Releases

How a release is built

A release is cut from a version tag (vMAJOR.MINOR.PATCH). The tagged commit has already passed CI, so the release workflow does not repeat the test suite; it builds the cross-compiled, pure-Go binaries for linux/amd64 and linux/arm64, produces a CycloneDX SBOM covering the Go modules and the vendored front-end, checksums every artifact, and signs the checksum manifest, the SBOM and the container image keyless with cosign. The image is signed by its content digest, not by a movable tag.

Everything you need to verify a download is in Verifying the install.

Versioning

PEART follows semantic versioning: the major number changes on a breaking change, the minor on a backward-compatible feature, the patch on a fix. A pre-release version carries a suffix (for example v1.2.0-rc1) and never becomes the latest tag a fresh install pulls.

Supported versions

While the project is before 1.0, only the latest released version receives security fixes. A vulnerability in a dependency that affects PEART is treated as a vulnerability in PEART: a fixed version is released with the dependency updated. See Reporting a vulnerability.

Changelog

The changelog records what changed between versions.