Skip to content

What's new in 0.7.1

Published on 2026-10-06: Python SDK rayito 0.7.1, TypeScript SDK rayito 0.7.1 and rayd 0.7.1.

A patch release on top of 0.7.0, with no API changes: rayd now carries the license notices of the libraries it includes, and the release signs the list of checksums of its files. The two SDKs only change their number, except for a new check in rayito image zip.

License notices travel with rayd

rayd is Apache-2.0 and statically links about 210 third-party crates (MIT, Apache-2.0, BSD, ISC, Unicode-3.0, Zlib and one CC0). Those licenses ask for their notice to accompany the binary wherever it is distributed, and since 0.7.1 it does, in all three copies:

Where What you find
GitHub Release rayd-v0.7.1 assets LICENSE, NOTICE and THIRD_PARTY_LICENSES.md
rayito-image.zip licenses/ folder with the same three files
Image published from that zip /usr/share/doc/rayd/, owned by root and read-only for everyone else

Inside a sandbox:

from rayito import Sandbox

with Sandbox.create(template="rayito-base") as sandbox:
    print(sandbox.commands.run("ls /usr/share/doc/rayd/").stdout)
    # LICENSE  NOTICE  THIRD_PARTY_LICENSES.md

import { Sandbox } from "rayito";

const sandbox = await Sandbox.create({ template: "rayito-base" });
try {
  const result = await sandbox.commands.run("ls /usr/share/doc/rayd/");
  console.log(result.stdout); // LICENSE  NOTICE  THIRD_PARTY_LICENSES.md
} finally {
  await sandbox.kill();
}

THIRD_PARTY_LICENSES.md is not versioned: cargo-about generates it from the tag's Cargo.lock every time it is packaged, and the build fails if it does not list exactly the crates compiled into rayd or if any is missing from the binary's .dep-v0. How to check it yourself: Verify a release.

SHA256SUMS is signed

The rayd release already published SHA256SUMS. Since 0.7.1 it also carries its Sigstore signature, SHA256SUMS.sigstore.json. The list covers every asset except itself and its signature, so a single verification also covers the SBOM and the license notices, which have no signature of their own:

RAYD_VERSION=0.7.1

cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity "https://github.com/alejandro-cedeno-10/rayito/.github/workflows/release.yml@refs/tags/rayd-v${RAYD_VERSION}" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  SHA256SUMS

sha256sum -c SHA256SUMS

rayito image zip requires the notices

If you package your own image, rayito image zip (and make image-zip) refuses to package an image directory that carries rayd without licenses/LICENSE, licenses/NOTICE and licenses/THIRD_PARTY_LICENSES.md. The image's Dockerfile copies them to /usr/share/doc/rayd/, so without them the build would fail later, already on AWS. From the repository, make image-licenses puts them in place, and make image-zip does it by itself. A directory without rayd is packaged just as before.

How to upgrade from 0.7.0

pip install -U "rayito[cli]"

pnpm add rayito@latest

Nothing else is required. The compatibility series is still 0.7, so a 0.7.1 SDK works with a rayd 0.7.0 image and vice versa. Republish the image (Images) when you want the notices to be inside the sandbox.

Full details: Changelog.