Changelog

🐛 Bug Fixes

• (cli) breaking Read config from stdin only with –config - (cherry-pick #3810) (#3827)

🚀 Features

• (oci) Chunked blob push with streaming for unknown digests (#3642)
• Ocm s3 v1 support (#3682)
• (transfer) Add configurable uploader configurations (#3643)
• (wget) Add checksum policy for wget inputs (#3644)
• (versioning) Pluggable, config-driven versioning schemes (#3635)
• Allow missing subjects in oci manifests (#3684)
• Git access (#3577)
• (cli) Apply OCM config piped into stdin (#3679)
• Discovery controller (#3600)
• Enable concurrent transfer processing (#3698)
• Git input (#1259) (#3675)
• (transfer) breaking Add Artifactory and Nexus repository uploaders (#3690)
• (transfer) breaking Replace –upload-as and copyMode with uploader configurations (#3742)

🐛 Bug Fixes

• (oci) Allow digest-only uploads in the materialized upload path (#3591)
• Credential type registration (#1146) (#3398)
• 3674 - digest override in oci upload (#3680)
• (cli) Drop cobra version template to restore linker dead-code elimination (#3693)
• Better specify // seperator in ocm download resource docs (#3700)
• (http) Return response bytes unmodified by default (#3701)

⚙️ Miscellaneous Tasks

• (config) breaking Remove the verification field and make config the canonical verifier (#3576)
• Migrate to rustfs (#3606)
• Optimize CEL environment construction in transfer graph (#3686)
• breaking Don’t repeatedly check whole graph for cycle detection (#3688)
• Enable digest verification across blob technologies during download (#3641)
• Log time spent in progress reports (#3697)
• breaking Remove support for nested generic configs in v2 (#3639)
• Add HTTP alias to Wget access type (#3672)
• Progress bar for transfer graph construction (#3696)
• Add pprof build tag to enable proper profiling later (#3707)
• Add HTTP alias for Wget input type (#3706)
• Don’t double discover config files (#3737)

📚 Documentation

• (website) Add caching configuration reference (#3734)

🚀 Features

• (go) Use go toolchain directive (#3592)
• (cli) Human-readable version output and –version/-v flag (#3618)
• (sbom) Discover sboms for transferred local blobs (#3572)
• Fix transferID collisions by implementing ADR 28 (#3612)
• Render resources within component on -o widetree (#3527)

🐛 Bug Fixes

• Rendering errors in ocm add cv for unregistered types (#3526)
• Rename S3Bucket to S3 types (#3597)
• Replace removed minio image (#3605)
• Http unlimited default timeout (#3615)
• Reject malformed credentials at ingestion time (#3623)
• (oci) Name the requested artifact in digest-pinned resource layouts (#3588)

⚙️ Miscellaneous Tasks

• Clean-up outdated logic in Taskfiles (#3601)
• Generate dependency table & readme overview from linting rules (#3541)
• Add link to credential migration docs (#3629)
• Update CONTRIBUTING.md to reflect lockstep release (#3630)
• (website) Use aliased to keep old urls (#3632)
• breaking Bump go version to 1.27 (#3671)

🚀 Features

• Get sbom for a given resource [2/2] (#3370)
• Add constructor validation [2/2] (#1185) (#3495)

🐛 Bug Fixes

• versioncheck merge semantics (#3485)
• Adjust CLI to TempFolder & WorkingDiretory being pointers (#3492)
• (cli) Use exact-identity-first matching for resource lookups (#3482)
• (controller) Requeue with backoff when a referenced object is not ready (#3531)

⚙️ Miscellaneous Tasks

• Integrate the verifier spec as an ocm config as well (#3471)
• Request scoped ocm configuration for the controller (#3515)
• breaking Move CLI & Controller into bindings/go (#3522)
• Fix creator string referencing old path (#3537)

📚 Documentation

• (docs) Add tutorial for SBOM (#3525)

🚀 Features

• Migrate the signature configuration usage into the CLI (#3356)
• Oci cache cli and controller wiring (#3433)

🐛 Bug Fixes

• Update versioncheck test to new release tags (#3362)
• Thread http config for resource repository in cli [2/2] (#3402)
• (cli) Remove downloadName label, –output wins, fallback to resource name (#3241)
• #1254 allow non digest processor available for custom resources [2/2] (#3417)

⚙️ Miscellaneous Tasks

• Update CLI and controller to require monolithic binding module (#3368)
• Update CLI integration tests to require monolithic binding module (#3369)
• Migrate k8s e2e test to ocm v2 (#3277)
• breaking Remove upload-as default default (#3278)
• (cli) breaking Bump bindings/go and remove default flag for --upload-as (#3393)

🚀 Features

• Wget download cache cli (#1234) (#3219)
• (cli) Register the GitHub digest processor and resource repository (#3211)
• (cli) Auto-configure ocm from docker config on first startup (#3185)

