v0.3.1

Fixes #130 - adds omitempty to the cert field in signatures to maintain compatibility with non ITE-7 implementations.

v0.3.0

This release includes a fix for CVE-2021-41087. You can find the security advisory here: GHSA-vrxp-mg9f-hwf3

Other changes include:

• A CLI courtesy of the BoxBoat team
• Certificate support in in-toto metadata
• Updated PAE function to match DSSE v1
• Updated type to indicate provenance matches SLSA spec
• Fix to make Metadata field in Provenance optional to match the specification

This release supports Go 1.16 and 1.17.

Shout out to our contributors (in no particular order): Parth Patel (@pxp928), Dan Lorenc (@dlorenc), Brandon Mitchell (@sudo-bmitch), Mikhail Swift (@mikhailswift), Furkan Türkal (@Dentrax), Batuhan Apaydın (@developer-guy), Christian Rebischke (@shibumi), Santiago Torres-Arias (@SantiagoTorres).

v0.2.0

Supported Go Versions for this release:

• Go 1.16
• Go 1.15

Changes:

• support for ITE-6 data structures
• support for ITE-5 signature generation
• support for specifying a local directory when running inspections
• switch from golang.org/x/crypto/ed25519 to crypto/ed25519

Thanks to our contributors: Aditya Sirish, Christian Rebischke, Cindy Kim, Dan Lorenc, Fredrik Skogman, Lukas Puehringer, Omer Levi Hevroni, Radu M, Santiago Torres, Scott Buckel, seb-bah, Vaibhav Lodha

v0.1.0

Initial release