- Bump github.com/google/go-containerregistry from 0.9.0 to 0.10.0 by @dependabot in #735
- Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 by @dependabot in #734
- Update base image to ghcr.io/distroless/static:latest by @imjasonh in #737
- Convert our SPDX SBOMs to spdx+json. by @mattmoor in #740
- Fix off-by-one error by @mattmoor in #742
- Add externalDocumentRefs to SPDX doc type by @puerco in #741
- Bump sigstore/cosign-installer from 2.4.0 to 2.4.1 by @dependabot in #746
- Unconditionally set the base image annotation. by @mattmoor in #745
- Start emitting multi-arch SBOMs for
SPDXwithkoby @mattmoor in #743 - Add base image information to SPDX SBOMs by @mattmoor in #744
- don't fail if LDFLAGS env isn't set by @imjasonh in #758
- Several SPDX SBOM adjustments. by @mattmoor in #760
- Decorate per-architecture images with base image annotations. by @mattmoor in #759
- Have
--image-refslist all images for multi-arch builds. by @mattmoor in #761 - remove deprecated k8s flags support by @imjasonh in #750
- Reject the -toolexec flag by @imjasonh in #752
- Add installation instructions for Alpine by @imjasonh in #754
- ko run: remove --generator flag by @imjasonh in #751
- exercise symlink chasing without .git by @imjasonh in #763
- Chore: bumped base image to go 1.18 by @ellistarn in #764
- Add a delimiter before digest in the SPDX namespace by @mattmoor in #765
- Bump k8s.io/apimachinery from 0.24.2 to 0.24.3 by @dependabot in #767
- Bump github.com/containerd/stargz-snapshotter/estargz from 0.11.4 to 0.12.0 by @dependabot in #768
- Use chainguard-dev/actions/setup-registry by @imjasonh in #772
- bump go-containerregistry dependency by @imjasonh in #773
- Remove redundant return path by @jonjohnsonjr in #774
- fix GitHub Actions workflows by @imjasonh in #777
- Deprecate ko deps by @imjasonh in #770
- Set layer media types consistently by @imjasonh in #776
- Add kind e2e test for ko run by @imjasonh in #779
- Add tests that ko can push to quay.io and Dockerhub by @imjasonh in #778
- Fix e2e push tests, these registries need --bare by @imjasonh in #780
- Bump github.com/sigstore/cosign from 1.9.0 to 1.10.0 by @dependabot in #781
- Bump golang.org/x/tools from 0.1.11 to 0.1.12 by @dependabot in #783
- Bump sigstore/cosign-installer from 2.4.1 to 2.5.0 by @dependabot in #784
- Bump github.com/sigstore/cosign from 1.10.0 to 1.10.1 by @dependabot in #786
- expose commands.ResolveFilesToWriter() method by @joshrwolf in #787
- feat: generate SLSA provenance for release binaries by @laurentsimon in #730
- adds org move message by @mchmarny in #789
- update default base image to distroless.dev/static by @imjasonh in #790
- Error if image platform does not match desired by @benmoss in #785
- Bump k8s.io/apimachinery from 0.24.3 to 0.24.4 by @dependabot in #792
- Bump github.com/sigstore/cosign from 1.10.1 to 1.11.0 by @dependabot in #793
- Bump sigstore/cosign-installer from 2.5.0 to 2.5.1 by @dependabot in #794
- Extend ko.local and kind.local detection to include sub-repos by @imjasonh in #796
- Support --tag and --tag-only with nop publisher by @imjasonh in #797
New Contributors
- @puerco made their first contribution in #677
- @otms61 made their first contribution in #698
- @seankhliao made their first contribution in #723
- @ellistarn made their first contribution in #764
- @joshrwolf made their first contribution in #787
- @laurentsimon made their first contribution in #730
- @mchmarny made their first contribution in #789
Full Changelog: v0.11.2...v0.12.0
