v1.20260719.123633

fix(deps): pin lua-nginx-module to lua-resty-core's exact required ve…

v1.31.2: chore: ponytail audit cleanup — dead code and duplication (#292)

* refactor(bin): drop unused backward-compat aliases in common.py

get_tags, get_dockerfile, build, push, bundle, metadata,
get_all_versions, init_dockerfile and tag had zero callers anywhere in
the repo. Only get_supported_os was actually used, so it's kept.

* refactor(bin): reuse common.py constants in docker-build.py

ARM64V8_ARCH and DOCKER_IMAGES_COMMAND were redeclared locally even
though common.py already exports both.

* refactor(bin): drop redundant fetch_latest wrapper

fetch_specific()'s specific_tag parameter already defaults to
"latest", so fetch_latest(distro, pattern) was just restating that
default. Call fetch_specific directly at each call site instead.

* refactor(bin): extract retry_on_rate_limit into shared lib-retry.sh

sign-image.sh and sign-manifest.sh each carried an identical copy of
the retry-with-backoff helper. Source it from one place instead.

* refactor(bin): use pathlib.rglob instead of shelling out to find

generate-dockerfiles.py and generate_tags.py each spawned
/usr/bin/find via subprocess to list Dockerfiles under nginx/.
Path.rglob() does this natively, verified to produce byte-identical
file listings.

---------

Co-authored-by: fabiocicerchia <fabiocicerchia@users.noreply.github.com>

v1.30.3: chore: ponytail audit cleanup — dead code and duplication (#292)

* refactor(bin): drop unused backward-compat aliases in common.py

get_tags, get_dockerfile, build, push, bundle, metadata,
get_all_versions, init_dockerfile and tag had zero callers anywhere in
the repo. Only get_supported_os was actually used, so it's kept.

* refactor(bin): reuse common.py constants in docker-build.py

ARM64V8_ARCH and DOCKER_IMAGES_COMMAND were redeclared locally even
though common.py already exports both.

* refactor(bin): drop redundant fetch_latest wrapper

fetch_specific()'s specific_tag parameter already defaults to
"latest", so fetch_latest(distro, pattern) was just restating that
default. Call fetch_specific directly at each call site instead.

* refactor(bin): extract retry_on_rate_limit into shared lib-retry.sh

sign-image.sh and sign-manifest.sh each carried an identical copy of
the retry-with-backoff helper. Source it from one place instead.

* refactor(bin): use pathlib.rglob instead of shelling out to find

generate-dockerfiles.py and generate_tags.py each spawned
/usr/bin/find via subprocess to list Dockerfiles under nginx/.
Path.rglob() does this natively, verified to produce byte-identical
file listings.

---------

Co-authored-by: fabiocicerchia <fabiocicerchia@users.noreply.github.com>

v1.20260628.094952

regenerated nginx files

v1.20260604.051610: [ci skip] Automated metadata (#223)

Co-authored-by: fabiocicerchia <fabiocicerchia@users.noreply.github.com>

v1.20260603.055646: ci: sign per-arch images immediately after push (#194)

Restructure the cosign signing flow so each per-arch image is signed with
cosign and gets a CycloneDX SBOM attestation in the same CI job that
pushed it, right after `docker push`. The multi-arch index (manifest
list) continues to be signed in the Docker Bundle job after
`docker manifest push`. This matches the standard Sigstore workflow
(push → sign by digest) more literally and closes the window between
publication and signature.

- bin/sign-and-sbom.sh -> bin/sign-image.sh: renamed and repurposed as the
  "sign one image right after its push" path (sign by digest + attach
  SBOM + verify).
- bin/sign-manifest.sh: simplified to handle only the manifest list
  index; per-arch signing and per-arch SBOM attachment are removed
  because they now happen in the per-arch jobs. Per-platform SBOMs are
  still attached to the index digest so tag-based consumers can retrieve
  SBOMs through the index tag.
- Makefile: add `sign-image` target (previously referenced in docs/DEV.md
  but not implemented).
- .circleci/config.yml: extract cosign/syft install into reusable
  `install_cosign` / `install_syft` commands; invoke them plus
  `make sign-image` after the "Push images" step in Docker AMD / Docker
  ARM; update the Docker Bundle step name to reflect its narrower scope.
- SUPPLY_CHAIN_SECURITY.md: document when per-arch vs index signing
  happens in the pipeline.

Co-authored-by: Claude <noreply@anthropic.com>

v1.20260602.145549

disabled cleanup of multi-arch images (with suffix tag)

v1.20260517.191542

What's Changed

• Fix ngx_proxy_protocol_write call in mail proxy module by @fabiocicerchia in #182
• [ci skip] Automated metadata update by @fabiocicerchia in #193
• ci: bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #195
• Automated updates by @fabiocicerchia in #201

Full Changelog: v1.20260409.184919...v1.20260517.191542

v1.20260409.184919: Automated updates (#184)

Co-authored-by: fabiocicerchia <fabiocicerchia@users.noreply.github.com>

v1.20260408.063530: [ci skip] Automated metadata (#183)

Co-authored-by: fabiocicerchia <fabiocicerchia@users.noreply.github.com>