The Sigsum team is happy to announce a new version of the Sigsum tools and go library, v1.0.0. The source code for the release can be checked out using git clone -b v1.0.0 https://git.glasklar.is/sigsum/core/sigsum-go.git or installed using go install sigsum.org/sigsum-go/cmd/...@v1.0.0 The v1.0.0 tag is signed using the key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/xZ+v5e435605MS4BYE89PLcgk8DT5PvuoM2oASnuk This is the same release key also published for nisse@glasklarteknik.se at https://www.system-transparency.org/keys/allowed-ST-release-signers. See the NEWS file https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/v1.0.0/NEWS or the excerpt below for the changes since v1.0.0. For further documentation and project information, see: https://www.sigsum.org/ /The Sigsum team NEWS for Sigsum-go, v1.0.0 This is a major release, advertising a library API that is intended to be stable, with only bugfixes and backwards-compatible extensions going into v1.x.y. The most notable library changes since the previous release are deletion of the Metrics interface and stricter validation of Ed25519 signatures. Except for rejection of some out-of-spec Ed25519 signatures, there are no changes in behavior of the command line tools. Incompatible changes: * Building now requires go version 1.27 or later. * When verifying Ed25519 signatures, reject points in non-canonical encoding, and points of low-order. The Verify function has also been moved to be a method on the PublicKey type. * In the struct server.Config, the server.Metrics interface is deleted, replaced by a simpler and more general callback HandlerDecorator. * The Leaf.Verify method now takes a key map as argument and returns an error object, with a specific error if the mapping doesn't include any key for the leaf's key hash. Documentation updates: * Document that in a Sigsum proof, the cosignature key hashes must be distinct.