⚙️ Miscellaneous Tasks

• Fix build running and building all architectures on basic ci runs (#2757)
• (fix) Argocd next version includes a need for metrics server pin it for now (#3280)
• (e2e) Fix the podinfo installation to remove HPA and use stable argo (#3293)
• (cli) Integration tests for the gitHub access type in cli (#3270)
• Add rbac role aggregator (#3296)

📚 Documentation

• (docs) Wget reference docs (#3205)
• Replace ocm v1 component references with ocm v2 (#3222)

🚀 Features

• (transfer) Add multi-version discovery to transfer cv (#2665)
• Wget transfer cli integration test (#3137)

🐛 Bug Fixes

• Adjust FlatMap merging logic (#3118)

📚 Documentation

• (docs) Add example for resource download with extra identity (#3174)

🚀 Features

• Register wget in cli (#3089)

🐛 Bug Fixes

• Config discovery within .config folders (#3070)

🚀 Features

• Implement sequential transfer in replication controller implementation (#2732)
• (controller) Add ArgoCD as alternative GitOps deployment option in e2e examples (#2904)
• (cli) Ownership policy integration (#2947)

⚙️ Miscellaneous Tasks

• Isolate unit tests from host config files (#2870)
• Drop helm plugin (#2898)
• (website) Fix location of crds (#2926)
• (releases-011) Cherry-pick #3015 and #3029 (#3058)
• (releases-011) Cherry-pick #3070 (#3079)

📚 Documentation

• (docs) Add documentation for the replication controller (#2940)

🚀 Features

• Credential wiring cli & controller [2/2] (#2721)
• Add credential typed to ocm describe (#990) (#2810)
• (http) Wire HTTP config from OCM config into CLI builtin plugins (#2795)
• Add command to print effective config (#2752)
• Make resolver cache TTL configurable (#2881)
• (cli) Wire transfer config into the cli (#2867)

🐛 Bug Fixes

• Remove early returns from config discovery (#2793)
• Handle multiple --config flags correctly (#2800)
• (controller) Do not list components on single versions in semver (#2841)

⚙️ Miscellaneous Tasks

• (fix) Update coc to linux foundation eu (#2727)
• (tests) Adjust integration test for component.labels (#2760)
• Bump go/configuration dependency to v0.0.15 and remove unused configurations (#2875)
• Make sed invocation BSD/GNU agnostic (#2886)
• (releases-10) Cherry-pick #2926 and #2920 (versioned website fixes) (#2933)

📚 Documentation

• (docs) Expand HTTP client configuration documentation to include retry policies and TLS verification options (#2840)

⚙️ Miscellaneous Tasks

• (releases-09) Cherry-pick #2926 and #2920 (versioned website fixes) (#2932)

🚀 Features

• Wire GPG signing handler into CLI builtin plugins (#2675)

🐛 Bug Fixes

• (cli) Eliminate flicker in transfer progress renderer (#2647)

⚙️ Miscellaneous Tasks

• Apply patch for helm bug (#2722)

Note

NOTE: Because this is the first canonically released single version in this repository, which is a deviation from the previous method of releasing ( cli/v0.x and kubernetes/controller/v0.x ), this release note now contains all commits from the begin of time; since there was no previous such tag v0.N.

