# Releases of sigsum-go

## What is a release?

A release of sigsum-go is a git tag that is mentioned in the [NEWS][]
file, and announced on the [sigsum-announce][] mailing list. Starting
with v0.14.1, tags of this form are used exclusively for releases, but
some of the older tags of this form are not considered releases.

[NEWS]: ./NEWS
[sigsum-announce]: https://lists.sigsum.org/mailman3/postorius/lists/sigsum-announce.lists.sigsum.org/

## What is being released?

### Command line programs

The following programs are released and supported:

- `./cmd/sigsum-key`
- `./cmd/sigsum-policy`
- `./cmd/sigsum-submit`
- `./cmd/sigsum-token`
- `./cmd/sigsum-verify`

User visible changes in these tools are documented in the [NEWS][]
file.

There are two additional programs, currently not properly supported:
`./cmd/sigsum-monitor` is work-in-progress. `./cmd/sigsum-witness` is
intended mainly for test purposes (to operate a witness, see
[litewitness][]).

[litewitness]: https://github.com/FiloSottile/torchwood/tree/main/cmd/litewitness

### Builtin named policies

A set of builtin named policies are included as files in the
`./pkg/policy/builtin/` directory. Those are embedded in the built
executable files. The contents of each builtin policy can be shown
using the `sigsum-policy` program.

### Library

The Go library (exported packages under `./pkg`) is intended for
applications that want to implement Sigsum logging, without going via
the command line tools. Important changes are documented in the NEWS
file, but we are not yet able to promise API stability (as indicated
by the "v0.*" module version). There's no documentation beyond the
source code comments.
