Release v0.8.2

What's Changed

Fixed

• Bump native-maven-plugin to 1.1.7 to fix the native build failing with a missing org.apache.maven.shared.utils.logging.MessageUtils class (upstream regression in 1.1.6).
• Unblock the windows-x86_64 native build, broken since harden-runner v2.20.0 began enforcing egress-policy: block on Windows runners: allow the Let's Encrypt CRL distribution points (*.c.lencr.org) that the Windows TLS stack needs to reach Maven Central, and prefer Git's OpenSSL curl (with an mvnw.cmd fallback) so a future intermediate rotation cannot stale that allowlist.

Changed

• Pass github-token to setup-graalvm in the native build to avoid unauthenticated api.github.com rate limits.
• Update pinned GitHub Actions (checkout v7.0.1, setup-java v5.6.0, setup-uv v9.0.0, codeql-action v4.37.3, setup-graalvm v1.6.3, harden-runner v2.20.0, trufflehog v3.96.0, zizmor-action v0.6.1, reviewdog action-actionlint v1.73.0, action-markdownlint v0.28.0).
• Update Maven build dependencies (JUnit Jupiter 6.1.2, Kotlin 2.4.10, flatten-maven-plugin 1.8.0).
• Update pinned tool versions (cdxgen 12.8.2, cyclonedx-cli 0.33.1, opengrep 1.26.0, trufflehog 3.96.0, prek 0.4.11, ruff 0.16.0) and prek hook revisions (zizmor v1.29.0, ruff v0.16.1, markdownlint-cli v0.49.1, betterleaks v1.7.3, trufflehog v3.96.0).

19 commits since v0.8.1

Changes

• 2ff0b3d docs: update changelog for changes since 0.8.1
• 83428c8 ci: drop contents: read from the nested native build job
• bf25d30 ci: allow CRL endpoints so windows native build reaches Maven Central
• 695e14b ci: update pinned tool versions
• b4ce026 ci: update pinned tool versions

Dependency updates

• ba17ab0 ci(deps): bump @cyclonedx/cdxgen
• 9c8d9e7 ci(deps): bump brace-expansion in /tools/github-workflow-tools
• 2b2e452 ci(deps): bump fast-uri in /tools/github-workflow-tools
• e0c095c ci(deps-dev): bump the python-workflow-tools group
• 709724d build(deps): bump native-maven-plugin to 1.1.7
• 4b91b4e ci(deps): bump @cyclonedx/cdxgen
• 83db2b5 ci(deps-dev): bump the python-workflow-tools group
• 53054d7 build(deps): bump the dependencies group across 1 directory with 2 updates
• 6d8ac7b build(deps): bump the maven-plugins group across 1 directory with 2 updates
• 32a2a30 ci(deps): bump the github-actions group across 1 directory with 12 updates
• 50ba0c8 ci(deps): bump @cyclonedx/cdxgen
• 384a554 ci(deps-dev): bump the python-workflow-tools group
• eda0545 ci(deps): bump the github-actions group with 8 updates
• 6cb1201 build(deps): bump org.graalvm.buildtools:native-maven-plugin

Contributors

• Mikaël Barbero

Verifying this release

Every asset has a detached OpenPGP signature (.asc) made by the Eclipse CSI project key,
and checksums_sha256.txt covers all of them.

# 1. Import the signing key, then verify the checksum manifest
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1ad4cb37c5f4d8f6c65a0759b1ef2693a64a8e8d
gpg --verify checksums_sha256.txt.asc checksums_sha256.txt

# 2. Verify what you downloaded against the manifest
sha256sum --ignore-missing -c checksums_sha256.txt   # Linux
shasum -a 256 --ignore-missing -c checksums_sha256.txt   # macOS

# 3. Verify the build provenance of the CLI fat JAR
gh attestation verify codesign-cli-0.8.2-bin.jar --repo eclipse-csi/codesign-tools

The key is fetched above by the identifier published here, so gpg --verify should report
Good signature from "Eclipse Common Security Infrastructure Project <csi-dev@eclipse.org>".
It also warns that the key is not certified by you, which is expected unless you have signed
it yourself.

