SOW v0.7.0

November 09, 2026 · By Vonng · In Release · 1191 words · 6 min

• Release

• release
• signing
• rpm
• recovery

VonngAuthor of SOW and Pigsty.

SOW 0.7.0 adds flat RPM pruning and a shared password-file signing interface. It also fixes defects in migration, recovery, publication, RPM signature verification, and version ordering found during the release review.

Availability: SOW 0.7.0 is available on GitHub and the Download page.

These notes cover the changes since 0.6.1. Database schema v13, configuration schema sow/v3, and the public repository layout stay unchanged. Workspaces on 0.5.0 through 0.6.1 need no schema migration.

Prune old RPM versions

sow prune DIR keeps the highest Epoch/Version/Release for each package name and architecture, publishes the filtered index, then deletes older RPMs.

sow prune /srv/candidate --dry-run --protect age_18 --protect age_18-llvmjit
sow prune /srv/candidate --protect age_18 --protect age_18-llvmjit

• --dry-run validates and previews without writes. Each repeatable --protect NAME preserves all versions of an exact package name and must match a package.
• --metadata-timestamp SECONDS sets the index publication time, with the same default of 0 as create.
• Replacement packages must pass embedded digest checks. SOW binds the verified and indexed bytes to a stable file identity, including change time, and checks it before every deletion and before completion. An in-place rewrite with restored size and mtime stops further deletion.
• You can resume an interrupted cleanup by rerunning sow prune. SOW refreshes an existing repo_complete marker only after successful completion. Errors report completed changes, and SOW does not restore already deleted packages.

Prune works on top-level regular binary RPMs in a local publication source. It rejects managed workspaces, DEB packages or indexes, package symlinks, source RPMs, equal EVRs within a name/architecture group, RPM v6 packages, signed repomd.xml, and independent metadata that SOW cannot generate. It does not sign packages. Clients with cached old indexes may still need the old RPMs: account for that before publishing a pruned repository.

See the prune command reference.

Sign with password files

Use --passfile PATH, SOW_GPG_PASSFILE, or a per-key passfile in sow.yml for protected RPM package keys and RPM/APT metadata keys, including GPG agent keys.

sow create ./packages --sign-with 0123456789ABCDEF --passfile /run/secrets/gpg-password

The priority is CLI, per-key configuration (including a legacy passphrase reference), then environment. The file contains one nonempty UTF-8 line, at most 64 KiB. SOW removes one final LF or CRLF without trimming spaces or tabs. Use a literal path, not file://. Relative CLI/environment paths use the current directory; configured paths use the workspace root. SOW searches no default file.

The interface also covers signing preflight, initialization, migration, leaf export, and recovery of interrupted operations. Credentials do not enter process arguments, repository state, or public files. Password files must be regular files with no symlinks in the path. Keep them outside the repository with private access permissions. Legacy metadata passphrase references remain supported.

See the password-file contract, including command coverage and external GPG requirements.

RPM compatibility

• ECDSA and EdDSA signatures: accept these header signatures in RPM’s tag 267 (RPMSIGTAG_DSA), where modern RPM stores them. Real Ed25519 and ECDSA packages now verify; SOW still rejects a mismatched RSA signature in that tag.
• Caret ordering: fix Version and Release comparisons so a snapshot such as 2.0^20250611 sorts before 2.0.1. Managed version limits consequently retain the newer release.
• Foreign metadata: create keeps its existing behavior of replacing repomd.xml without groups, updateinfo, modules, or unknown records that SOW does not generate. This preserves compatibility with legacy Pigsty repositories, including the modules generated by Pigsty v4.4.0 on EL8/9. Human output now warns about dropped types; JSON output adds dropped_metadata when nonempty. SOW does not maintain the external metadata files or signatures themselves.
• Prune metadata guard: prune rejects those independent records before mutation and rechecks before publication. Prune allows SQLite and zchunk encodings of the package indexes. Prune also rejects an old index larger than the 16 MiB inspection limit. Create can still replace oversized or malformed indexes, but cannot report types it could not inspect.

If clients need the extra metadata, continue maintaining it with the appropriate generator. Refresh external repomd.xml.asc signatures after rebuilding.

Managed repositories and recovery

• Migrated repositories remain writable. A completed C2 migration retains the identity of the Generation it created. Later builds no longer cause check, build, add, or gc to reject that migration anchor, and repo rm no longer mistakes a completed migration for an active transition. Affected repositories recover after upgrading without manual database repair.
• Protect every published pointer. The withdrawal guard now checks the complete published Generation, including views unchanged by the latest publication. SOW rejects removing a Dist, architecture, or signing companion while a configured target still publishes it. Retire that target binding first, or publish under a new target name and prefix. Retired public files remain available for you to remove separately; ordinary publication does not withdraw them automatically.
• Unrelated offline targets no longer block operations. Publication, abort, and target GC compare the selected target against prospective paths of other targets. SOW still rejects actual physical path overlap.
• Recover interrupted plan writes. SOW can discard empty, partial, or hash-invalid GC plans in the planned phase before any deletion. It can rebuild retained-removal plans while the original target still exists. Contradictory state after destructive work remains an error.
• Export carried-forward Dists. export rpm-leaf accepts a clean Dist that a later Generation did not rebuild, with or without signing.
• Tolerate a backward clock step. Mutation recovery identifies the sole active operation by its ID instead of choosing by wall-clock order.

Dependencies and release checks

Go 1.27.3 remains the build baseline. YAML retains strict single-document validation and canonical configuration output. This release updates the bounded local RPM parser patch and third-party notices with the dependency changes.

Integration now requires protected-key signing tests on EL8, EL9, and EL10. The EL8 test detects whether rpmsign --rpmv3 exists and skips only the unsupported repeated-signature case. Release gates cover unit and race tests, APT/DNF clients, S3-compatible publication, static analysis, vulnerability reachability, reproducible clean-source builds, and archive/RPM/DEB contents. Hosted R2 live testing is optional and was not run for this review; macOS amd64 was cross-built on the arm64 review host.

Upgrade

Stop writers, back up the complete workspace while preserving hard links, install 0.7.0, then run these commands for each configured Repository:

sow version
sow build -r REPOSITORY -C /srv/sow
sow check -r REPOSITORY -C /srv/sow

An unchanged build is a no-op. Workspaces from 0.3 or 0.4 still need sow repo migrate REPOSITORY first. Plain repositories have no database migration.

SOW 0.6.1 and older cannot load a configuration that contains passfile; remove those fields before downgrading. The no-symlink rule for password files remains in force. SOW does not support RPM v6.

The release produces Linux and macOS archives for amd64 and arm64, two RPMs, two DEBs, and SHA256SUMS. See the installation guide and all changes since 0.6.1.