8 releases 16 tags

RSS feed

• 0.9.0 e57dd2b76e

  Compare

  0.9.0 Stable

  damian-buho released this 2026-10-25 04:34:55 +00:00 | 7 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  11 commits, 1 contributor, 3 days since 0.8.0.

  Features

  • forge: declare and publish to GitHub with arm64 (e5908fb)
  • publish: push to Docker Hub (9412845)

  Bug fixes

  • deps: bump pnpm to 12.15.0 (c8088e5)
  • deps: bump upstream to 26.12.1 (c0304a0)
  • deps: bump upstream to 24.22.1 (32894b7)
  • deps: bump upstream to 22.23.4 (da4fb5e)
  • pnpm: keep the pnpm store and corepack cache in the npm cache (95643a6)
  • security: update VAs (1942eed)
  • deps: patch undici bundled in global npm and pnpm (f3dc84d)

  Installation

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/b19-node:0.9.0
  

  This release also publishes the 0.9 and 0 tags — pull the precision you want to pin.

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/b19/node:0.9.0
  

  Usage

  Build on top of this image:

  FROM damianbuho/b19-node:0.9.0
  

  For the recommended multi-stage pattern and the build-hook system (build.d), scaffold a derivative with b19/scripts/scaffold.sh from m6e/b19.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull docker.io/damianbuho/b19-node@sha256:252b9924174f91e0b572ea99534ec7814ab5dcaf7127b802dd2913b2e3f5ae49
  docker pull kiota.ch/b19/node@sha256:252b9924174f91e0b572ea99534ec7814ab5dcaf7127b802dd2913b2e3f5ae49
  

  Platform	Digest	Size
  linux/amd64	sha256:14347be18fbe7f89da1d4e3e485253e7eca55f832cc534d30f054a695a5e75f5	216.0 MB

  Sizes are compressed layer bytes as stored in the registry.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/b19-node@sha256:252b9924174f91e0b572ea99534ec7814ab5dcaf7127b802dd2913b2e3f5ae49
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/b19/node@sha256:252b9924174f91e0b572ea99534ec7814ab5dcaf7127b802dd2913b2e3f5ae49
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/b19-node@sha256:252b9924174f91e0b572ea99534ec7814ab5dcaf7127b802dd2913b2e3f5ae49
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/b19/node@sha256:252b9924174f91e0b572ea99534ec7814ab5dcaf7127b802dd2913b2e3f5ae49
  

  Full changes: https://kiota.ch/b19/node/compare/0.8.0...0.9.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 0.8.0 e22aa505e8

  Compare

  0.8.0 Stable

  damian-buho released this 2026-10-21 10:55:20 +00:00 | 19 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  5 commits, 1 contributor, 1 day since 0.7.5.

  What’s new

  Certificate trust follows the system store

  • Node is built to verify TLS against the system trust store, not the Mozilla copy compiled into the official binary.
  • A root removed from the system store, by Ubuntu or by the b19 distrust list, stops being trusted at once, without waiting for a Node release.
  • Certificates added to the system store are trusted with no NODE_EXTRA_CA_CERTS setup.
  • NODE_OPTIONS=--use-bundled-ca returns to the compiled-in copy.

  Features

  • security: verify TLS against the system CA store (f042c53)

  Bug fixes

  • security: drop NODE_EXTRA_CA_CERTS, the default store is the system one (4b85fe8)

  Installation

  Pull the published container image:

  docker pull kiota.ch/b19/node:0.8.0
  

  This release also publishes the 0.8 and 0 tags — pull the precision you want to pin.

  Usage

  Build on top of this image:

  FROM kiota.ch/b19/node:0.8.0
  

  For the recommended multi-stage pattern and the build-hook system (build.d), scaffold a derivative with b19/scripts/scaffold.sh from m6e/b19.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull kiota.ch/b19/node@sha256:fa5b2541643680486cadac316c751c6cd05fd2671d19e22bc785d7dce00b8f8e
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/b19/node@sha256:fa5b2541643680486cadac316c751c6cd05fd2671d19e22bc785d7dce00b8f8e
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/b19/node@sha256:fa5b2541643680486cadac316c751c6cd05fd2671d19e22bc785d7dce00b8f8e
  

  Full changes: https://kiota.ch/b19/node/compare/0.7.5...0.8.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 0.7.5 1095db642c

  Compare

  0.7.5 Stable

  damian-buho released this 2026-10-19 13:47:45 +00:00 | 25 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  3 commits, 1 contributor, 2 hours since 0.7.4.

