March 2025 - Sigsum-announce - Sigsum mailing lists

ANNOUNCE: log-go v0.15.2
by Niels Möller 25 Mar '25

25 Mar '25

The Sigsum team is happy to release a new version of the log-go log server software, version tag v0.15.2, succeeding the previous release v0.15.0. The source code for the release can be checked out from the git repository as git clone -b v0.15.2 https://git.glasklar.is/sigsum/core/log-go.git or installed using go install sigsum.org/log-go/cmd/...@v0.15.2 This is a bugfix release. The most important change is a correction to how the log server applies its configured rate limits. See NEWS file for details on changes, excerpt below. If you find any bugs, please report them on the sigsum-general(a)lists.sigsum.org mailing list or open an issue on GitLab in the log-go repository: https://git.glasklar.is/sigsum/core/log-go/ The expectations and intended use of the log server software is documented in the log-go RELEASES file. You will also find more information about the overall release process there, see https://git.glasklar.is/sigsum/core/log-go/-/blob/main/RELEASES.md. / The Sigsum team NEWS for log-go v0.15.2 This is minor release fixing a few issues found since the previous release. Upgrading from the previous release is expected to work with no issues. This release has been tested to work together with: * Sigsum tools (most importantly sigsum-submit and sigsum-verify, as well as sigsum-witness) https://git.glasklar.is/sigsum/core/sigsum-go, tag v0.11.2. Improvements: * Fixed a bug in the rate-limit logic. The intended behavior is to only count the first add-leaf requests for a particular leaf, and not count retries for the same leaf. In v0.15.0, retries could exhaust the rate limit quota. * More relevant logging of witness errors. When a witness starts failing, and when it recovers, the error is logged at INFO level. Repeated errors are logged at DEBUG level. In v0.15.0, all errors were logged at DEBUG level, i.e., no errors logged by default. Incompatible changes: * The --max-range command-line option is now only available for the primary node. Before this change, there was a --max-range command-line option also for the secondary node but that option had no effect. Miscellaneous: * Increased max-range default value to 512. * Updated config.toml.example file and added a corresponding test to help ensure the example config stays up-to-date.

1 0

ANNOUNCE: sigsum-go v0.11.2
by Rasmus Dahlberg 21 Mar '25

21 Mar '25

The Sigsum team is happy to announce a new version of the Sigsum tools, v0.11.2. The source code for the release can be checked out using git clone -b v0.11.2 https://git.glasklar.is/sigsum/core/sigsum-go.git or installed using go install sigsum.org/sigsum-go/cmd/...@v0.11.2 See the NEWS file https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/v0.11.2/NEWS or the excerpt below for the changes since v0.11.1. For further documentation and project information, see: https://www.sigsum.org/ /The Sigsum team --- NEWS for Sigsum tools, v0.11.2 This release fixes yet another manpage date nit. Bug fixes: * Fix so that make doc works for signed git tags.

1 0

ANNOUNCE: sigsum-go v0.11.1
by Rasmus Dahlberg 13 Mar '25

13 Mar '25

The Sigsum team is happy to announce a new version of the Sigsum tools, v0.11.1. The source code for the release can be checked out using git clone -b v0.11.1 https://git.glasklar.is/sigsum/core/sigsum-go.git or installed using go install sigsum.org/sigsum-go/cmd/...@v0.11.1 See the NEWS file https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/v0.11.1/NEWS or the excerpt below for the changes since v0.11.0. For further documentation and project information, see: https://www.sigsum.org/ /The Sigsum team --- NEWS for Sigsum tools, v0.11.1 This release fixes manpage nits found during Debian packaging. Bug fixes: * Fix non-deterministic date in sigsum-tools manpage. * Fix invalid manpage NAME sections for all subcommands. * Fix typos in usage messages and manpages. * Fix s/--verbose/--quiet/ in NEWS entry for v0.11.0. Incompatible changes: * Move sigsum-tools manpage from section 5 to section 7.

1 0

ANNOUNCE: sigsum-go v0.11.0
by Rasmus Dahlberg 12 Mar '25

12 Mar '25

The Sigsum team is happy to announce a new version of the Sigsum tools, v0.11.0. The source code for the release can be checked out using git clone -b v0.11.0 https://git.glasklar.is/sigsum/core/sigsum-go.git or installed using go install sigsum.org/sigsum-go/cmd/...@v0.11.0 See the NEWS file https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/v0.11.0/NEWS or the excerpt below for the changes since v0.10.1. For further documentation and project information, see: https://www.sigsum.org/ /The Sigsum team --- NEWS for Sigsum tools, v0.11.0 The main changes in this version are more efficient batch submissions as well as improved documentation for all tools. New features: * sigsum-submit: batch submissions are done more efficiently underneath the hood (the UI of passing >1 input is the same). * sigsum tools: some short and long option names have been added, e.g., "-a" is now the short option for "--token-signing-key". Bug fixes: * Fix so that the --quiet option cannot crash sigsum-token. Documentation improvements: * sigsum tools: all usage messages have been brushed up. * man pages: can be generated with `make doc`. Depends on help2man (cmd/*) and pandoc (doc/tools.md) being installed. Incompatible changes: * sigsum-submit: increase timeout from 45s to 10m. There is a builtin shorter timeout for individual log queries that is not configurable.

1 0