🚀 Features

• Migrate configuration v1 (#35)
• Setup the OCM CLI with Cobra and automatically generate its reference documentation (#50)
• Logging flags for configurable logging in the CLI (#83)
• Add component references to CLI internals (#86)
• Setup get component version command (#82)
• Introduce file / path flag (#242)
• Update the cli to use the latest plugin package (#284)
• Add component version command (#189)
• Ocm version command (#354)
• ocm download resource command (#372)
• Configuration for file-system config types for plugins and internal plugins (#390)
• (cli) Update to use repository module (#439)
• (cli) Build and create a CTF containing the OCM CLI with multiple Architectures and Operating Systems (#413)
• Add dir input to cli (#450)
• Download plugins from a component version (#473)
• (cli) Add plugin shutdown timeout flag (#569)
• (cli) Add tree renderer (#511)
• (cli) Add support for default plugin directory flag (#570)
• (cli) Json/yaml graph renderer (#574)
• Dir and file updates to support working dir (#591)
• (565) Relative file pointers dir input e2e (#613)
• Setup helm blob transformer that can extract OCI layouts (#530)
• (cli) breaking Ocm get cv –recursive (#604)
• Add support for OCI repository pattern for add component version (#628)
• (verification) Update resolver handling for component verification (#872)
• Adjust cli to updated constructor (and plugins and credentials) (#889)
• (cli) Sign/verify support (#895)
• Add component construction with external references (#1009)
• Create a migration infrastructure for context and configuration v1=>v2 (#1014)
• Component lister internal plugin for CTF (#1045)
• (cli) Resolver integration (#1053)
• (cli) Add support for multi-architecture container images (#1058)
• (ci) Overhaul CLI workflow for enhanced artifact generation and publishing (#1073)
• Component version resolution service (#1055)
• ocm get cv <ctf_dir> (#1068)
• (697) Recursive cleanup (#1076)
• Improve download plugin UX and add help for helm input plugin (#1144)
• Adjust resolution service to provide repositories and component versions (#1145)
• Add command to manage plugins (#1190)
• (scheme) Expose scheme retrieval methods for internal plugins (#1268)
• Add JSON Schema generator for Go structs (#1219)
• (manager) Add GetJSONSchemaForRepositorySpecification method (#1283)
• Migrate the component version controller to v2 (#1188)
• Migrate the repository controller to ocm v2 (#1322)
• Minimal transfer command implementation (#1405)
• Add event source for triggering component version objects (#1433)
• breaking Migrating the resource controller to use v2 (#1452)
• Recursive cv transfer support (#1506)
• Migrate the deployment controller to v2 (#1563)
• (helm) Add helm chart with updated E2E test workflow (#1670)
• (hacks) Update KRO to v0.8.1 (#1679)
• Transfer local blobs by default (#1669)
• (624) Implement apply sets from kro for deployer #624 (#1335)
• Add component reference resolvers to the controller (#1635)
• Use new resource repo bindings for oci (#1718)
• (cli) Add describe command for detailing OCM entities and metadata (#1554)
• Add progress tracking for transformation execution (#1702)
• breaking Make OCM configurations propagate through resource reference (#1752)
• (850) Remove kro permissions and create a small guide to update their permissions if necessary (#1750)
• Register helm as inbuilt input plugin (#1756)
• Oci artifact cli (#1684)
• Oci artifact uploader (#1765)
• Warn instead of info if upload-as is ociArtifact and copy-resources is missing (#1824)
• Remove compref package from cli (#1941)
• (883) Helm transfer cli (#1846)
• (docs) Use same diagram as on the website with proper light/dark support (#1955)
• Whitelist ocm config types (#1998)
• Update toOCI to handle OCI and localBlob transparently (#1943)
• (913) breaking Object in status field (#2008)
• Register helm digest processor plugin (#2076)
• Add –transfer-spec flag for two-step transfer workflow (#2077)
• Rename ocm-resource-repository subsystem to access in describe types (#2083)
• Increase resolver worker queue length from 100 to 1000 (#2085)
• Const with reference digest (#2084)
• (cli) Add full PEM encoding support for signing and verifying component versions (#2147)
• (controller) Move configuration from internal to pkg (#2281)
• 911 helm resource repo (#2130)
• Add conversion webhook to the controller (#2274)
• (cli) Add progress renderer with phase tracking and animated vis… (#2132)
• Make event subscriber buffer size configurable (#2282)
• Remove the config folder and generate rbac and crds with helm templating enabled (#2363)
• Add how-to about verifying component versions with controllers (#2407)
• (cli) Add version update notification (#2491)
• (cli) Integrate cosign signing handler [2/2] (#2346)
• breaking Migrate transfer and controller bindings to runtime.Typed credentials (gate 7) (#2616)
• Cli credentials rollout (#2642)
• Unified release flow for a single github release version (#2468)

