[colonel-byte-release-please]

🤖 I have created a release beep boop

0.40.0 (2026-11-08)

⚠ BREAKING CHANGES

• sha256sum: compute the digest of a file in an oci:// artifact (#1046)
• assemble: let a file source name an oci:// reference (#1045)

Features

• assemble: let a file source name an oci:// reference (#1045) (54aabb6)
• assemble: record and pin the digest an oci:// file source resolved to (#1051) (bb27376)
• coci: take a file out of a single-layer container image (#1050) (696a97b)
• examples: render a k3s flavor whose binary comes from the k3s image (#1052) (925643e)
• sha256sum: compute the digest of a file in an oci:// artifact (#1046) (b009975)

Bug Fixes

• assemble: stage an extractPath that collides with its target name (#1043) (e9c363c)
• contentstore: match an oci:// file source against the bare ref a store records (#1055) (62794b9)
• haulerstore: resolve a multi-platform file artifact per architecture (#1044) (06056d0)

Documentation

• commands: regenerate the command reference for pflag v1.1.0 (#1042) (23070bc)

Miscellaneous

• deps: update rancher distro pins to v1.37.2, v1.36.6, v1.35.10 (#1040) (4c2b9a9)
• examples: add the rendered k3s-oci examples (#1053) (ce3fe1d)

Build

• deps: bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.23.3 to 1.24.0 in the cloud-kms group (#1035) (55b5ab3)
• deps: bump github.com/go-jose/go-jose/v4 from 4.1.7 to 4.1.8 (#1038) (6befcaa)
• deps: bump github.com/spf13/pflag from 1.0.10 to 1.1.0 (#1037) (b79856c)
• deps: bump the core group with 3 updates (#1036) (0197fda)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Binary size

	Size
Latest release	40MB
This PR	40MB
Difference	+160KB (0.39%)