Contributors
mchmarny, imjasonh, and 12 other contributors
Assets 15
v0.11.2
Changelog
- 9459e51: Bump github.com/containerd/stargz-snapshotter/estargz (#664) (@dependabot[bot])
- 61b3ccd: Bump golang.org/x/tools from 0.1.9 to 0.1.10 (#663) (@dependabot[bot])
- 327a88f: Bump k8s.io/apimachinery from 0.23.4 to 0.23.5 (#662) (@dependabot[bot])
- cefd28f: go1.18: Preserve trailing tabs while massaging
go version -moutput (#668) (@tstromberg)
Contributors
tstromberg and dependabot
Assets 14
v0.11.1
v0.11.0
v0.10.0
Changelog
- 729419a: Add 'ko build' as a preferred alias for 'ko publish' (#456) (@imjasonh)
- 96bedf1: Add .ko.yaml to base ko container image on golang:1.17 (#533) (@imjasonh)
- 2fbc908: Add
Trimpathbuild option (@halvards) - 1425e4b: Add a mutex to map writing when using KOCACHE (#580) (@imjasonh)
- a8c0773: Add a workflow to push a :latest ko image to ghcr.io (#528) (@imjasonh)
- 22c9a52: Add coverage of --platform=a,b (#547) (@mattmoor)
- 9821190: Add e2e test for using ldflags to set a build-time variable (#480) (@imjasonh)
- da244de: Add how to use Azure Container Apps (#561) (@koudaiii)
- 00d0a34: Add integration test config to repo (@halvards)
- f5762be: Add support for
--image-refs(#555) (@mattmoor) - 6d06913: Add support for writing SBOMs when the
build.Resultisoci.Signed*. (#506) (@mattmoor) - 84e8ab6: Allow to customize
publish.Namer(#477) (@cardil) - 73a4629: Always clean Dir for packages.Load (@jonjohnsonjr)
- 465eca2: Always produce OCI images and indexes (#449) (@imjasonh)
- 2502eb9: Build each platform concurrently (#527) (@jonjohnsonjr)
- 7477a29: Bump github.com/containerd/stargz-snapshotter/estargz (#464) (@dependabot[bot])
- 933e908: Bump github.com/containerd/stargz-snapshotter/estargz (#508) (@dependabot[bot])
- 32490da: Bump github.com/containerd/stargz-snapshotter/estargz (#577) (@dependabot[bot])
- 6230daa: Bump github.com/docker/docker (#466) (@dependabot[bot])
- b1c35d2: Bump github.com/docker/docker (#490) (@dependabot[bot])
- b20faa5: Bump github.com/docker/docker (#510) (@dependabot[bot])
- ddf9257: Bump github.com/docker/docker (#559) (@dependabot[bot])
- 70b671c: Bump github.com/google/go-cmp from 0.5.6 to 0.5.7 (#567) (@dependabot[bot])
- f44a16c: Bump github.com/google/go-containerregistry from 0.6.0 to 0.7.0 (#503) (@dependabot[bot])
- 64df1a7: Bump github.com/google/go-containerregistry from 0.7.0 to 0.8.0 (#565) (@dependabot[bot])
- fd81c29: Bump github.com/spf13/cobra from 1.2.1 to 1.3.0 (#557) (@dependabot[bot])
- 815a59a: Bump github.com/spf13/viper from 1.10.0 to 1.10.1 (#558) (@dependabot[bot])
- a1c8717: Bump github.com/spf13/viper from 1.9.0 to 1.10.0 (#529) (@dependabot[bot])
- b7c9449: Bump golang.org/x/tools from 0.1.6 to 0.1.7 (#465) (@dependabot[bot])
- 5565544: Bump golang.org/x/tools from 0.1.8 to 0.1.9 (#575) (@dependabot[bot])
- 08dfc02: Bump k8s.io/apimachinery from 0.22.2 to 0.22.3 (#489) (@dependabot[bot])
- 23c6850: Bump k8s.io/apimachinery from 0.22.3 to 0.22.4 (#509) (@dependabot[bot])
- 2ba70fc: Bump k8s.io/apimachinery from 0.22.4 to 0.23.0 (#531) (@dependabot[bot])
- 1a12a62: Bump k8s.io/apimachinery from 0.23.0 to 0.23.1 (#556) (@dependabot[bot])
- 64fa5ed: Bump k8s.io/apimachinery from 0.23.1 to 0.23.3 (#576) (@dependabot[bot])
- ad0607f: Cache base image metadata in-memory (#525) (@jonjohnsonjr)
- 5ac3ef9: Clean filepath from zip before creating tempdir (#459) (@imjasonh)
- 3edb68b: Connect SBOMs with SPDX support. (#511) (@mattmoor)
