v0.0.3

Patch release. v0.0.2 went live on the GitHub release page but the
crates.io and Homebrew workflows that fire on release: published
both failed, leaving cargo install jarvy and
brew install bearbinary/tap/jarvy unavailable.

Fixed

• Cargo.toml declared readme = "README.md" (uppercase) but the
  tracked file is Readme.md (mixed case). On macOS the difference
  is invisible (case-insensitive filesystem); on the Linux CI runner
  it failed cargo publish with readme "README.md" does not appear to exist. Both Publish Crate and Publish to Package Managers
  workflows hit the same error. Same fix in the include = [...]
  manifest list. Now matches what's actually in the git tree.
• .github/workflows/winget.yml was scaffolded from a different
  project's template and never customized — identifier: Benji377.Tooka
  and fork-user: Benji377 referenced a totally unrelated package.
  Rewrote with placeholder TODO values for Jarvy.Jarvy /
  bearbinary and changed the trigger from release: published to
  workflow_dispatch only. winget-releaser cannot create a brand-new
  package registration; the first submission must go through
  wingetcreate new and a hand-reviewed PR to microsoft/winget-pkgs.
  After that's merged the trigger can be flipped back.

Removed

• Duplicate .github/workflows/crates.yml deleted. Both that and
  publish-packages.yml::publish-crates-io were firing on
  release: published and trying to cargo publish. Even if both
  had the right secret, the second one would race-fail with "crate
  version already exists". Kept the version inside publish-packages.yml
  because it composes with the Homebrew tap update via needs:.
• docs/release-testing.md and docs/release-quirks-jarvy.md
  references to crates.yml updated to point at the surviving
  workflow path.

Known issues (not fixed in this release)

• GitHub Pages is not enabled for bearbinary/Jarvy repo — the
  Deploy Docs workflow fails with HttpError: Not Found ... Ensure GitHub Pages has been enabled. Fix is in repo Settings → Pages,
  not in code. Until enabled, the docs site at jarvy.dev (or
  whichever Pages URL ends up provisioned) won't update on release.
• winget first submission still requires manual wingetcreate new
  intervention (see Fixed above for the workflow disable).

Full Changelog: v0.0.2...v0.0.3

Installation

Quick Install (Unix)

curl -fsSL https://raw.githubusercontent.com/bearbinary/jarvy/main/dist/scripts/install.sh | bash

Quick Install (Windows PowerShell)

irm https://raw.githubusercontent.com/bearbinary/jarvy/main/dist/scripts/install.ps1 | iex

Homebrew

brew install bearbinary/tap/jarvy

Cargo

cargo install jarvy

Early-Release Channel

Pre-release tags (-rc.N, -beta.N) are routed through the beta channel.
Opt in: JARVY_CHANNEL=beta on the install script, or jarvy update --channel beta.
See docs/release-testing.md.

See installation docs for more options.

Security

Verify Signatures

All release artifacts are signed with Sigstore keyless OIDC. Verify any artifact:

ARTIFACT=jarvy-linux-x86_64.tar.gz
BASE=https://github.com/bearbinary/jarvy/releases/download/v0.0.3
curl -LO $BASE/$ARTIFACT
curl -LO $BASE/$ARTIFACT.sig
curl -LO $BASE/$ARTIFACT.pem
cosign verify-blob \
  --signature $ARTIFACT.sig \
  --certificate $ARTIFACT.pem \
  --certificate-identity-regexp 'https://github.com/bearbinary/Jarvy/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  $ARTIFACT

Tag Signature

This release was cut from a signed git tag. Verify with:

git -c gpg.ssh.allowedSignersFile=.github/allowed_signers tag --verify v0.0.3

SBOM

Software Bill of Materials in SPDX 2.3 (sbom.spdx.json) and CycloneDX 1.4 (sbom.cdx.json).

Checksums

SHA256 checksums for all artifacts are in SHA256SUMS.txt.