Maven Central

Artifact	Coordinates
API	org.eclipse.csi:codesign-api:0.8.2
Maven plugin	org.eclipse.csi:codesign-maven-plugin:0.8.2
CLI	org.eclipse.csi:codesign-cli:0.8.2

Full changelog: v0.8.1...v0.8.2

Release v0.8.1

What's Changed

Changed

• Move workflow tooling manifests from .github/tools to tools/github-workflow-tools so Dependabot can manage them.
• Restrict Dependabot updates for the workflow tools npm ecosystem to direct dependencies.
• Update pinned GitHub Actions (checkout v7, dependency-review-action v5, codeql-action, harden-runner, setup-java, trivy-action, setup-uv, setup-graalvm, cosign-installer, trufflehog, zizmor-action, reviewdog actions, attest-build-provenance).
• Update Maven build dependencies (Maven 3.9.16, okhttp 5.4.0, JUnit Jupiter 6.1.1, Kotlin 2.4.0, and the maven-plugins group).
• Update pinned tool versions (cdxgen, cyclonedx-cli, opengrep, poutine, trufflehog, prek, ruff).

Fixed

• Disable base64 line-wrapping when building the gh-pages push auth header in the site workflow.

30 commits since v0.7.3

Changes

• bac0406 build(release): prepare release 0.8.1
• 9b4d4f7 fix(release): honor gpg.format so SSH commit/tag signing works
• 0efb455 docs: update changelog for upcoming 0.7.4 release
• fde44d0 ci: disable base64 line-wrapping when building gh-pages push auth header
• 3840288 ci: update pinned tool versions
• 63c496b ci: move tools repo outside of .github for dependabot
• a2e78e8 ci: update pinned tool versions
• 4f55380 ci: update pinned tool versions
• 8040273 ci: update pinned tool versions

Dependency updates

• 23f2087 ci(deps-dev): bump the python-workflow-tools group
• a056be8 ci(deps): bump @cyclonedx/cdxgen
• a6ba721 build(deps): bump the maven-plugins group across 1 directory with 5 updates
• 92b1706 build(deps): bump the dependencies group across 1 directory with 4 updates
• ede7a89 ci(deps): bump the github-actions group across 1 directory with 13 updates
• 40c5346 ci(deps-dev): bump the python-workflow-tools group
• 6ea9785 ci(deps): bump @cyclonedx/cdxgen
• 9eeb08d ci(deps): bump the github-actions group across 1 directory with 2 updates
• 8260509 ci(deps): add allow rule for direct dependencies in dependabot
• fb4e504 build(deps): bump the maven-plugins group across 1 directory with 5 updates
• a4f2901 build(deps): bump org.junit.jupiter:junit-jupiter
• a782c0d ci(deps): bump the github-actions group with 3 updates
• 19a2af8 ci(deps-dev): bump prek
• b96b047 ci(deps): bump @cyclonedx/cdxgen
• a23c058 ci(deps): bump the github-actions group with 5 updates
• 4ae09c5 build(deps): bump the dependencies group with 2 updates
• 294d820 build(deps): bump org.apache.maven.plugins:maven-enforcer-plugin
• 3ecdc14 ci(deps): bump @cyclonedx/cdxgen
• 10c1a5b ci(deps-dev): bump the python-workflow-tools group
• 392b750 build(deps): bump the maven-plugins group across 1 directory with 2 updates
• e7cf030 ci(deps): bump the github-actions group across 1 directory with 4 updates

Contributors

• Mikaël Barbero

Verifying this release

Every asset has a detached OpenPGP signature (.asc) made by the Eclipse CSI project key,
and checksums_sha256.txt covers all of them.

# 1. Import the signing key, then verify the checksum manifest
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1ad4cb37c5f4d8f6c65a0759b1ef2693a64a8e8d
gpg --verify checksums_sha256.txt.asc checksums_sha256.txt

# 2. Verify what you downloaded against the manifest
sha256sum --ignore-missing -c checksums_sha256.txt   # Linux
shasum -a 256 --ignore-missing -c checksums_sha256.txt   # macOS

# 3. Verify the build provenance of the CLI fat JAR
gh attestation verify codesign-cli-0.8.1-bin.jar --repo eclipse-csi/codesign-tools

The key is fetched above by the identifier published here, so gpg --verify should report
Good signature from "Eclipse Common Security Infrastructure Project <csi-dev@eclipse.org>".
It also warns that the key is not certified by you, which is expected unless you have signed
it yourself.

