chore(release): 0.3.0

CHANGELOG.md

@@ -10,6 +10,8 @@ the CBOM/report/eval schema versions, the database) can change in a minor releas
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-10-17
+
 ### Changed
 
 - **The remote TLS CBOM says how it knows each fact, and keeps every identifier it read**
@@ -749,7 +751,8 @@ the CBOM/report/eval schema versions, the database) can change in a minor releas
 - **Storage:** SQLite only. Up to 50 snapshots of up to 32 MiB are kept per machine; there is no overall storage
   budget yet.
 
-[Unreleased]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.1.1...v0.2.0
 [0.1.1]: https://github.com/offsetsecurity/cipherhorizon/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/offsetsecurity/cipherhorizon/releases/tag/v0.1.0

deploy/cipherhorizon.container

@@ -23,7 +23,7 @@ After=network-online.target
 
 [Container]
 ContainerName=cipherhorizon
-Image=ghcr.io/offsetsecurity/cipherhorizon:0.2.0
+Image=ghcr.io/offsetsecurity/cipherhorizon:0.3.0
 PublishPort=127.0.0.1:8080:8080
 Volume=cipherhorizon-data:/data
 # Another port: set it here and in PublishPort (the health check follows it), e.g.

docs/engineering/DISTRIBUTION.md

@@ -92,7 +92,7 @@ tar -xzf cipherhorizon_0.1.0_linux_amd64.tar.gz
 docker run -d --name cipherhorizon -p 8080:8080 \
   -e CIPHERHORIZON_TOKEN="$(openssl rand -hex 24)" \
   -v cipherhorizon-data:/data \
-  ghcr.io/offsetsecurity/cipherhorizon:0.2.0
+  ghcr.io/offsetsecurity/cipherhorizon:0.3.0
 
 # container, built locally (docker-compose.yml at the repository root)
 echo "CIPHERHORIZON_TOKEN=$(openssl rand -hex 24)" > .env
@@ -136,10 +136,10 @@ gh attestation verify cipherhorizon_0.1.0_linux_amd64.tar.gz --repo offsetsecuri
 
 **Container image:**
 ```sh
-cosign verify ghcr.io/offsetsecurity/cipherhorizon:0.2.0 \
+cosign verify ghcr.io/offsetsecurity/cipherhorizon:0.3.0 \
   --certificate-identity-regexp '^https://github.com/offsetsecurity/cipherhorizon/\.github/workflows/release\.yml@refs/tags/v' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com
-gh attestation verify oci://ghcr.io/offsetsecurity/cipherhorizon:0.2.0 --repo offsetsecurity/cipherhorizon
+gh attestation verify oci://ghcr.io/offsetsecurity/cipherhorizon:0.3.0 --repo offsetsecurity/cipherhorizon
 ```
 
 Air-gapped users: the archives are self-contained, so download on a connected machine, verify there, and move

docs/engineering/INSTALL.md

@@ -120,7 +120,7 @@ header lists the commands). The log goes to `~/Library/Logs/CipherHorizon/cipher
 ```sh
 docker run -d --name cipherhorizon --restart unless-stopped \
   -p 127.0.0.1:8080:8080 -v cipherhorizon-data:/data \
-  ghcr.io/offsetsecurity/cipherhorizon:0.2.0
+  ghcr.io/offsetsecurity/cipherhorizon:0.3.0
 ```
 
 Or, from a checkout, `docker compose up -d` ([docker-compose.yml](../../docker-compose.yml): read-only