🐛 Bug Fixes

• Fixup golangci v2 run (#155)
• Make it so that locations without plugins don’t generate warning messages (#214)
• Default log level to info (#222)
• Concurrent intermediary step to ensure we install once and then run concurrently (#301)
• Set the temp folder flag on change (#441)
• Make sure we do not ignore defer without a named return (#449)
• Support plain http in component repository (#484)
• (cli) Correct default value for --logoutput in CLI docs (#571)
• Use environment property if defined and fall back to gh otherwise (#588)
• Run plugin download integration separately as a go module (#581)
• (ci) Properly generate and add repo checkout to generate (#610)
• (ci) Properly generate and add repo checkout to generate (#611)
• (ci) Properly generate and add repo checkout to generate (#612)
• (cli) Fixup / refactor filesystem config handling (#615)
• (ci) Streamline docker build and push process for multi-architecture support (#698)
• (tests) Improve resource reconciliation and cleanup logic (#827)
• (tests) Increase default operation timeout for Kubernetes tests (#853)
• (ctf) Add support for recognizing additional CTF archive files: tar.gz, tgz, tar (#651) (#882)
• In some cases golangci-lint will fail parsing a comment with a URL (#888)
• (oci) Fix repository detection for OCI URLs with IP addresses (#894)
• Use cobra.Finalize instead of PersistentPostRunE (#984)
• (cli) Multi ctf repo race (#965)
• Linting controller after upgrade to golangci lint 2.5.0 (#1007)
• Typo in docs (#1024)
• Use the correct credential configuration in download test (#1038)
• Ward against nil error if resource is not filled in (#1069)
• Revert changing the CLI image to debian (#1102)
• Add dynamic RESTMapper integration and improve defaulting for unstructured resources in deployer_controller (#1104)
• Ensure verbose logs during tests for better diagnostics (#1186)
• (cmd) Improve error message for rendering components (#1217)
• Add subPath to OCI repository spec implementation (#1231)
• (737) Handle credentials resolution correctly (#1191)
• (oci) Update dependencies to simplified plugin registration (#1325)
• Helm input plugin validation fix (#1336)
• (controllers) Usage of k8s secret dockerconfigjson (#1353)
• Use the latest runtime package to fix the none deterministic failure (#1392)
• 743 add semver check cli tests (#1341)
• Rm nested fields and descriptor scheme (#1391)
• (controller) Resource lookup by reference in deployer (#1400)
• (cmd) Correct transformation type assignment in upload metadata (#1407)
• (revert) “chore(deps): update module github.com/mikefarah/yq/v4 to v4.48.2 (#1418)” (#1441)
• Make sure correct resource identity type is used (#1447)
• (controllers) Do not return an error when digest is not available (#1503)
• Pin the node version to 1.34 so it does not upgrade to an unsupported version (#1520)
• Prepare for having more than one listener for the resource channel (#1528)
• Pin the kube version for kind in the .env file (#1521)
• Remove double checking of config (#1629)
• Ignore shutdown try if the process is already done (#1662)
• Transfer localblobs with relation external (#1729)
• Use a runtime.Type type switch instead of a string match (#1760)
• Update the configuration to 0.0.10 and fix the resolver prepending a catch-all incorrectly (#1773)
• Use the right k8sClient in the repository suite (#1797)
• Transformer carry over signatures (#1798)
• Various cli fixes on transfer and construction behavior (#1807)
• Oci upload behavior (#1806)
• Context being cancelled prematurely and adjusting flux api version for objects (#1830)
• Update the chart name to chart to push under kubernetes/controller/chart (#1848)
• (1776) Ctf detection on windows absolute paths (#1792)
• (cli) Transfer respect resolvers (#1888)
• Release note creation (#1893)
• (1388) Fix auto decompress for download resources (#1800)
• Testdata location in cli tests (#1921)
• ServiceAccount name in custom RBAC documentation (#1935)
• Error checking and prune bool check upon HasPruned and removed some dead code (#1897)
• breaking Move verification to resolution service (#1707)
• Register oci type instead of AnyConsumerIdentityType (#1890)
• AddComponentVersion was writing to the same file (#2013)
• Usage of correct scheme when converting to ociRepository type in getAccessReference (#2033)
• Only trigger a reconcile event for the resource if the component changed (#2023)
• breaking Refactor skip verify field to verification policies (#2050)
• Error when –config flag specifies non-existent file (#2062)
• breaking Drop downgrade policy with cv label (#2056)
• Add a maximum resource size to the deployer controller (#2022)
• Get config hash for deployer download-cache key (Cachebacked Repository refactoring) (#2058)
• (controller) breaking ApplySet conflict detection (#2185)
• (ocm-k8s-toolkit) Fix pruning scope (#2313)
• Use unused values from the helm values section (#2376)
• Update module ocm.software/open-component-model/bindings/go/oci to v0.0.40 (#2331) (#2352)
• (cli) Remove duplicate v prefix in version check URL (#2555)
• (cli) Suppress version check warning for pseudo-version builds (#2578)

