[Bug]: v1.5.0 and v1.5.0-signed tags are not similar

[trhpx]

Is there an existing issue for this?

• I have searched existing issues

Current Behavior

v1.5.0-signed Is from June 11, 2025 and has the DBX updates from this same month.

v1.5.0
Is from April and seems quite unrelated

Expected Behavior

Should yesterday's tag be v1.6.0 instead? At the very least, not 1.5.0 to avoid confusion?

Steps To Reproduce

Observe GitHub

Build Environment

- OS(s):
- Tool Chain(s):
- Targets Impacted:

Version Information

v1.5.0

Urgency

Medium

Are you going to fix this?

Someone else needs to fix it

Do you need maintainer feedback?

Maintainer feedback requested

Anything else?

No response

[Flickdm]

@trhpx - Those tags are a remnant of a failed release due to token expiration I was attempting to make. I thought when I deleted the release that it would clear up the associated tag but I see I was mistaken. I went ahead and moved the tag for v.1.5.0 forward as it should match v1.5.0-signed and that's where it should be anyways.

Once #219 is in I will create a v1.5.1 release that actually has the real assets associated with them and a note explaining why there is no release for v1.5.0 and why v1.5.1 was created with a callout to this issue. I plan to leave this issue up until then to answer anyones questions in the meantime.

In the meantime - the signed payloads and raw Authenticode hashes were added in #214 and represent the latest revocations as of 6/11/25 and may be used.

[Flickdm]

New releases are available at https://github.com/microsoft/secureboot_objects/releases for v1.5.1 and v1.5.1-signed