  Bug fixes

  • workflows: move pins (7bea3ea)
  • workflows: fix preflights (302d920)

  Installation

  Pull the published container image:

  docker pull kiota.ch/b19/node:0.7.5
  

  This release also publishes the 0.7 and 0 tags — pull the precision you want to pin.

  Usage

  Build on top of this image:

  FROM kiota.ch/b19/node:0.7.5
  

  For the recommended multi-stage pattern and the build-hook system (build.d), scaffold a derivative with b19/scripts/scaffold.sh from m6e/b19.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull kiota.ch/b19/node@sha256:6b2da1e9adc37c83b33afb88667f64a60826ceabc83ab59c6f0237db923c1175
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/b19/node@sha256:6b2da1e9adc37c83b33afb88667f64a60826ceabc83ab59c6f0237db923c1175
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/b19/node@sha256:6b2da1e9adc37c83b33afb88667f64a60826ceabc83ab59c6f0237db923c1175
  

  Full changes: https://kiota.ch/b19/node/compare/0.7.4...0.7.5

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 0.7.4 a37f0018cd

  Compare

  0.7.4 Stable

  damian-buho released this 2026-10-19 04:39:40 +00:00 | 29 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  10 commits, 1 contributor, 2 days since 0.7.3.

  Bug fixes

  • refactor CI workflows (new goals + preflight checks) (6075f15)
  • workflows: move pins (6e5f2e9, 1ba83c1)
  • workflows: enable checks (9507583)

  Installation

  Pull the published container image:

  docker pull kiota.ch/b19/node:0.7.4
  

  This release also publishes the 0.7 and 0 tags — pull the precision you want to pin.

  Usage

  Build on top of this image:

  FROM kiota.ch/b19/node:0.7.4
  

  For the recommended multi-stage pattern and the build-hook system (build.d), scaffold a derivative with b19/scripts/scaffold.sh from m6e/b19.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull kiota.ch/b19/node@sha256:3d2a7651af5e70cef6965e9f5e82ba397d393b808fa29e6c46f62da5e19e6c8c
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/b19/node@sha256:3d2a7651af5e70cef6965e9f5e82ba397d393b808fa29e6c46f62da5e19e6c8c
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/b19/node@sha256:3d2a7651af5e70cef6965e9f5e82ba397d393b808fa29e6c46f62da5e19e6c8c
  

  Full changes: https://kiota.ch/b19/node/compare/0.7.3...0.7.4

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 0.7.3 4a4778f040

  Compare

  0.7.3 Stable

  damian-buho released this 2026-10-16 03:41:56 +00:00 | 33 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  12 commits, 1 contributor, 5 days since 0.7.2.

  Bug fixes

  • deps: bump pnpm to 12.12.1 (b89991f)
  • deps: bump upstream to 26.12.0 (7df46de)
  • deps: bump upstream to 24.22.0 (0b4b1ba)
  • deps: bump pnpm to 12.13.0 (97eb49e)
  • deps: bump pnpm to 12.14.0 (d0aec89)
  • deps: bump npm to 12.2.1 (83e4fa2)

  Installation

  Pull the published container image:

  docker pull kiota.ch/b19/node:0.7.3
  

  This release also publishes the 0.7 and 0 tags — pull the precision you want to pin.

  Usage

  Build on top of this image:

  FROM kiota.ch/b19/node:0.7.3
  

  For the recommended multi-stage pattern and the build-hook system (build.d), scaffold a derivative with b19/scripts/scaffold.sh from m6e/b19.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull kiota.ch/b19/node@sha256:3f453cc47d5db41fce9f3f1b8b98944f91ab8f847f97530094e5e65a09cbb638
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/b19/node@sha256:3f453cc47d5db41fce9f3f1b8b98944f91ab8f847f97530094e5e65a09cbb638
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/b19/node@sha256:3f453cc47d5db41fce9f3f1b8b98944f91ab8f847f97530094e5e65a09cbb638
  

  Full changes: https://kiota.ch/b19/node/compare/0.7.2...0.7.3

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 0.7.2 46a88b4e8a

  Compare

  0.7.2 Stable

  damian-buho released this 2026-10-10 18:34:38 +00:00 | 46 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  9 commits, 1 contributor, 1 day since 0.7.1.