- 5617d1e: Document /ko-app/ and entrypoint in README.md (#499) (@imjasonh)
- 1e3c8ae: Document ko publish in README (#469) (@imjasonh)
- 52d42d8: Document setup-ko in README.md (#484) (@imjasonh)
- b9cd759: Don't log the value of --password if given (#458) (@imjasonh)
- 0015a81: Enforce more lint checks, fix findings (#492) (@imjasonh)
- a56047a: Filter out nil addendum before constructing index. (#546) (@mattmoor)
- 6cc2d7f: Fix #530 Hanging behavior with ASDF installed Go on Darwin (#548) (@StevenACoffman)
- a41529e: Fix Windows e2e test (#599) (@imjasonh)
- 66a77a9: Fix handling of 'has' selectors (#473) (@antoineco)
- de2ce53: Fix issue where kubectl apply is run in place of kubectl create (#494) (@sbwsg)
- 5a13603: Fix tarball publisher ctx handling (#545) (@jonjohnsonjr)
- 98ff104: Generate CycloneDX SBOMs using our own JSON generation (#587) (@imjasonh)
- af2ff52: Generate ko deps in SPDX format (#507) (@imjasonh)
- b9f9268: Improve build config issue error scenario #483 (#487) (@HeavyWombat)
- 89ede91: Include cred helpers in keychain (#581) (@imjasonh)
- 70f0273: Introduce --verbose flag that enables logs.Warn logs (#600) (@imjasonh)
- 54cddcc: Introduce KOCACHE (#269) (@jonjohnsonjr)
- f8d0aca: Log base image@digest when building (#592) (@imjasonh)
- 08fccaa: Mention other tools that integrate with ko (#504) (@imjasonh)
- 5787600: Normalize the package hash to hex. (#512) (@mattmoor)
- c67fb03: Pre-parse platform string with StringSliceVar (#551) (@wilsonehusin)
- b813b95: Prepare for Go 1.18 by replacing all our forked code (#549) (@imjasonh)
- dde6c6d: Re-enable codeql analysis (#457) (@imjasonh)
- 42723d7: Revert "Always produce OCI images and indexes (#449)" (#462) (@imjasonh)
- 5640c33: Run golangci-lint before tool setup to fix tar errors (#518) (@markusthoemmes)
- e961890: Set GOAMD64 if variant is set (#578) (@imjasonh)
- 8135bf2: Set config creation time without mutating (#524) (@imjasonh)
- 0187841: Sign image using cosign (#595) (@imjasonh)
- 33fa766: Support osversion when selecting base images (#536) (@imjasonh)
- 5f733f9: Support partial platform matching for osversion only (#572) (@imjasonh)
- 3fc720f: Update ecr-login dependency to allow us to avoid logspam (#586) (@imjasonh)
- d91d7a4: Update golangci-lint and fix issues (#519) (@markusthoemmes)
- 103ff5b: Use build config Dir for all go tool commands (@halvards)
- 6ff3469: Use default
completioncommand provided by cobra. (#522) (@darklore) - 1e46fde: Use signal.NotifyContext and cmd.Context (#482) (@imjasonh)
- 5d7673e: Use tools/go/packages in place of go/build (#486) (@benmoss)
- 3e5ee5b: Validate KO_CONFIG_PATH (#471) (@tcnghia)
- 6014fcd: bump containerd dependency (#463) (@imjasonh)
- 6447264: use github api to generate the changelog (#474) (@caarlos0)
Contributors
halvards, tcnghia, and 14 other contributors
Assets 14
v0.9.3
v0.9.2
v0.9.1
Changelog
v0.9.0 was released incorrectly, and should not be used.
The full commit log since the previous release is available here: v0.8.3...v0.9.1
Highlights
- enable
ko's logic to be embedded in other Go programs #348 - enable base images from the Docker daemon (
ko.local) #371 - add support for Go build flags #340
- annotate built images with base image annotations #354
- build working Windows images #374
- implement
ko deps#403 - deprecate
--watch#434
😍 Thanks 😍
ko wouldn't be possible without the work of its dedicated contributors. Thanks to @halvards @HeavyWombat @jonjohnsonjr @imjasonh @mattmoor
Contributors
halvards, imjasonh, and 3 other contributors