Skip to content

v0.0.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 May 17:52
v0.0.2
This tag was signed with the committer’s verified signature.
Cliftonz Zac Clifton
SSH Key Fingerprint: kBE3PN8y73G0km42vo+O/iJR5ugoIx+G5am6Dad59pQ
Verified
Learn about vigilant mode.
773d46f
This commit was signed with the committer’s verified signature.
Cliftonz Zac Clifton
SSH Key Fingerprint: kBE3PN8y73G0km42vo+O/iJR5ugoIx+G5am6Dad59pQ
Verified
Learn about vigilant mode.

Patch release fixing the cosign verification snippet baked into
release notes, SECURITY.md, and docs/release-quirks-jarvy.md.

Fixed

  • release notes / SECURITY.md / docs: the
    --certificate-identity-regexp value used bearbinary/jarvy
    (lowercase j). The actual Sigstore cert subject GitHub Actions
    produces is bearbinary/Jarvy/... (capital J — the repo's
    canonical case). cosign's regex is case-sensitive, so users
    copy-pasting the verify command from the v0.0.1 release page
    saw "none of the expected identities matched" even though the
    signature was valid. Corrected all three sources to
    bearbinary/Jarvy/. github.com URLs elsewhere in the repo are
    unchanged because GitHub URL matching is case-insensitive — only
    cosign's regex was affected.

Full Changelog: v0.0.1...v0.0.2

Installation

Quick Install (Unix)

curl -fsSL https://raw.githubusercontent.com/bearbinary/jarvy/main/dist/scripts/install.sh | bash

Quick Install (Windows PowerShell)

irm https://raw.githubusercontent.com/bearbinary/jarvy/main/dist/scripts/install.ps1 | iex

Homebrew

brew install bearbinary/tap/jarvy

Cargo

cargo install jarvy

Early-Release Channel

Pre-release tags (-rc.N, -beta.N) are routed through the beta channel.
Opt in: JARVY_CHANNEL=beta on the install script, or jarvy update --channel beta.
See docs/release-testing.md.

See installation docs for more options.

Security

Verify Signatures

All release artifacts are signed with Sigstore keyless OIDC. Verify any artifact:

ARTIFACT=jarvy-linux-x86_64.tar.gz
BASE=https://github.com/bearbinary/jarvy/releases/download/v0.0.2
curl -LO $BASE/$ARTIFACT
curl -LO $BASE/$ARTIFACT.sig
curl -LO $BASE/$ARTIFACT.pem
cosign verify-blob \
  --signature $ARTIFACT.sig \
  --certificate $ARTIFACT.pem \
  --certificate-identity-regexp 'https://github.com/bearbinary/Jarvy/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  $ARTIFACT

Tag Signature

This release was cut from a signed git tag. Verify with:

git -c gpg.ssh.allowedSignersFile=.github/allowed_signers tag --verify v0.0.2

SBOM

Software Bill of Materials in SPDX 2.3 (sbom.spdx.json) and CycloneDX 1.4 (sbom.cdx.json).

Checksums

SHA256 checksums for all artifacts are in SHA256SUMS.txt.

Assets 51
Loading