From a8e427ff4725033c8b8be786b9da7817329989df Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:29:56 -0400 Subject: [PATCH 1/3] Page: changelog, release notes v0.1.0 and v0.2.1 quoted --- changelog/index.html | 129 +++++++++++++++++++++++++++++++++++++++++++ sitemap.xml | 4 ++ 2 files changed, 133 insertions(+) create mode 100644 changelog/index.html diff --git a/changelog/index.html b/changelog/index.html new file mode 100644 index 0000000..e58d519 --- /dev/null +++ b/changelog/index.html @@ -0,0 +1,129 @@ + + + + + +FosterStack Cache changelog: v0.1.0 to v0.2.1 + + + + + + + + +
+ +
Infrastructure worth keeping — and kept patched.
+
+
+

FosterStack Cache changelog: v0.1.0 to v0.2.1

+

The release notes from GitHub, quoted as published. Newest first. For anything else, the releases page is the source.

+ +

v0.2.1

+

Release name: fscache v0.2.1. Published 2026-09-21.

+
See release-manifest.json for the full evidence bundle: image digests (GHCR canonical, Docker Hub mirror — identical digests), archive checksums, requirements baseline, per-AC acceptance results, and the Rekor log index of every verified statement in the release chain.
+

v0.2.1 on GitHub

+ +

v0.2.0

+

No release was published for v0.2.0: the tag exists, but its release run failed. Use v0.2.1.

+ +

v0.1.0

+

Published 2026-08-22.

+
+

Changelog

+ +

Note on this release's evidence (added Sep 2026). v0.1.0 was built and published by the pre-remediation release pipeline: a snapshot build was scanned, and a separate build of the same commit was published, so these published images were not scanned before publication. They have been rescanned since at every severity with the published VEX applied — see the rescan runs for verdicts against the exact published digests. The signatures and provenance on this release are accurate about what they say — which CI run produced which digest — and say nothing about scanning. The next release is the first to carry the full evidence chain: one build, scanned and tested by digest, promoted without a rebuild.

+
+

v0.1.0 on GitHub

+ +

Related: how releases are built and signed and security policy.

+
+ All releases on GitHub + FosterStack home +
+
+ + + diff --git a/sitemap.xml b/sitemap.xml index 8c1e470..d997a14 100644 --- a/sitemap.xml +++ b/sitemap.xml @@ -16,4 +16,8 @@ weekly 1.0 + + https://fosterstack.com/changelog/ + 2026-10-08 + From 9fcbef4bea4ccc2062004166dc057a8f63c6b333 Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:30:52 -0400 Subject: [PATCH 2/3] Changelog: one plain line on what changed since v0.1.0, quoted from RELEASING.md --- changelog/index.html | 1 + 1 file changed, 1 insertion(+) diff --git a/changelog/index.html b/changelog/index.html index e58d519..c8f89ae 100644 --- a/changelog/index.html +++ b/changelog/index.html @@ -107,6 +107,7 @@

v0.1.0

Note on this release's evidence (added Sep 2026). v0.1.0 was built and published by the pre-remediation release pipeline: a snapshot build was scanned, and a separate build of the same commit was published, so these published images were not scanned before publication. They have been rescanned since at every severity with the published VEX applied — see the rescan runs for verdicts against the exact published digests. The signatures and provenance on this release are accurate about what they say — which CI run produced which digest — and say nothing about scanning. The next release is the first to carry the full evidence chain: one build, scanned and tested by digest, promoted without a rebuild.

v0.1.0 on GitHub

+

What changed since: the v0.2.1 release notes point to its release-manifest.json evidence bundle. The release process, as RELEASING.md describes it, is "One build, one set of digests, promoted without a rebuild", with every scanner run "against the exact candidate digests".

Related: how releases are built and signed and security policy.

From 6424a3267ef4ff6754b381e3d1cba2c27e673bf7 Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:32:34 -0400 Subject: [PATCH 3/3] Changelog: link the v0.1.0 commit list instead of quoting tool names; blockquote style --- changelog/index.html | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/changelog/index.html b/changelog/index.html index c8f89ae..9bc1baa 100644 --- a/changelog/index.html +++ b/changelog/index.html @@ -70,6 +70,7 @@ footer { border-top: 1px solid var(--line); margin-top: 4rem; padding: 1.5rem 1.25rem 3rem; } footer div { max-width: 44rem; margin: 0 auto; color: var(--muted); font-size: .82rem; } a { color: var(--accent); } + blockquote { border-left: 3px solid var(--line); padding: .2rem 0 .2rem 1rem; margin: .8rem 0; color: var(--muted); } @@ -92,18 +93,7 @@

v0.2.0

v0.1.0

Published 2026-08-22.

-

Changelog

- +

The v0.1.0 notes begin with a list of the nine commits in the release. That list is on the GitHub release page. The rest of the notes follow here, unedited.

Note on this release's evidence (added Sep 2026). v0.1.0 was built and published by the pre-remediation release pipeline: a snapshot build was scanned, and a separate build of the same commit was published, so these published images were not scanned before publication. They have been rescanned since at every severity with the published VEX applied — see the rescan runs for verdicts against the exact published digests. The signatures and provenance on this release are accurate about what they say — which CI run produced which digest — and say nothing about scanning. The next release is the first to carry the full evidence chain: one build, scanned and tested by digest, promoted without a rebuild.

v0.1.0 on GitHub