Repository navigation
Tags
Tags
1.9 Release Changes since 1.8 This release focuses on downloader reliability, signed repository support, HTTP robustness, and a more secure container and CI setup. ### Highlights - Download .db.sig files for repositories that provide signed database metadata. - Correctly handle repositories without .db.sig files without generating unnecessary errors. - Abort stalled upstream downloads instead of waiting indefinitely. - Prevent concurrent downloads targeting different destination paths from being incorrectly shared. - Fix races in downloader usage tracking, streaming reads, mirrorlist caching, and concurrent prefetch updates. - Prevent purge operations from removing files that are still being written. - Preserve accurate download sizes and offsets using 64-bit integers. - Return appropriate server-side errors instead of masking them as 404 Not Found. - Add HTTP read-header and idle timeouts. - Expand test coverage for concurrency, stalled downloads, signed databases, purge behavior, mirrorlists, and error handling. ### Container and CI improvements - Run the production container as the dedicated non-root user 65532. - Add clearer cache volume ownership and user override documentation. - Pin base images by tag and digest. - Improve Docker build caching and reduce build context size. - Add OCI image labels and a development Docker target. - Rework multi-architecture image builds and publishing. - Build images during pull requests and manual workflow runs without pushing. - Replace Travis CI with the GitHub Actions workflow. - Add Dependabot updates for Go modules, Docker images, and GitHub Actions. - Update Go, Alpine, and project dependencies. This includes 26 commits and approximately 1,172 lines added since the 1.8 tag.