SOW v0.7.1

November 11, 2026 · By Vonng · In Release · 545 words · 3 min

• Release

• release
• recovery
• rpm
• s3

VonngAuthor of SOW and Pigsty.

SOW 0.7.1 updates the Go toolchain and dependencies. It also fixes recovery, package validation, RPM export, and S3/R2 handling.

Download the release from GitHub or the Download page.

These notes cover changes since 0.7.0. Database schema v13, configuration schema sow/v3, the CLI, and the public repository layout remain compatible. Workspaces on 0.5.0 through 0.7.0 need no schema migration.

Recovery and repository state

• Recover interrupted legacy dist.new and dist.init operations when effective signing is absent.
• Preserve unproven C2 migration stage files intact under .sow/<repo>/abandoned/ and report their location. Empty stages are removed, repeated recovery is safe, and local GC can proceed. Inspect the reported files before removing them.
• Reopen directory cursors between deletion batches so cleanup completes on macOS APFS and BSD filesystems.
• Keep multi-statement SQLite reads in one read-only transaction. Split large Dist membership queries below SQLite’s parameter limit.
• Normalize legacy repository time records with fractional seconds and reject years outside 1..9999.

Package validation and RPM export

• Reject RPM v6 consistently in Plain create, every prune path, and Managed ingestion.
• Limit decompressed DEB control archives and APT/RPM metadata streams, including oversized PAX headers.
• Recognize Linux renameat2 unsupported-operation errors and retain the portable fallback.
• Allow export rpm-leaf when an unrelated filesystem publication target is unmounted. Physical path overlap is still rejected.
• Use the selected Dist’s recorded build publication time for the exported metadata signature. A later build of another Dist no longer changes that time. The exported repomd.xml data timestamp remains 0.
• Accept repeated package inputs when sow add receives both explicit files and their parent directory.

S3 and R2

The updated AWS SDK retries bodyless HTTP 429 responses. SOW preserves the HTTP error classification when those retries are exhausted.

SOW also finds HTTP status codes inside joined errors. An HTTP 404 during multipart abort means the upload is already removed. Error XML responses for listing and multipart operations now have size limits.

Toolchain and dependencies

Source builds require Go 1.27.4 or newer. All 35 required module versions were checked against the latest available versions during release preparation.

AWS internals, pprof, x/mod, x/sync, and modernc compiler dependencies are also updated. The local RPM parser security patch is retained. Third-party notices match the new release builds.

Upgrade

Stop workspace writers and back up the complete workspace with hard links preserved. Install 0.7.1, then build and check each configured Repository:

sow version
sow build -r REPOSITORY -C /srv/sow
sow check -r REPOSITORY -C /srv/sow

An unchanged build is a no-op. Workspaces from 0.3 or 0.4 still need sow repo migrate REPOSITORY first. Plain repositories have no database migration.

SOW 0.6.1 and older cannot read configurations containing passfile. Remove those fields before downgrading. RPM v6 remains unsupported.

The release includes four Linux/macOS archives, two RPMs, two DEBs, and SHA256SUMS. See the upgrade guide and complete changes.