⚙️ Miscellaneous Tasks

• Make the cli use the extracted configuration module (#181)
• Remove flag parsing from the configuration module (#185)
• Prepare docs for website (#202)
• Apply latest versions to the CLI module (#271)
• Update CLI documentation directory path in Taskfile (#462)
• Add function to convert relative links to Hugo’s relrefformat (#528)
• breaking Update Go to v1.25.0 and golangci-lint to 2.4.0 (#562)
• (cli) Restructure integration module path (#621)
• Move ocm-k8s-toolkit to open-component-model monorepo (#480)
• Fixup dependency management for indirect majors and do go get -u all for controller (#677)
• Optimize and refactor kubernetes controller image build and tests (#678)
• Attempt to use inbuilt token (#713)
• Separate publish from e2e (#715)
• Prune unused golangci-lint dependencies from go.sum (#728)
• Enhance dependency configuration and tooling (#737)
• Bump to oci v0.0.7 (#800)
• Adjust rendering to breaking changes in graph logic (#806)
• Inherit defaults from .env in local Taskfile for controllers (#821)
• Add debug log if no plugins were loaded (#944)
• Columnar output combined with the visual tree hierarchy (#945)
• (cli) Adjust cli to dag refactor (#1032)
• Bump golang.org/x/net to v0.46.0 (#1071)
• (ci) Add workflows for CLI releases and changelog generation (#1075)
• (cli) Update the plugin version for the cli to fix location determination behavior (#1099)
• Change base image (#1101)
• Enhance base image with trust store and reduce number of platforms for cli image (#1105)
• Add GCO_ENABLED=0 to build (#1108)
• Correct typo: CGO_ENABLED instead of GCO_ENABLED (#1109)
• Change logging level from Info to Debug across various Go components for improved log granularity (#1111)
• breaking Bump kro to 0.6.3 and fixup access specification to schemaless object (#1225)
• Export digest functions to signing module (#1281)
• Remove moved functions and adjust deps (#1285)
• (controller) Update release to make a new tag on each main rele… (#1380)
• Fix go vet issues (#1408)
• Add cli transfer tests (#1435)
• Rewrite of jsonschema gen to be fully go native (#1412)
• Refactor test tasks (#1453)
• Remove replication controller (#1482)
• Change log level from warn to debug for missing credential consumer identity in pathmatcher. (#1533)
• Clean up kustomize config and use helm tasks in CI (#1681)
• Remove ocm v1 lib from controllers (#1712)
• Remove mandelsoft library from controllers (#1747)
• Make sure helm is uninstall on failure (#1762)
• Replace huge mermaid with tam diagram (#1826)
• Upgrade ocm.software/open-component-model/bindings/go/constructor to v0.0.6 and reenable tests (#1847)
• Update dependencies and simplify ociResourceRepoPlugin initialization (#1854)
• Update go version to 1.26.1 (#1932)
• (doc) Update install instructions for helm install (#1931)
• Workflow for controller release (#1900)
• Update OCI dependency to v0.0.35 (#1957)
• Update OCI dependency to v0.0.35 (#1958)
• Change log level to warning on ocm add cv to suppress message (#1966)
• Enhance CLI help: add example for signer spec and add some more explaining lines (#1965)
• Update identity type from OCIRepository to OCIRegistry across integration tests and configurations (#1992)
• Update the code of conduct that ocm is following (#2018)
• Upgrade Helm to v4.1.3 across CI workflows and Taskfile (#2021)
• Increase controller resource limits to account for workload characteristics (#2030)
• Bump kro to 0.9.0 (#2052)
• Remove obsolete repository (#2061)
• Introduce new helper for controller chart to truncate Chart version (#2028)
• Remove flux from kubernetes controller (#2068)
• Migrate to transfer module (#2075)
• Cap controller error backoff to 5 minutes (#2089)
• breaking Remove interval field from resource CR (#2116)
• Add status description to deployer (#2118)
• Remove unused cli arguments (#2125)
• Streamline release workflows and CLI build versioning (#2131)
• Add description to tasks (#2145)
• (markdown) Add markdownlint CI job and fix lint violations (#1753)
• Add new default to Subscriber Channel Size (#2367)
• Controller - update LocalBlob/v1 type assertions to UpperCamelCase [4/4] (#2326)
• Cli - update LocalBlob/v1 assertions to UpperCamelCase [3/4] (#2325)
• Fix CVE-2026-33186 for grpc go below 1.80.1 (#2443)
• (website) Adjust onboarding guide (#2496)

📚 Documentation

• Setup initial readmes and documentation
• Fixup markdown (#11)
• (docs) Bump descriptor/v2 everywhere in monorepo (#394)
• (docs) Correct help text for ocm add cv (#553)
• (docs) Lowercase archive in commandline help (#555)
• (docs) Update README installation instructions (#725)
• (docs) Update deployment command in README from ‘make deploy’ to ’task deploy’ (#1022)
• (docs) Streamline installation instructions for OCM K8s Toolkit (#1044)
• (docs) Ocm-k8s-toolkit example - k8s-manifest-simple (#1054)
• Various documentation improvements, high level guides, CONTRIBUTING.md (#1701)
• (docs) Fix deprecated guide (#1886)
• (docs) Add doc that ocmconfigs are merged (#1991)
• (docs) Update installation instructions and website links (#2051)
• (docs) Sync contributing guides (#2285)
• (docs) Add support for .dockerconfigjson format in docstring (#2457)
• (docs) Add onboarding and how we work guide (#2444)

Test

• (cli) UpperCamelCase - add input type casing tests for all input types in CLI (#2071)

⚙️ Miscellaneous Tasks

• (website) Adjust onboarding guide (#2496)

📚 Documentation

• (docs) Add support for .dockerconfigjson format in docstring (#2457)
• (docs) Add onboarding and how we work guide (#2444)

🚀 Features

• (cli) Add version update notification (#2491)

🐛 Bug Fixes

• (cli) Remove duplicate v prefix in version check URL (#2555)

📚 Documentation

• (docs) Add onboarding and how we work guide (#2444)

Test

• (cli) UpperCamelCase - add input type casing tests for all input types in CLI (#2071)

🚀 Features

• Remove the config folder and generate rbac and crds with helm templating enabled (#2363)
• Add how-to about verifying component versions with controllers (#2407)

🐛 Bug Fixes

• Use unused values from the helm values section (#2376)
• Update module ocm.software/open-component-model/bindings/go/oci to v0.0.40 (#2331) (#2352)

⚙️ Miscellaneous Tasks

• Controller - update LocalBlob/v1 type assertions to UpperCamelCase [4/4] (#2326)
• Fix CVE-2026-33186 for grpc go below 1.80.1 (#2443)

📚 Documentation

• (docs) Sync contributing guides (#2285)

🐛 Bug Fixes

• Update module ocm.software/open-component-model/bindings/go/oci to v0.0.40 (#2331) (#2352)

⚙️ Miscellaneous Tasks

• Cli - update LocalBlob/v1 assertions to UpperCamelCase [3/4] (#2325)
• Fix CVE-2026-33186 for grpc go below 1.80.1 (#2443)

📚 Documentation

• (docs) Sync contributing guides (#2285)