Maven Central

Artifact	Coordinates
API	org.eclipse.csi:codesign-api:0.8.1
Maven plugin	org.eclipse.csi:codesign-maven-plugin:0.8.1
CLI	org.eclipse.csi:codesign-cli:0.8.1

Full changelog: v0.7.3...v0.8.1

Release v0.7.3

What's Changed

Security

• Switch from gitleaks to betterleaks for secret scanning in CI.
• Add dependency-review-action for license and vulnerability vetting of dependencies introduced in PRs.
• Check for high and critical vulnerabilities in the release script.

Added

• Integrate poutine into CI guardrail: violations are reported as code scanning alerts. Trusted actions from 'unverified' creators are excluded from poutine checks.
• Include poutine in the pinned-tool-versions update check.

Changed

• Drop macOS Intel (osx-x86_64) builds — no longer supported by GraalVM.
• Remove osx-x86_64 from JReleaser configuration (the binary is no longer built).
• Upgrade GraalVM distribution to 25 and graalvm/setup-graalvm action to v1.5.2.
• Rename reviewdog workflow to prs-review.
• Extend allowed network endpoints in CI workflows to include raw.githubusercontent.com and api.deps.dev.
• Move .poutine.yml to .github/poutine.yml.
• Switch Dependabot update interval from weekly to daily.
• Update pinned tool versions and CI/build dependencies (python-workflow-tools, setup-uv, kotlin-stdlib, prek, native-maven-plugin, gson, cdxgen, harden-runner, trufflehog).

Fixed

• Fix hook-coverage script and documentation following the rename of the reviewdog workflow to prs-review.
• Fix fetch of ci/update-pinned-tool-versions script in workflow.
• Fix README lint issue.

67 commits since v0.6.2

Changes

• 7d5e946 build: update version in pom.xml to 0.7.3-SNAPSHOT
• 06a2d98 docs: add back unreleased section
• a09c32d build: osx-x86_64 is not built anymore, remove all references
• 97f286e chores(doc): update changelog for next release
• 23cf3a0 build: osx-x86_64 is not built anymore, remove it from the assemble and release job
• b0f280f chores(doc): update changelog for next release
• 89e091a build: osx-x86_64 is not built anymore, remove it from jreleaser config as well
• b5c0aaa feat: check for high and critical vulnerability in release script
• d7c2fab chore: update changelog
• b4d7766 ci: update pinned tool versions
• a9b094f ci: change Dependabot update interval from weekly to daily
• 4e3020f ci: update pinned tool versions
• 5b021ad chore: moved .poutine.yml to .github/poutine.yml
• 9bbcb80 ci: update pinned tool versions
• a42f108 ci: macos intel is not supported anymore by graalvm
• dee5287 ci: update pinned tool versions
• 449bb12 chore(deps-ci): allow reaching out to releases.astral.sh for tools maintenance workflow
• 4f1658f chore(deps-ci): graalvm distribution to 25
• 779c302 chore(deps-ci): update graalvm/setup-graalvm action to v1.5.2
• 6a5d135 fix(ci): allow raw.githubusercontent.com endpoint for 'update-versions' job
• 11e67ed fix(ci): add more allowed-endpoints for prek job (3)
• 085bb9a chores(ci): fix linting in ci scripts
• 6525bb0 fix(ci): add more allowed-endpoints for prek job (2)
• c93b8dc fix(ci): add more allowed-endpoints for prek job
• 16c1a1f chores: update changelogs
• 7962036 fix(ci): fix hook-coverage doc after the renaming of the reviewdog workflow
• 410f814 fix(ci): fix check-hook-coverage script after the renaming of the reviewdog workflow
• 3ac3d71 ci: allow calls to api.deps.dev from actions/dependency-review-action and rename reviewdog to prs-review
• 5564a36 build: make poutine ignore trusted actions from 'unverified' creator
• 3fdb81d ci: add raw.githubusercontent.com to allowed-endpoints for some more steps
• 370a5af ci: add raw.githubusercontent.com to allowed-endpoints for some steps
• b2cea5d ci: added dependency-review-action for license and vulnerability vetting of dependencies in PR
• ed8c817 ci: do not fail on poutine violation in ci guardrail, it will create code scanning alerts anyway
• a9c78a5 ci: update pinned tool versions
• aed1209 ci: fix fetch of ci/update-pinned-tool-versions in workflow
• 6a304c3 ci: also check for poutine's update
• 7e235f6 ci: reverted back fail on poutine violation to get scanner results
• 9b62825 docs: fix lint in README
• c111ca3 build: fix poutine early failure
• fdbde65 build: fail on poutine violation
• 997014c build: switched from gitleaks to betterleaks

Dependency updates

• 0bc7c10 build(deps): bump com.google.code.gson:gson in the dependencies group
• 8728a95 ci(deps): bump step-security/harden-runner in the github-actions group
• 7d7436d build(deps): bump org.jetbrains.kotlin:kotlin-stdlib
• d952189 build(deps): bump the maven-plugins group with 2 updates
• edee40f ci(deps): bump @cyclonedx/cdxgen
• 5c8bb24 ci(deps): bump the github-actions group with 2 updates
• 443bd02 ci(deps-dev): bump the python-workflow-tools group
• 4041f3e build(deps): bump the dependencies group with 3 updates
• 46e9853 ci(deps): bump @cyclonedx/cdxgen
• e8de922 ci(deps-dev): bump ruff
• f1b119d ci(deps): bump the github-actions group with 2 updates
• 881dce4 ci(deps): bump the github-actions group with 2 updates
• 29e3ab5 ci(deps-dev): bump ruff
• 74e938b ci(deps): bump trufflesecurity/trufflehog in the github-actions group
• 61ebf91 build(deps): bump org.graalvm.buildtools:native-maven-plugin
• 1c99a0a ci(deps): bump the github-actions group with 2 updates
• 872d1c2 ci(deps): bump @cyclonedx/cdxgen
• b950fea ci(deps-dev): bump ruff
• bc6ec48 ci(deps): bump the github-actions group with 5 updates
• 8dfedd8 ci(deps): bump brace-expansion from 5.0.4 to 5.0.5 in /.github/tools
• e40094b ci(deps): bump picomatch from 4.0.3 to 4.0.4 in /.github/tools
• 9a4b536 ci(deps): bump tar and @cyclonedx/cdxgen in /.github/tools
• 186d2b5 ci(deps-dev): bump the python-workflow-tools group
• 9e1be0e ci(deps): bump astral-sh/setup-uv in the github-actions group
• bc6ed16 build(deps): bump org.jetbrains.kotlin:kotlin-stdlib
• 2699f1a ci(deps-dev): bump prek

Contributors

• Mikaël Barbero

Verifying this release

Every asset has a detached OpenPGP signature (.asc) made by the Eclipse CSI project key,
and checksums_sha256.txt covers all of them.

# 1. Import the signing key, then verify the checksum manifest
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1ad4cb37c5f4d8f6c65a0759b1ef2693a64a8e8d
gpg --verify checksums_sha256.txt.asc checksums_sha256.txt

# 2. Verify what you downloaded against the manifest
sha256sum --ignore-missing -c checksums_sha256.txt   # Linux
shasum -a 256 --ignore-missing -c checksums_sha256.txt   # macOS

# 3. Verify the build provenance of the CLI fat JAR
gh attestation verify codesign-cli-0.7.3-bin.jar --repo eclipse-csi/codesign-tools

The key is fetched above by the identifier published here, so gpg --verify should report
Good signature from "Eclipse Common Security Infrastructure Project <csi-dev@eclipse.org>".
It also warns that the key is not certified by you, which is expected unless you have signed
it yourself.

Maven Central

Artifact	Coordinates
API	org.eclipse.csi:codesign-api:0.7.3
Maven plugin	org.eclipse.csi:codesign-maven-plugin:0.7.3
CLI	org.eclipse.csi:codesign-cli:0.7.3

Full changelog: v0.6.2...v0.7.3

Release v0.6.2

What's Changed

Changed

• Update build and ci dependencies

12 commits since v0.6.1

Changes

• 5c02770 build: added validation messages to release script
• e44fdb7 doc: updated changelogs
• ff02f27 ci: align trivy-action tag with commit hash
• 9345001 ci: add raw.githubusercontent.com to allowed endpoint in Opengrep job
• 4c9dd25 ci: update pinned tool versions
• 7a81f11 docs: update README with project badges

Dependency updates

• 9f2c14a ci(deps): update harden-runner to latest (fix vuln)
• 3e759d7 ci(deps): bump the github-actions group with 3 updates
• 65fa3b3 ci(deps-dev): bump ruff
• d9acdbe build(deps): bump the dependencies group with 2 updates
• 33a7682 ci(deps): bump zizmorcore/zizmor-action in the github-actions group
• 7d72204 ci(deps-dev): bump prek

Contributors

• Mikaël Barbero

Verifying this release

Every asset has a detached OpenPGP signature (.asc) made by the Eclipse CSI project key,
and checksums_sha256.txt covers all of them.

# 1. Import the signing key, then verify the checksum manifest
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1ad4cb37c5f4d8f6c65a0759b1ef2693a64a8e8d
gpg --verify checksums_sha256.txt.asc checksums_sha256.txt

# 2. Verify what you downloaded against the manifest
sha256sum --ignore-missing -c checksums_sha256.txt   # Linux
shasum -a 256 --ignore-missing -c checksums_sha256.txt   # macOS

# 3. Verify the build provenance of the CLI fat JAR
gh attestation verify codesign-cli-0.6.2-bin.jar --repo eclipse-csi/codesign-tools

The key is fetched above by the identifier published here, so gpg --verify should report
Good signature from "Eclipse Common Security Infrastructure Project <csi-dev@eclipse.org>".
It also warns that the key is not certified by you, which is expected unless you have signed
it yourself.

Maven Central

Artifact	Coordinates
API	org.eclipse.csi:codesign-api:0.6.2
Maven plugin	org.eclipse.csi:codesign-maven-plugin:0.6.2
CLI	org.eclipse.csi:codesign-cli:0.6.2

Full changelog: v0.6.1...v0.6.2

Release v0.6.1

What's Changed

Fixed

• Fit shellcheck calls in reviewdog workflow

Changed

• Grant issues:write permission for JReleaser release labeling

7 commits since v0.6.0

Changes

• 72f908f docs: updates CHANGELOG
• e22abac fix: grant issues:write permission for JReleaser release labeling
• e6fd833 fix: pass shell files as separate args to shellcheck in reviewdog

Dependency updates

• 1dca17b ci(deps): bump the github-actions group across 1 directory with 2 updates
• dde96d1 build(deps): bump the maven-plugins group with 2 updates
• 3b1b6a3 ci(deps-dev): bump ruff
• bf6dd12 build(deps): bump the dependencies group with 2 updates

Contributors

• Mikaël Barbero

Verifying this release

Every asset has a detached OpenPGP signature (.asc) made by the Eclipse CSI project key,
and checksums_sha256.txt covers all of them.

# 1. Import the signing key, then verify the checksum manifest
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1ad4cb37c5f4d8f6c65a0759b1ef2693a64a8e8d
gpg --verify checksums_sha256.txt.asc checksums_sha256.txt

# 2. Verify what you downloaded against the manifest
sha256sum --ignore-missing -c checksums_sha256.txt   # Linux
shasum -a 256 --ignore-missing -c checksums_sha256.txt   # macOS

# 3. Verify the build provenance of the CLI fat JAR
gh attestation verify codesign-cli-0.6.1-bin.jar --repo eclipse-csi/codesign-tools

The key is fetched above by the identifier published here, so gpg --verify should report
Good signature from "Eclipse Common Security Infrastructure Project <csi-dev@eclipse.org>".
It also warns that the key is not certified by you, which is expected unless you have signed
it yourself.

Maven Central

Artifact	Coordinates
API	org.eclipse.csi:codesign-api:0.6.1
Maven plugin	org.eclipse.csi:codesign-maven-plugin:0.6.1
CLI	org.eclipse.csi:codesign-cli:0.6.1

Full changelog: v0.6.0...v0.6.1

Release v0.6.0

What's Changed

Security

• Use here-strings instead of echo piping for GPG key import in release workflow to avoid exposing secrets in process listings.

Fixed

• Fix Nexus2 snapshot deployer closeRepository and releaseRepository settings (should be false for snapshot deployments).

Changed

• Add explicit JReleaser release.github configuration with conventional-commits changelog preset, contributor listing, and issue linking.
• Add jreleaser:catalog step to create GitHub attestations for distribution artifacts (native binaries and fat JAR).
• Consolidate duplicate build steps in release workflow (publish and dry-run used identical commands).
• Upgrade upload-artifact to v7.0.0 in release workflow for consistency with native build workflow.

5 commits since v0.5.13

• b2196ac build: add release script to automate (and secure steps)
• cf65b3b feat: upgrade to 0.6.0-SNAPSHOT
• 4fae709 ci: validate tag format for site publishing
• bfe8bbb ci: harden release workflow and add JReleaser release/catalog configuration
• a1dbd55 doc: fix changelog

Contributors

• Mikaël Barbero

Verifying this release

Every asset has a detached OpenPGP signature (.asc) made by the Eclipse CSI project key,
and checksums_sha256.txt covers all of them.

# 1. Import the signing key, then verify the checksum manifest
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1ad4cb37c5f4d8f6c65a0759b1ef2693a64a8e8d
gpg --verify checksums_sha256.txt.asc checksums_sha256.txt

# 2. Verify what you downloaded against the manifest
sha256sum --ignore-missing -c checksums_sha256.txt   # Linux
shasum -a 256 --ignore-missing -c checksums_sha256.txt   # macOS

# 3. Verify the build provenance of the CLI fat JAR
gh attestation verify codesign-cli-0.6.0-bin.jar --repo eclipse-csi/codesign-tools

The key is fetched above by the identifier published here, so gpg --verify should report
Good signature from "Eclipse Common Security Infrastructure Project <csi-dev@eclipse.org>".
It also warns that the key is not certified by you, which is expected unless you have signed
it yourself.

Maven Central

Artifact	Coordinates
API	org.eclipse.csi:codesign-api:0.6.0
Maven plugin	org.eclipse.csi:codesign-maven-plugin:0.6.0
CLI	org.eclipse.csi:codesign-cli:0.6.0

Full changelog: v0.5.13...v0.6.0

Release v0.5.13

What's Changed

• Initial relase
• All previous releases were for testing and automating the release workflow.

1 commit since v0.5.12

• c76a895 fix: create native archives in shell instead of JReleaser nativeImage assembler

Contributors

• Mikaël Barbero

Verifying this release

Every asset has a detached OpenPGP signature (.asc) made by the Eclipse CSI project key,
and checksums_sha256.txt covers all of them.

# 1. Import the signing key, then verify the checksum manifest
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1ad4cb37c5f4d8f6c65a0759b1ef2693a64a8e8d
gpg --verify checksums_sha256.txt.asc checksums_sha256.txt

# 2. Verify what you downloaded against the manifest
sha256sum --ignore-missing -c checksums_sha256.txt   # Linux
shasum -a 256 --ignore-missing -c checksums_sha256.txt   # macOS

# 3. Verify the build provenance of the CLI fat JAR
gh attestation verify codesign-cli-0.5.13-bin.jar --repo eclipse-csi/codesign-tools

The key is fetched above by the identifier published here, so gpg --verify should report
Good signature from "Eclipse Common Security Infrastructure Project <csi-dev@eclipse.org>".
It also warns that the key is not certified by you, which is expected unless you have signed
it yourself.

Maven Central

Artifact	Coordinates
API	org.eclipse.csi:codesign-api:0.5.13
Maven plugin	org.eclipse.csi:codesign-maven-plugin:0.5.13
CLI	org.eclipse.csi:codesign-cli:0.5.13

Full changelog: v0.5.12...v0.5.13

Release v0.5.12

Changelog

d5b32ff feat: prepare for v0.5.12

Release v0.5.11

Changelog

3067bb2 feat: prepare for v0.5.11

Release v0.5.10

Changelog

1c3e3ce feat: prepare for v0.5.10