  Bug fixes

  • deps: bump pnpm to 12.11.2 (49aec19)

  Installation

  Pull the published container image:

  docker pull kiota.ch/b19/node:0.7.2
  

  This release also publishes the 0.7 and 0 tags — pull the precision you want to pin.

  Usage

  Build on top of this image:

  FROM kiota.ch/b19/node:0.7.2
  

  For the recommended multi-stage pattern and the build-hook system (build.d), scaffold a derivative with b19/scripts/scaffold.sh from m6e/b19.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull kiota.ch/b19/node@sha256:9a957d21f9d836a1b5ce5f79af52e777b17b17cf5e744e746f8adb6ce25cf552
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/b19/node@sha256:9a957d21f9d836a1b5ce5f79af52e777b17b17cf5e744e746f8adb6ce25cf552
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/b19/node@sha256:9a957d21f9d836a1b5ce5f79af52e777b17b17cf5e744e746f8adb6ce25cf552
  

  Full changes: https://kiota.ch/b19/node/compare/0.7.1...0.7.2

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 0.7.1 a57c1d202c

  Compare

  0.7.1 Stable

  damian-buho released this 2026-10-09 07:45:23 +00:00 | 56 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  6 commits, 1 contributor, 10 hours since 0.7.0.

  Bug fixes

  • image: keep the global npm install cache out of the image layer (dcf7193)
  • deps: bump upstream to 26.11.1 (8ef2ccf)
  • security: suppress npm-bundled GHSA twins via shared fragment (fee58b1)

  Installation

  Pull the published container image:

  docker pull kiota.ch/b19/node:0.7.1
  

  This release also publishes the 0.7 and 0 tags — pull the precision you want to pin.

  Usage

  Build on top of this image:

  FROM kiota.ch/b19/node:0.7.1
  

  For the recommended multi-stage pattern and the build-hook system (build.d), scaffold a derivative with b19/scripts/scaffold.sh from m6e/b19.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull kiota.ch/b19/node@sha256:3aab851ae1d7c074ccf31c5c548799da32409856f3234f9b41a753cfa4a867ca
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/b19/node@sha256:3aab851ae1d7c074ccf31c5c548799da32409856f3234f9b41a753cfa4a867ca
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/b19/node@sha256:3aab851ae1d7c074ccf31c5c548799da32409856f3234f9b41a753cfa4a867ca
  

  Full changes: https://kiota.ch/b19/node/compare/0.7.0...0.7.1

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 0.7.0 a1e9e84419

  Compare

  0.7.0 Stable

  damian-buho released this 2026-10-08 17:22:01 +00:00 | 63 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  12 commits, 1 contributor, 13 hours since 0.6.4.

  Features

  • ci: sign images (14ecddc)
  • ci: attest images (47b8f29)
  • ci: cut image releases (6882c60)

  Bug fixes

  • deps: bump upstream to 26.11.0 (18ed9cf)

  Performance

  • container: declare M6E_VERSION next to the user stage (94c6f33)

  Installation

  Pull the published container image:

  docker pull kiota.ch/b19/node:0.7.0
  

  This release also publishes the 0.7 and 0 tags — pull the precision you want to pin.

  Usage

  Build on top of this image:

  FROM kiota.ch/b19/node:0.7.0
  

  For the recommended multi-stage pattern and the build-hook system (build.d), scaffold a derivative with b19/scripts/scaffold.sh from m6e/b19.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull kiota.ch/b19/node@sha256:87864dde7d61b873034beb9110b2b54ff05d02cec994b2548f06ed2a40ec4356
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/b19/node@sha256:87864dde7d61b873034beb9110b2b54ff05d02cec994b2548f06ed2a40ec4356
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/b19/node@sha256:87864dde7d61b873034beb9110b2b54ff05d02cec994b2548f06ed2a40ec4356
  

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads