v2.0.1

Changelog

• 4f47155 bump go to 1.26.4 to squash CVE noise (#640)

Full v2 Release notes: https://github.com/hauler-dev/hauler/releases/tag/v2.0.0

v2.0.0

Release Overview for Hauler v2.0.0

Comparison base: v1.4.3 → v2.0.0

v2.0.0 is a major release. It replaces Hauler's entire OCI plumbing... the ORAS v1 dependency and the in-house cosign fork with a native containerd based implementation, drops the deprecated v1alpha1 API, and layers on a meaningful set of new capabilities and reliability fixes on top of that new foundation.

---

🏗️ The Big Overhaul - PR #515

"over-haul: replace ORAS v1 and the cosign fork with a native containerd-based implementation"

On the surface this is a "no new features" refactor, but it's the cornerstone of the release and the primary justification for the major version bump. It touched 28 files with ~2,300 insertions.

---

What Changed?

• Removed the ORAS v1 dependency - push/pull is now driven directly by containerd's docker resolver and google/go-containerregistry, new pkg/content/registry.go (RegistryTarget) and pkg/content/types.go (Target interface, IoContentWriter) replaces what ORAS used to own.
• Removed the hauler-maintained cosign fork - pkg/cosign is now a thin verify only wrapper around upstream sigstore/cosign/v3. Images are added through a native s.AddImage() path in pkg/store
• Added OCI 1.1 Referrers support - signatures, attestations, and SBOMs are discovered both via the classic cosign tag convention (sha256-<hex>.sig / .att / .sbom) and the modern Referrers API, then correctly through the OCI layout

---

Why It Matters?

• We own the copy path now. Because store copy registry:// is no longer black-boxed inside cosign, this release was able to add per-artifact retry logic (pkg/retry, --retries / --ignore-errors) and per-blob progress logging (pushed blob / existing blob, plus a completion line per artifact). That control simply wasn't possible while cosign owned the transfer loop
• No more fork maintenance burden. Tracking upstream cosign no longer means maintaining a divergent fork, we consume sigstore/cosign/v3 directly and stay current on security fixes without the extra effort
• Standards-forward signature handling. Supporting both legacy cosign tags and OCI 1.1 referrers means hauls produced today remain compatible with both older Hauler versions and modern registries that wire up referrers natively
• A cleaner internal contract. The new Target interface and containerd resolver give every command (add, sync, copy, save, serve) a single, consistent transfer abstraction, which is exactly what made the smaller features below cheap to build.

---

✨ New Features

PR	Feature	What it does
#551	Add images from a local Docker daemon	hauler store add image can now pull straight from the local Docker daemon using the --local flag, not just remote registries, but handy for air-gapping locally-built images.
#519	Chunked hauls	If there are size constraints on what can be brought into the airgap, Hauler can now chunk the haul into specified sizes during hauler store save and rejoin them on hauler store load . The --chunk-size flag accepts inputs as byte sizes, such as 1TB, 500MB, etc and will save multiple files not exceeding the specified size. When loaded, Hauler will automatically detect the files and join them back to one store. This is not compatible with the --containerd flag.
#538	Native images.txt sync	hauler store sync now has the option to sync artifacts from an images.txt file directly. The flag --image-txt allows you to pass an image list as a local or remote file, and Hauler will iterate over the list and add everything to your store. This is convenient for products that provide an images.txt file as a release artifact, but may not have a Hauler manifest available.
#541	Exclude extra artifacts on pull	A flag --exclude-extras (for both images and charts) to skip pulling associated sigs/atts/SBOMs/referrers when you only want the artifact itself, with smaller and faster hauls.
#547	--dry-run for sync --products	Preview exactly what a product sync would fetch before committing to the transfer.
#532	Multiple prefix references	Allows specifying more than one prefix reference (with de-duplication), improving flexibility when remapping repositories.

Dev tooling: #577 added a make target for vulnerability scanning.

---

🐛 Bug Fixes

PR	Fix
#604	Adjust regex for image detection within charts - to allow hyphen in image property
#618 / #411	Special-characters fix - adds regex filtering in store copy to skip invalid filenames that previously broke hauler store serve.
#529	Fix extract for OCI files - plus a guard against path-traversal during extraction.
#531	extract now handles image indexes correctly (multi-arch), not just single manifests.
#537	Fix --keep-registry logic - including correctly trimming the implicit library/ prefix.
#534	Fix Docker Hub default-host bug - correct default registry resolution.
#535	kind annotation no longer hard-codes cosign - descriptor kind values are now neutral/correct.
#514	File-referenced chart dependencies without a repository field are now handled correctly.
#575	Cleaner logging when extracting OCI artifacts that carry cosign bits.
#572	Removed an unnecessary rewrite flag from sync.
#553	Handle large diffs passed to the gh api (CI tooling).

