Skip to content

v0.6.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Aug 04:26
· 1012 commits to main since this release
v0.6.3
bd479c2

ManT 0.6.3

ManT 0.6.3 strengthens release licensing, verification, and supply-chain security without changing the v6 document protocol.

Highlights

  • Complete distribution notices: every ManT crate carries the Apache-2.0 text, bundled libmandoc ISC/BSD exceptions are mapped to their authoritative source headers, and native archives include a generated license report for the locked Rust dependency graph.
  • Verifiable native releases: every Linux and Windows archive ships with a target-specific CycloneDX SBOM, SHA-256 checksums, GitHub artifact attestations, and a portable Sigstore bundle.
  • Reproducible SBOM attestations: deterministic CycloneDX documents now receive a stable UUID serial number so GitHub can recognize and cryptographically bind them to each archive.
  • Automated supply-chain checks: CI audits advisories, licenses, dependency sources, pinned workflow dependencies, generated notices, and pull-request dependency changes.
  • Public security posture: the repository publishes an OpenSSF Scorecard, uploads SARIF findings to GitHub code scanning, and documents private vulnerability reporting.
  • Portable packaging checks: release metadata and package paths are normalized and tested on both Unix and Windows runners.

Install or update

Unix:

curl --proto '=https' --tlsv1.2 -LsSf https://raw.githubusercontent.com/BryanHeBY/ManT/main/scripts/install.sh | sh

Windows PowerShell:

irm https://raw.githubusercontent.com/BryanHeBY/ManT/main/scripts/install.ps1 | iex

Verify a release artifact

gh attestation verify mant-0.6.3-PLATFORM.EXT --repo BryanHeBY/ManT

The release archives also contain the self-hosted mant.md manual and complete applicable license notices.

Full changelog: v0.6.1...v0.6.3

Assets 12
Loading