Release v0.4.0

What's Changed

• update NEWS for melange 0.3.0. by @kaniini in #357
• Add darwin goreleaser target (macOS) by @jdolitsky in #359
• Upgrade go to 1.20 and clean up ci by @cpanato in #358
• Allow construction of empty packages without environment/pipelines by @kaniini in #360
• build: fix SBOM language gathering for subpackage pipelines by @kaniini in #361
• package: allow any library which has a SONAME to be a provider by @kaniini in #362
• Fix goreleaser cosign flags by @jdolitsky in #365
• Bump apko to pick up busybox detection fix. by @dlorenc in #366
• melange bump: optional flag to modify git-checkout pipeline expected-… by @rawlingsj in #367
• make original test commit sha different from the new expected sha to … by @rawlingsj in #368
• fix: log package new names+versions when regenerating index by @imjasonh in #369
• add a update.manual: key to indicate a package should be manually u… by @rawlingsj in #371
• Add --arch to melange index to skip packages with the wrong arch by @kaniini in #372
• index: rework architecture filtering by @kaniini in #375
• feat: respect target-architecture to filter archs by @imjasonh in #376
• export mutate functions as these are very useful to be called outside… by @rawlingsj in #377
• update to apko git by @kaniini in #379
• Use logrus for logging, like apko by @kaniini in #380
• build(deps): bump sigstore/cosign-installer from 3.0.1 to 3.0.2 by @dependabot in #382
• build(deps): bump actions/add-to-project from 0.4.1 to 0.5.0 by @dependabot in #373
• feat: send useragent in HTTP requests by @imjasonh in #378
• upgrade alpine pkgs lima by @developer-guy in #289
• build(deps): bump google.golang.org/api from 0.114.0 to 0.116.0 by @dependabot in #383
• Upgrade to apko 0.7.4-20230411 snapshot. by @kaniini in #386
• Use formatted YAML encoder from yam by @luhring in #385
• build: package: append subpackages to build log by @kaniini in #387
• pipelines: autoconf/make-install: delete all GNU libtool metadata files by @kaniini in #388
• Do not depend on concrete logger by @luhring in #389
• Print full uri to debug file download errors by @patflynn in #390
• update apko to 20230413 snapshot by @kaniini in #391
• fix 403 error when melange bumping some packages, https://www.netfilt… by @rawlingsj in #392
• build(deps): bump actions/checkout from 3.5.0 to 3.5.2 by @dependabot in #393
• Fix parse configuration's use of abstract filesystems by @luhring in #395
• update apko dependency to 20230419 snapshot by @kaniini in #397
• update apko to 20230420, use apko log.Logger everywhere by @kaniini in #399
• build(deps): bump google.golang.org/api from 0.116.0 to 0.119.0 by @dependabot in #398
• upgrade apko to 20230421 snapshot by @kaniini in #400
• build(deps): bump github.com/docker/docker from 23.0.3+incompatible to 23.0.4+incompatible by @dependabot in #402
• cli: build: warn when no work to do instead of throwing an error by @kaniini in #403
• bump to latest apko which handles file overwrites by @deitch in #404
• add a strip-suffix: key to melange update struct to indicate strippin… by @rawlingsj in #405
• add ignore-regex-patterns update config to indicate you want to ign… by @rawlingsj in #406
• simplify DataItems to use the builtin marshallable map type by @joshrwolf in #407
• update alpine-go to include replaces hotfix by @kaniini in #410
• use go-apk library instead of apko by @deitch in #411
• move signing funcs to rely on external go-apk library by @deitch in #412
• build(deps): bump gitlab.alpinelinux.org/alpine/go from 0.6.1-0.20230428211436-f22972d078c8 to 0.7.0 by @dependabot in #414
• Add name method to build config by @luhring in #419
• build: add support for configurable logging policies by @kaniini in #420
• Add trimpath to the go pipeline. by @dlorenc in #424
• build: package: skip SONAME analysis when ELF interpreter setting is present by @kaniini in #425
• chore: improve mac quick-start guide by @AlexsJones in #427
• Add an optional "deps" paramter to the go/build pipeline. by @dlorenc in #428
• pipelines: patch: add support for quilt patch-series files by @kaniini in #429
• build(deps): bump golang.org/x/sync from 0.1.0 to 0.2.0 by @dependabot in #432
• Set builddate in our .PKGINFO control data. by @mattmoor in #435
• use latest version of melange in lima configuration file by @developer-guy in #436
• add multiple runner options by @deitch in #263