---

⚠️ Breaking Changes ⚠️

• #528 - Removed deprecated code and dropped all v1alpha1 API support. Manifests using apiVersion: hauler.cattle.io/v1alpha1 will no longer be accepted; users must migrate to hauler.cattle.io/v1.
• The ORAS v1 and cosign-fork removals (#515) are internal, but any downstream tooling that depended on Hauler's forked cosign behavior should be re-validated before using v2.0.0

---

🔧 Maintenance & Dependencies 🔧

• Quality / CI: improved test coverage (#530), verified/signed commits + better messages (#550), Dependabot config (#585), Mergify replacing the cherry-pick bot (#581, #533), workflow fixes (#574), and a dev.md contributor guide (#521)
• Notable dependency bumps: Go → 1.26.0; sigstore/cosign/v3 → 3.1.1; containerd → 1.7.33; go-containerregistry → 0.21.7; helm/v3 → 3.21.2; in-toto-golang → 0.11.0; plus grpc, otel, docker/cli, go-jose, and zerolog.

📒 Full Changelog 📒

• v1.4.3...v2.0.0

Contributors

@amartin120
@CamrynCarter
@zackbradys
@atoy3731
@eklatzer
@dependabot[bot]

v2.0.0-rc.2

Changelog

• db69d73 add v2 to module path to correct version

Full Changelog: v2.0.0-rc.1...v2.0.0-rc.2

v2.0.0-rc.1

What's Changed

• fix dockerhub default host bug by @amartin120 in #534
• adjust hauler's kind annotation to not reflect cosign by @amartin120 in #535
• Bump google.golang.org/grpc from 1.78.0 to 1.79.3 in the go_modules group across 1 directory by @dependabot[bot] in #536
• Add cherry-pick workflow for release branches by @CamrynCarter in #533
• images.txt testdata file for testing image.txt sync by @CamrynCarter in #539
• fix keep registry logic by @CamrynCarter in #537
• Option to sync images.txt files natively by @CamrynCarter in #538
• chunk the haul by @CamrynCarter in #519
• Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in the go_modules group across 1 directory by @dependabot[bot] in #542
• allow multiple prefix references by @zackbradys in #532
• add optional flag for excluding extra artifacts when pulling from a registry by @amartin120 in #541
• Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 in the go_modules group across 1 directory by @dependabot[bot] in #548
• verified commits and better messages on backport merge commit by @CamrynCarter in #550
• Bump helm.sh/helm/v3 from 3.19.0 to 3.20.2 in the go_modules group across 1 directory by @dependabot[bot] in #552
• handle large file passed to gh api by @CamrynCarter in #553
• add dry-run flag for sync --products by @amartin120 in #547
• add ability to add images from local docker daemon by @amartin120 in #551
• Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 in the go_modules group across 1 directory by @dependabot[bot] in #557
• removed unnecessary rewrite flag from sync by @CamrynCarter in #572
• adjust logging for extracting oci artifacts with cosign bits by @amartin120 in #575
• fixed github workflows (tests and cherrypicker) by @zackbradys in #574
• added makefile command for vulnerability checks by @zackbradys in #577
• remove cherrypick bot and add mergify details by @CamrynCarter in #581
• Add dependabot configuration file to track multiple release minor rel… by @atoy3731 in #585
• Bump github.com/rs/zerolog from 1.34.0 to 1.35.1 by @dependabot[bot] in #593
• Bump github.com/google/go-containerregistry from 0.20.7 to 0.21.5 by @dependabot[bot] in #600
• Bump github.com/containerd/containerd from 1.7.30 to 1.7.31 by @dependabot[bot] in #596
• Bump helm.sh/helm/v3 from 3.20.2 to 3.21.0 by @dependabot[bot] in #610
• Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 in the go_modules group across 1 directory by @dependabot[bot] in #612
• Bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in #613
• Bump github.com/containerd/containerd from 1.7.31 to 1.7.32 by @dependabot[bot] in #616
• 411 special characters fix by @atoy3731 in #618
• Bump golang.org/x/sync from 0.20.0 to 0.21.0 by @dependabot[bot] in #620
• remove experimental notes from rewrite and remove for 2.0.0 release by @CamrynCarter in #621
• Bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in #628
• Bump k8s.io/apimachinery from 0.36.1 to 0.36.2 by @dependabot[bot] in #625
• Bump helm.sh/helm/v3 from 3.21.0 to 3.21.1 by @dependabot[bot] in #623
• bumped versions and dependencies by @zackbradys in #630
• Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 by @dependabot[bot] in #633
• updated git ignore by @zackbradys in #631
• Bump helm.sh/helm/v3 from 3.21.1 to 3.21.2 by @dependabot[bot] in #635
• fix: image detection regex to allow hyphen in image property by @eklatzer in #604