🚀 Features

• (controller) Move configuration from internal to pkg (#2281)
• 911 helm resource repo (#2130)
• Add conversion webhook to the controller (#2274)
• Make event subscriber buffer size configurable (#2282)

🐛 Bug Fixes

• (controller) breaking ApplySet conflict detection (#2185)
• (ocm-k8s-toolkit) Fix pruning scope (#2313)

⚙️ Miscellaneous Tasks

• Add new default to Subscriber Channel Size (#2367)

🚀 Features

• 911 helm resource repo (#2130)
• (cli) Add progress renderer with phase tracking and animated vis… (#2132)

⚙️ Miscellaneous Tasks

• (markdown) Add markdownlint CI job and fix lint violations (#1753)

⚙️ Miscellaneous Tasks

• Add status description to deployer (#2118)
• Remove unused cli arguments (#2125)
• Add description to tasks (#2145)

🚀 Features

• (cli) Add full PEM encoding support for signing and verifying component versions (#2147)

⚙️ Miscellaneous Tasks

• Streamline release workflows and CLI build versioning (#2131)

🚀 Features

• (docs) Use same diagram as on the website with proper light/dark support (#1955)
• Whitelist ocm config types (#1998)
• Update toOCI to handle OCI and localBlob transparently (#1943)
• (913) breaking Object in status field (#2008)
• Register helm digest processor plugin (#2076)
• Increase resolver worker queue length from 100 to 1000 (#2085)

🐛 Bug Fixes

• breaking Move verification to resolution service (#1707)
• Register oci type instead of AnyConsumerIdentityType (#1890)
• Usage of correct scheme when converting to ociRepository type in getAccessReference (#2033)
• Only trigger a reconcile event for the resource if the component changed (#2023)
• breaking Refactor skip verify field to verification policies (#2050)
• breaking Drop downgrade policy with cv label (#2056)
• Add a maximum resource size to the deployer controller (#2022)
• Get config hash for deployer download-cache key (Cachebacked Repository refactoring) (#2058)

⚙️ Miscellaneous Tasks

• Update OCI dependency to v0.0.35 (#1957)
• Update identity type from OCIRepository to OCIRegistry across integration tests and configurations (#1992)
• Update the code of conduct that ocm is following (#2018)
• Upgrade Helm to v4.1.3 across CI workflows and Taskfile (#2021)
• Increase controller resource limits to account for workload characteristics (#2030)
• Bump kro to 0.9.0 (#2052)
• Remove obsolete repository (#2061)
• Introduce new helper for controller chart to truncate Chart version (#2028)
• Remove flux from kubernetes controller (#2068)
• Cap controller error backoff to 5 minutes (#2089)
• breaking Remove interval field from resource CR (#2116)

📚 Documentation

• (docs) Update installation instructions and website links (#2051)

🚀 Features

• Register helm digest processor plugin (#2076)
• Add –transfer-spec flag for two-step transfer workflow (#2077)
• Rename ocm-resource-repository subsystem to access in describe types (#2083)
• Const with reference digest (#2084)

🐛 Bug Fixes

• Register oci type instead of AnyConsumerIdentityType (#1890)
• AddComponentVersion was writing to the same file (#2013)
• Error when –config flag specifies non-existent file (#2062)

⚙️ Miscellaneous Tasks

• Update OCI dependency to v0.0.35 (#1958)
• Change log level to warning on ocm add cv to suppress message (#1966)
• Enhance CLI help: add example for signer spec and add some more explaining lines (#1965)
• Update identity type from OCIRepository to OCIRegistry across integration tests and configurations (#1992)
• Migrate to transfer module (#2075)

📚 Documentation

• (docs) Add doc that ocmconfigs are merged (#1991)
• (docs) Update installation instructions and website links (#2051)

🚀 Features

• (verification) Update resolver handling for component verification (#872)
• Create a migration infrastructure for context and configuration v1=>v2 (#1014)
• Component version resolution service (#1055)
• Adjust resolution service to provide repositories and component versions (#1145)
• (manager) Add GetJSONSchemaForRepositorySpecification method (#1283)
• Migrate the component version controller to v2 (#1188)
• Migrate the repository controller to ocm v2 (#1322)
• Add event source for triggering component version objects (#1433)
• breaking Migrating the resource controller to use v2 (#1452)
• Migrate the deployment controller to v2 (#1563)
• (helm) Add helm chart with updated E2E test workflow (#1670)
• (hacks) Update KRO to v0.8.1 (#1679)
• (624) Implement apply sets from kro for deployer #624 (#1335)
• Add component reference resolvers to the controller (#1635)
• Use new resource repo bindings for oci (#1718)
• breaking Make OCM configurations propagate through resource reference (#1752)
• (850) Remove kro permissions and create a small guide to update their permissions if necessary (#1750)

