Release Notes on SOW

SOW v0.7.1

Vonng — Wed, 11 Nov 2026 22:00:00 +0800

v0.7.1 · 2026-11-11

SOW 0.7.1 updates the Go toolchain and dependencies. It also fixes recovery, package validation, RPM export, and S3/R2 handling.

Download the release from GitHub or the Download page.

These notes cover changes since 0.7.0. Database schema v13, configuration schema sow/v3, the CLI, and the public repository layout remain compatible. Workspaces on 0.5.0 through 0.7.0 need no schema migration.

Recovery and repository state

Recover interrupted legacy dist.new and dist.init operations when effective signing is absent.
Preserve unproven C2 migration stage files intact under .sow/<repo>/abandoned/ and report their location. Empty stages are removed, repeated recovery is safe, and local GC can proceed. Inspect the reported files before removing them.
Reopen directory cursors between deletion batches so cleanup completes on macOS APFS and BSD filesystems.
Keep multi-statement SQLite reads in one read-only transaction. Split large Dist membership queries below SQLite’s parameter limit.
Normalize legacy repository time records with fractional seconds and reject years outside 1..9999.

Package validation and RPM export

Reject RPM v6 consistently in Plain create, every prune path, and Managed ingestion.
Limit decompressed DEB control archives and APT/RPM metadata streams, including oversized PAX headers.
Recognize Linux renameat2 unsupported-operation errors and retain the portable fallback.
Allow export rpm-leaf when an unrelated filesystem publication target is unmounted. Physical path overlap is still rejected.
Use the selected Dist’s recorded build publication time for the exported metadata signature. A later build of another Dist no longer changes that time. The exported repomd.xml data timestamp remains 0.
Accept repeated package inputs when sow add receives both explicit files and their parent directory.

S3 and R2

The updated AWS SDK retries bodyless HTTP 429 responses. SOW preserves the HTTP error classification when those retries are exhausted.

SOW v0.7.0

Vonng — Mon, 09 Nov 2026 09:00:00 +0800

v0.7.0 · 2026-11-09

SOW 0.7.0 adds flat RPM pruning and a shared password-file signing interface. It also fixes defects in migration, recovery, publication, RPM signature verification, and version ordering found during the release review.

Availability: SOW 0.7.0 is available on GitHub and the Download page.

These notes cover the changes since 0.6.1. Database schema v13, configuration schema sow/v3, and the public repository layout stay unchanged. Workspaces on 0.5.0 through 0.6.1 need no schema migration.

SOW v0.6.1

Vonng — Thu, 22 Oct 2026 20:30:00 +0800

v0.6.1 · 2026-10-22

SOW 0.6.1 is a maintenance release with updated dependencies and clearer error messages. It keeps the CLI, database schema v13, configuration sow/v3, and public repository layout. Workspaces already on 0.5.0 or 0.6.0 need no schema migration.

Get the packages and archives from the download page, with checksums from the v0.6.1 release.

Toolchain and dependencies

Source builds now require Go 1.27.3 or newer. All release binaries use Go 1.27.3. The release updates the libraries used for encryption, S3 access, compression, SQLite, and Debian package parsing.

SOW v0.6.0

Vonng — Sat, 17 Oct 2026 00:00:00 +0800

v0.6.0 · 2026-10-17

SOW 0.6.0 improves repository updates, file verification, and recovery after an interruption. It keeps the current command set, configuration format, and public repository layout. A Managed workspace already on 0.5.0 needs no database migration.

This note covers the changes since 0.5.0. Use the installation guide for upgrade steps and the download page for release availability.

Changes for repository operators

Area	Change in 0.6.0	Effect on your workflow
Plain RPM updates	Keep current and immediately previous checksum-named metadata	Clients can finish fetching metadata referenced by the previous index
Managed builds	Record one publication time for metadata and signatures	Recovery preserves the original time; unchanged builds keep their existing output
File verification	Check file identity throughout authenticated reads	SOW detects replaced or rewritten files, including rewrites that restore the modification time
Signing keys	Read complete OpenPGP key bundles	SOW checks all supplied trusted keys and rejects malformed input
State and recovery	Preserve locks, consistent reads, and committed results	Maintenance errors do not make completed changes appear to have rolled back
Large repositories	Reuse verified data and limit parallel work	Builds, imports, checks, and publication avoid repeated work

Plain RPM updates keep the previous indexes

A client first downloads repomd.xml, then requests the metadata files named inside it. An update between those requests could previously remove the old metadata files before the client fetched them.

SOW v0.5.0

Vonng — Tue, 29 Sep 2026 00:00:00 +0800

v0.5.0 · 2026-09-29

SOW 0.5.0 adds publication timestamps for existing YUM repositories and fixes Managed repository recovery, signing, and package-path handling. It also reduces repeated package verification during builds.

Install the release from Download SOW. If you use a Managed workspace from 0.3 or 0.4, migrate each Repository before further writes.

Upgrade a Managed workspace

Stop commands that write to the workspace.
Back up the complete workspace, including sow.yml, .sow/, and all Repository roots.
Install SOW 0.5.0.
Migrate, build, and check each Repository. Replace pgsql and /srv/sow with your names.

sow repo migrate pgsql -C /srv/sow
sow build -r pgsql -C /srv/sow
sow check -r pgsql -C /srv/sow

The migration updates the database to schema v13. Configuration remains sow/v3, and the public layout remains pool/ plus dists/. The first build refreshes RPM authentication and APT metadata records. Later builds reuse matching RPM verification records.

SOW v0.4.0

Vonng — Mon, 24 Aug 2026 00:00:00 +0000

v0.4.0 · 2026-08-24

SOW 0.4.0 improved Managed repository verification and recovery. check reads each physical package once for its content hash. RPM verification keeps separate trust decisions for separate key sets. Publication targets can change their public URL or cache lifetime through an audited rebind operation.

Plain behavior and the public pool/ and dists/ layout stayed the same. This page describes version 0.4.0; use the installation guide to upgrade to the current release.

SOW v0.3.0

Vonng — Mon, 10 Aug 2026 00:00:00 +0000

v0.3.0 · 2026-08-10

SOW 0.3.0 reduced repeated package reads and database queries. Plain generation uses one pass over package content. Managed builds cache parsed package data and commit new pool files in batches. This release also removed retired runtime and publication code.

Plain: read each package once

The default unsigned sow create path hashes and parses each RPM or DEB once. --jobs controls parallel work. SOW renders metadata from the parsed results, then checks that the package set and file attributes still match before writing the indexes.

SOW v0.2.0

Vonng — Sat, 08 Aug 2026 00:00:00 +0000

v0.2.0 · 2026-08-08

SOW 0.2.0 introduced Plain and Managed workflows for RPM and DEB repositories. It builds static package repositories with one Go executable on Linux or macOS.

This page describes the 0.2.0 release. Use the current documentation for installation and operations today.

Build a flat repository

Plain mode indexes RPM and DEB files at the top level of a directory: