[levidurfee]

Summary

SBOMs. Each release binary now gets a CycloneDX SBOM beside it, such as rypt-linux-amd64.cdx.json:

• GoReleaser makes it with Syft v1.54.1, from the binary's own build information, so it lists exactly what was compiled in: the Go version, the rypt SDK, and x/crypto, x/sys, x/term.
• The SBOMs are listed in SHA256SUMS. The Homebrew cask is unchanged.
• CI installs Syft too, so the snapshot build checks SBOM generation on every PR.

govulncheck. A new vulncheck CI job fails when the code calls a function with a known vulnerability, in a module or in the standard library.

Newest Go for builds. govulncheck's first run found something:

• With Go 1.27.0 (go.mod's version, which CI and releases used), the CLI calls into 8 vulnerable standard-library packages: net/http, net/http/internal/http2, crypto/tls and net/textproto.
• Go 1.27.2 fixes all of them.
• The published v0.1.0 and v0.1.1 binaries were built with Go 1.27.0 and contain those packages. A binary scan of the v0.1.1 linux/amd64 binary confirms it.

So:

• CI and the release workflow now build with the newest Go release (go-version: stable, check-latest: true), as x6c-co/rypt does.
• go.mod now says go 1.27.2, so go install users also get a toolchain with the fixes.

The one remaining govulncheck note is an x/crypto advisory that has no fix yet and that the CLI never calls.

Testing

• I ran goreleaser release --snapshot --clean locally with GoReleaser v2.18.3 and Syft v1.54.1. It made six SBOMs, named after their binaries and listed in SHA256SUMS, each listing stdlib@1.27.2 and the four modules.
• govulncheck ./... with Go 1.27.2 reports no vulnerabilities affecting the code.
• make vet test passes.

After merging

Releasing v0.2.0 replaces the affected binaries.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NTEjHbdKp83qgQgmqR1BJ6