🐛 Bug Fixes

• (ci) Streamline docker build and push process for multi-architecture support (#698)
• (tests) Improve resource reconciliation and cleanup logic (#827)
• (tests) Increase default operation timeout for Kubernetes tests (#853)
• Linting controller after upgrade to golangci lint 2.5.0 (#1007)
• Typo in docs (#1024)
• Ward against nil error if resource is not filled in (#1069)
• Add dynamic RESTMapper integration and improve defaulting for unstructured resources in deployer_controller (#1104)
• (oci) Update dependencies to simplified plugin registration (#1325)
• (controllers) Usage of k8s secret dockerconfigjson (#1353)
• Use the latest runtime package to fix the none deterministic failure (#1392)
• (controller) Resource lookup by reference in deployer (#1400)
• (revert) “chore(deps): update module github.com/mikefarah/yq/v4 to v4.48.2 (#1418)” (#1441)
• (controllers) Do not return an error when digest is not available (#1503)
• Pin the node version to 1.34 so it does not upgrade to an unsupported version (#1520)
• Prepare for having more than one listener for the resource channel (#1528)
• Pin the kube version for kind in the .env file (#1521)
• Use a runtime.Type type switch instead of a string match (#1760)
• Use the right k8sClient in the repository suite (#1797)
• Context being cancelled prematurely and adjusting flux api version for objects (#1830)
• Update the chart name to chart to push under kubernetes/controller/chart (#1848)
• ServiceAccount name in custom RBAC documentation (#1935)
• Error checking and prune bool check upon HasPruned and removed some dead code (#1897)

⚙️ Miscellaneous Tasks

• Move ocm-k8s-toolkit to open-component-model monorepo (#480)
• Fixup dependency management for indirect majors and do go get -u all for controller (#677)
• Optimize and refactor kubernetes controller image build and tests (#678)
• Attempt to use inbuilt token (#713)
• Separate publish from e2e (#715)
• Prune unused golangci-lint dependencies from go.sum (#728)
• Enhance dependency configuration and tooling (#737)
• Inherit defaults from .env in local Taskfile for controllers (#821)
• Bump golang.org/x/net to v0.46.0 (#1071)
• breaking Bump kro to 0.6.3 and fixup access specification to schemaless object (#1225)
• (controller) Update release to make a new tag on each main rele… (#1380)
• Fix go vet issues (#1408)
• Remove replication controller (#1482)
• Clean up kustomize config and use helm tasks in CI (#1681)
• Remove ocm v1 lib from controllers (#1712)
• Remove mandelsoft library from controllers (#1747)
• Make sure helm is uninstall on failure (#1762)
• Replace huge mermaid with tam diagram (#1826)
• Update dependencies and simplify ociResourceRepoPlugin initialization (#1854)
• Update go version to 1.26.1 (#1932)
• (doc) Update install instructions for helm install (#1931)
• Workflow for controller release (#1900)

📚 Documentation

• (docs) Update README installation instructions (#725)
• (docs) Update deployment command in README from ‘make deploy’ to ’task deploy’ (#1022)
• (docs) Streamline installation instructions for OCM K8s Toolkit (#1044)
• (docs) Ocm-k8s-toolkit example - k8s-manifest-simple (#1054)
• (docs) Fix deprecated guide (#1886)

🚀 Features

• Migrate configuration v1 (#35)
• Setup the OCM CLI with Cobra and automatically generate its reference documentation (#50)
• Logging flags for configurable logging in the CLI (#83)
• Add component references to CLI internals (#86)
• Setup get component version command (#82)
• Introduce file / path flag (#242)
• Update the cli to use the latest plugin package (#284)
• Add component version command (#189)
• Ocm version command (#354)
• ocm download resource command (#372)
• Configuration for file-system config types for plugins and internal plugins (#390)
• (cli) Update to use repository module (#439)
• (cli) Build and create a CTF containing the OCM CLI with multiple Architectures and Operating Systems (#413)
• Add dir input to cli (#450)
• Download plugins from a component version (#473)
• (cli) Add plugin shutdown timeout flag (#569)
• (cli) Add tree renderer (#511)
• (cli) Add support for default plugin directory flag (#570)
• (cli) Json/yaml graph renderer (#574)
• Dir and file updates to support working dir (#591)
• (565) Relative file pointers dir input e2e (#613)
• Setup helm blob transformer that can extract OCI layouts (#530)
• (cli) breaking Ocm get cv –recursive (#604)
• Add support for OCI repository pattern for add component version (#628)
• Adjust cli to updated constructor (and plugins and credentials) (#889)
• (cli) Sign/verify support (#895)
• Add component construction with external references (#1009)
• Component lister internal plugin for CTF (#1045)
• (cli) Resolver integration (#1053)
• (cli) Add support for multi-architecture container images (#1058)
• (ci) Overhaul CLI workflow for enhanced artifact generation and publishing (#1073)
• ocm get cv <ctf_dir> (#1068)
• (697) Recursive cleanup (#1076)
• Improve download plugin UX and add help for helm input plugin (#1144)
• Add command to manage plugins (#1190)
• (scheme) Expose scheme retrieval methods for internal plugins (#1268)
• Add JSON Schema generator for Go structs (#1219)
• (manager) Add GetJSONSchemaForRepositorySpecification method (#1283)
• Minimal transfer command implementation (#1405)
• Recursive cv transfer support (#1506)
• Transfer local blobs by default (#1669)
• Add component reference resolvers to the controller (#1635)
• Use new resource repo bindings for oci (#1718)
• (cli) Add describe command for detailing OCM entities and metadata (#1554)
• Add progress tracking for transformation execution (#1702)
• Register helm as inbuilt input plugin (#1756)
• Oci artifact cli (#1684)
• Oci artifact uploader (#1765)
• Warn instead of info if upload-as is ociArtifact and copy-resources is missing (#1824)

