v0.25.0

What's Changed

• Better attestations by @kpcyrd in #186
  • There's now a long-term in-toto signing key for the daemon that can be queried at /api/v0/public-keys
    • Attestations carry a signature from the worker that has processed the compile
    • Attestations now also carry an additional signature from the key that identifies the rebuilderd instance
    • The long-term key is what users assign trust to
  • Old attestations are automatically getting signed with the new long-term key when fetched through the api
    • This is on by default but can be turned off in the configuration file
• Better error logging on stdio for the http daemon
• Update dependencies by @kpcyrd in #187

Thanks

We'd like to thank @repi for their support on github sponsors.

v0.24.0

What's Changed

• Support for compressed build logs/diffoscope/attestations has been added by @Nihlus in #181
  • This requires a one-time migration to compresses all logs and runs a VACUUM afterwards. This implies some downtime, please do not restart the daemon while the migration is applying
  • The size reduction is quite significant, from a reported 47.9G down to 2.1G (-95.7%)
  • If an http client is indicating zstd compression support, the data is passed through as-is, resulting in much better throughput
  • Thanks again @Nihlus for this remarkable contribution

New Contributors

• @Nihlus made their first contribution in #181

Thanks

We'd like to thank @repi for their support on github sponsors.

v0.23.1

What's Changed

• Enable compression middleware by @kpcyrd in #177

Thanks

We'd like to thank @repi for their support on github sponsors.

v0.23.0

What's Changed

• Update Github actions by @jelly in #172
• contrib: update Fedora example configuration by @jelly in #171
• Debian: exclude packages not listed in architectures (arch:all) by @jspricke in #174
• Allow importing multiple Debian releases, merged into one set by @kpcyrd in #176

Full Changelog: v0.22.1...v0.23.0

This release was part of MiniDebConf Hamburg 2025.

Thanks

We'd like to thank @repi for their support on github sponsors.

v0.22.1

What's Changed

• Increase ping timeout before unassigning a task by @kpcyrd in #170

Full Changelog: v0.22.0...v0.22.1

Thanks

We'd like to thank @repi for their support on github sponsors.

v0.22.0

What's Changed

• Migrate diesel dependency from 1.x to 2.x by @kpcyrd in #156
• Port argument parsing from structopt (clap 2) to clap 4 by @kpcyrd in #157
• Refactor dependency on http client, replace dependency on openssl with memory-safe implementation by @kpcyrd in #158
• Update dependencies (in-toto, remove atty, dotenv -> dotenvy) by @kpcyrd in #159
• README: Update Debian status and worker docker image by @kpcyrd in #160
• README: the development dashboard is served over http by @jelly in #165
• Run cargo fmt on codebase by @kpcyrd in #166
• Experimental Fedora support by @jelly in #167
• Update dependencies by @kpcyrd in #169

Full Changelog: v0.21.0...v0.22.0

Thanks

We'd like to thank @repi for their support on github sponsors.

v0.21.0

What's Changed

• Debian support was significantly improved and now works with the new snapshot service, and the debrebuild rebuilder backend that is provided in the official Debian devscripts package
  • Support binNMUs in Debian (Closes #4) by @jspricke in #147
  • Update rebuilder-debian.sh for current debrebuild from devscripts by @h01ger in #151
• Update dependencies by @kpcyrd in #145
  • Replace base64 crate with data-encoding by @kpcyrd in #148
  • Refactor xz/lzma decompression code by @kpcyrd in #149
• Update dependencies, clarify license by @kpcyrd in #153

New Contributors

• @jspricke made their first contribution in #147
• @h01ger made their first contribution in #151

Thanks

This work was sponsored by the Reproducible Builds Project, and people like you and me! We'd like to thank @SantiagoTorres and @repi in particular for their support on github sponsors.

v0.20.0

• Change the default in the archlinux integration to not execute check()
• Fix application/x-bzip2 detection for Arch Linux packages (thanks @Vekhir!)
• Update dependencies and fix some clippy warnings

Thanks

We'd like to thank @SantiagoTorres, @repi and @rgacogne for their support on github sponsors.

v0.19.0

• Run delete for orphaned builds in chunks
• Update in-toto dependency to 0.3.0
• Add make install target
• Misc bugfixes for Debian, Arch Linux, Tails rebuilds

Thanks

We'd like to thank @SantiagoTorres, @repi and @rgacogne for their support on github sponsors.

v0.18.1

• Update the tails rebuilder script to set $HOME to a temporary directory. Thanks to @jvoisin for reporting and his help debugging this (#112, #118)

Thanks

We'd like to thank @jvoisin, @SantiagoTorres and @repi for their support on github sponsors.