• Add go vendor support to the go build pipeline. by @dlorenc in #440
• add configuration field inline docs by @joshrwolf in #430
• add extra logging when runner fails to TestUsability by @rawlingsj in #446
• default for mac is docker, not bwrap by @deitch in #447
• Update distroless references by @jonjohnsonjr in #452
• Update README.md by @imjasonh in #453
• Allow built in melange pipelines to be used in subpackages by @rawlingsj in #455
• Try to make install work on Linux and Mac. by @amouat in #451
• Pull in index builddate support. by @mattmoor in #460
• build(deps): bump github.com/docker/docker from 23.0.4+incompatible to 24.0.1+incompatible by @dependabot in #458
• Pull in the latest go-apk for xattrs support by @mattmoor in #462
• upgrade go-apk to latest commit, implement go-apk XattrFS interfaces by @kaniini in #463
• build(deps): bump google.golang.org/api from 0.119.0 to 0.123.0 by @dependabot in #457
• Require that build config YAML has only known fields by @luhring in #465
• include filename when parsing fails by @imjasonh in #466
• Remove secfixes and advisories altogether by @luhring in #468
• Validate configuration at the end of parsing by @luhring in #469
• upgrade alpine-lima to 3.18 by @developer-guy in #467
• add wolfictl by @developer-guy in #473
• Bump apko and fix what that breaks by @jonjohnsonjr in #477
• build(deps): bump github.com/containerd/containerd from 1.6.15 to 1.6.18 by @dependabot in #439
• build(deps): bump actions/setup-go from 4.0.0 to 4.0.1 by @dependabot in #448
• Refactor index code, support writing APKINDEX JSON representation natively by @kaniini in #478
• build(deps): bump github.com/lima-vm/lima from 0.14.2 to 0.16.0 by @dependabot in #479
• build(deps): bump sigstore/cosign-installer from 3.0.2 to 3.0.5 by @dependabot in #456
• warn and fallback to SOURCE_DATE_EPOCH=0 when specified but empty by @joshrwolf in #480
• run tests with race detector by @imjasonh in #482
• cond: allow underscores and capitalization in variable expressions by @kaniini in #485
• pipeline: fetch: optionally delete fetched artifacts after unpacking by @kaniini in #486
• Change the default for delete to false. by @dlorenc in #487
• import apko and go-apk with package caching by @deitch in #492
• fix apk caching directory by @deitch in #493
• do not attempt to use a cachedir which is unset, do not clobber melange cache dir setting by @kaniini in #494
• workflows: add wolfi-presubmit by @kaniini in #496
• Switch from calling Glob to two Stats by @jonjohnsonjr in #495
• import apko and go-apk with better debug logging by @deitch in #499
• add a kubernetes pod runner by @joshrwolf in #464
• add strip prefix and suffix update config for release monitor by @rawlingsj in #500
• ensure bundles are rooted correctly by @joshrwolf in #508
• add a split/debug pipeline by @joshrwolf in #509
• build: scan subpackage pipelines for dependencies by @kaniini in #510
• update apko and go-apk to use pinned deps correctly by @deitch in #511
• build(deps): bump google.golang.org/api from 0.125.0 to 0.127.0 by @dependabot in #507
• build(deps): bump actions/checkout from 3.5.2 to 3.5.3 by @dependabot in #502
• build(deps): bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0 by @dependabot in #503
• build(deps): bump golangci/golangci-lint-action from 3.4.0 to 3.6.0 by @dependabot in #504
• build(deps): bump docker/login-action from 2.1.0 to 2.2.0 by @dependabot in #505
• some small UX improvements for k8s runner by @imjasonh in #516
• update apko to 0.9.0 by @kaniini in #519
• build(deps): bump github.com/package-url/packageurl-go from 0.1.1-0.20220203205134-d70459300c8a to 0.1.1 by @dependabot in #513
• build(deps): bump sigstore/cosign-installer from 3.0.5 to 3.1.0 by @dependabot in #518
• build(deps): bump google.golang.org/api from 0.128.0 to 0.129.0 by @dependabot in #521
• build(deps): bump cloud.google.com/go/storage from 1.30.1 to 1.31.0 by @dependabot in #522
• add release notes for Melange 0.4.0 by @kaniini in #524
• build(deps): bump github.com/opencontainers/image-spec from 1.1.0-rc3 to 1.1.0-rc4 by @dependabot in #523

New Contributors

• @joshrwolf made their first contribution in #407
• @AlexsJones made their first contribution in #427
• @mattmoor made their first contribution in #435
• @jonjohnsonjr made their first contribution in #452

Full Changelog: v0.3.0...v0.4.0