Full Changelog: v2.0.0-dev.1...v2.0.0-rc.1

v1.4.3

What's Changed

• [1.4] Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 in the go_modules group across 1 directory by @github-actions[bot] in #554
• [1.4] Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 in the go_modules group across 1 directory by @github-actions[bot] in #564
• [1.4] Bump google.golang.org/grpc from 1.78.0 to 1.79.3 in the go_modules group across 1 directory by @github-actions[bot] in #567
• fixed versions and dependencies on release/1.4 by @zackbradys in #568
• [1.4] removed unnecessary rewrite flag from sync by @github-actions[bot] in #573
• added makefile command for vulnerability checks (backport #577) by @mergify[bot] in #580
• remove cherrypick bot and add mergify details (backport #581) by @mergify[bot] in #582

Full Changelog: v1.4.2...v1.4.3

v1.4.3-rc.1

What's Changed

• [1.4] Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 in the go_modules group across 1 directory by @github-actions[bot] in #554
• [1.4] Bump github.com/sigstore/timestamp-authority/v2 from 2.0.4 to 2.0.6 in the go_modules group across 1 directory by @github-actions[bot] in #564
• [1.4] Bump google.golang.org/grpc from 1.78.0 to 1.79.3 in the go_modules group across 1 directory by @github-actions[bot] in #567
• fixed versions and dependencies on release/1.4 by @zackbradys in #568
• [1.4] removed unnecessary rewrite flag from sync by @github-actions[bot] in #573

Full Changelog: v1.4.2...v1.4.3-rc.1

v2.0.0-dev.2

What's Changed

• Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 in the go_modules group across 1 directory by @dependabot[bot] in #497
• Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 in the go_modules group across 1 directory by @dependabot[bot] in #498
• Bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 in the go_modules group across 1 directory by @dependabot[bot] in #502
• update cosign fork to 3.0.4 plus dep tidy by @amartin120 in #509
• fix: Fix file:// dependency chart path resolution by @eklatzer in #510
• update github.com/olekukonko/tablewriter to v1.1.2 by @amartin120 in #512
• keep registry on image rewrite if not specified by @CamrynCarter in #501
• Bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 in the go_modules group across 1 directory by @dependabot[bot] in #517
• update release/2.0 from main by @zackbradys in #546

New Contributors

• @eklatzer made their first contribution in #510

Full Changelog: v1.4.2-dev.1...v2.0.0-dev.2

v2.0.0-dev.1

What's Changed

• smaller changes and updates for v1.4.2 release by @zackbradys in #524
• over-"haul": replace oras v1 and cosign fork with native containerd-based implementation by @amartin120 in #515
• Bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible in the go_modules group across 1 directory by @dependabot[bot] in #526
• removed deprecated code by @zackbradys in #528
• fix extract for oci files by @amartin120 in #529
• improved test coverage by @amartin120 in #530
• adjust extract to handle an image index appropriately by @amartin120 in #531

Full Changelog: v1.4.2-rc.1...v2.0.0-dev.1

v1.4.2

What's Changed

• Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1 in the go_modules group across 1 directory by @dependabot[bot] in #495
• fix for new helm chart features by @zackbradys in #496
• Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 in the go_modules group across 1 directory by @dependabot[bot] in #497
• Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 in the go_modules group across 1 directory by @dependabot[bot] in #498
• Bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 in the go_modules group across 1 directory by @dependabot[bot] in #502
• update cosign fork to 3.0.4 plus dep tidy by @amartin120 in #509
• fix: Fix file:// dependency chart path resolution by @eklatzer in #510
• update github.com/olekukonko/tablewriter to v1.1.2 by @amartin120 in #512
• keep registry on image rewrite if not specified by @CamrynCarter in #501
• Bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 in the go_modules group across 1 directory by @dependabot[bot] in #517
• fix: handling of file referenced dependencies without repository field by @devLeitner in #514
• Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 in the go_modules group across 1 directory by @dependabot[bot] in #520
• dev.md file by @CamrynCarter in #521
• smaller changes and updates for v1.4.2 release by @zackbradys in #524

New Contributors

• @eklatzer made their first contribution in #510
• @devLeitner made their first contribution in #514

Full Changelog: v1.4.1...v1.4.2

v1.4.2-rc.1

What's Changed

• Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 in the go_modules group across 1 directory by @dependabot[bot] in #497
• Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 in the go_modules group across 1 directory by @dependabot[bot] in #498
• Bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 in the go_modules group across 1 directory by @dependabot[bot] in #502
• update cosign fork to 3.0.4 plus dep tidy by @amartin120 in #509
• fix: Fix file:// dependency chart path resolution by @eklatzer in #510
• update github.com/olekukonko/tablewriter to v1.1.2 by @amartin120 in #512
• keep registry on image rewrite if not specified by @CamrynCarter in #501
• Bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 in the go_modules group across 1 directory by @dependabot[bot] in #517
• fix: handling of file referenced dependencies without repository field by @devLeitner in #514
• Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 in the go_modules group across 1 directory by @dependabot[bot] in #520
• dev.md file by @CamrynCarter in #521

New Contributors

• @eklatzer made their first contribution in #510
• @devLeitner made their first contribution in #514

Full Changelog: v1.4.2-dev.1...v1.4.2-rc.1