🐛 Bug Fixes

• Fixup golangci v2 run (#155)
• Make it so that locations without plugins don’t generate warning messages (#214)
• Default log level to info (#222)
• Concurrent intermediary step to ensure we install once and then run concurrently (#301)
• Set the temp folder flag on change (#441)
• Make sure we do not ignore defer without a named return (#449)
• Support plain http in component repository (#484)
• (cli) Correct default value for --logoutput in CLI docs (#571)
• Use environment property if defined and fall back to gh otherwise (#588)
• Run plugin download integration separately as a go module (#581)
• (ci) Properly generate and add repo checkout to generate (#610)
• (ci) Properly generate and add repo checkout to generate (#611)
• (ci) Properly generate and add repo checkout to generate (#612)
• (cli) Fixup / refactor filesystem config handling (#615)
• (ctf) Add support for recognizing additional CTF archive files: tar.gz, tgz, tar (#651) (#882)
• In some cases golangci-lint will fail parsing a comment with a URL (#888)
• (oci) Fix repository detection for OCI URLs with IP addresses (#894)
• Use cobra.Finalize instead of PersistentPostRunE (#984)
• (cli) Multi ctf repo race (#965)
• Use the correct credential configuration in download test (#1038)
• Revert changing the CLI image to debian (#1102)
• Ensure verbose logs during tests for better diagnostics (#1186)
• (cmd) Improve error message for rendering components (#1217)
• Add subPath to OCI repository spec implementation (#1231)
• (737) Handle credentials resolution correctly (#1191)
• (oci) Update dependencies to simplified plugin registration (#1325)
• Helm input plugin validation fix (#1336)
• 743 add semver check cli tests (#1341)
• Rm nested fields and descriptor scheme (#1391)
• (cmd) Correct transformation type assignment in upload metadata (#1407)
• Make sure correct resource identity type is used (#1447)
• Remove double checking of config (#1629)
• Ignore shutdown try if the process is already done (#1662)
• Transfer localblobs with relation external (#1729)
• Update the configuration to 0.0.10 and fix the resolver prepending a catch-all incorrectly (#1773)
• Transformer carry over signatures (#1798)
• Various cli fixes on transfer and construction behavior (#1807)
• Oci upload behavior (#1806)

⚙️ Miscellaneous Tasks

• Make the cli use the extracted configuration module (#181)
• Remove flag parsing from the configuration module (#185)
• Prepare docs for website (#202)
• Apply latest versions to the CLI module (#271)
• Update CLI documentation directory path in Taskfile (#462)
• Add function to convert relative links to Hugo’s relrefformat (#528)
• breaking Update Go to v1.25.0 and golangci-lint to 2.4.0 (#562)
• (cli) Restructure integration module path (#621)
• Bump to oci v0.0.7 (#800)
• Adjust rendering to breaking changes in graph logic (#806)
• Add debug log if no plugins were loaded (#944)
• Columnar output combined with the visual tree hierarchy (#945)
• (cli) Adjust cli to dag refactor (#1032)
• Bump golang.org/x/net to v0.46.0 (#1071)
• (ci) Add workflows for CLI releases and changelog generation (#1075)
• (cli) Update the plugin version for the cli to fix location determination behavior (#1099)
• Change base image (#1101)
• Enhance base image with trust store and reduce number of platforms for cli image (#1105)
• Add GCO_ENABLED=0 to build (#1108)
• Correct typo: CGO_ENABLED instead of GCO_ENABLED (#1109)
• Change logging level from Info to Debug across various Go components for improved log granularity (#1111)
• Export digest functions to signing module (#1281)
• Remove moved functions and adjust deps (#1285)
• Add cli transfer tests (#1435)
• Rewrite of jsonschema gen to be fully go native (#1412)
• Refactor test tasks (#1453)
• Change log level from warn to debug for missing credential consumer identity in pathmatcher. (#1533)
• Upgrade ocm.software/open-component-model/bindings/go/constructor to v0.0.6 and reenable tests (#1847)

📚 Documentation

• Setup initial readmes and documentation
• Fixup markdown (#11)
• (docs) Bump descriptor/v2 everywhere in monorepo (#394)
• (docs) Correct help text for ocm add cv (#553)
• (docs) Lowercase archive in commandline help (#555)
• Various documentation improvements, high level guides, CONTRIBUTING.md (#1701)

🚀 Features

This is our first release! While it’s still a long way to go until we reach feature parity with our existing tooling, this will serve as a baseline.