v0.5.2

Patch release. jarvy update --method binary could not find a release
asset on any platform, so binary self-update failed for everyone; this
fixes it.

Fixes:

• Fix jarvy update --method binary failing with "No binary for this
  platform" (Windows) or a download error (macOS/Linux). The updater
  matched assets by an ad-hoc <os>-<arch> string (linux-x86_64,
  darwin-aarch64), but release assets are named by Rust target triple
  (x86_64-unknown-linux-musl, aarch64-apple-darwin,
  x86_64-pc-windows-msvc) since the binary-tarball change in v0.5.0,
  so nothing matched. The updater now requests the exact triple each
  platform ships. Other update methods (Homebrew, Cargo, apt/dnf/…)
  were unaffected.

Internal:

• Add a package-verify follow-through and make the telemetry
  disclosure tests hermetic against an ambient JARVY_TEST_MODE, so the
  Coverage and cross-platform E2E jobs are green again. crates.io
  publishing moved to Trusted Publishing (OIDC) with the API token kept
  as a fallback.

Full Changelog: v0.5.1...v0.5.2

Installation

Quick Install (Unix)

curl -fsSL https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.sh | bash

Quick Install (Windows PowerShell)

irm https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.ps1 | iex

Homebrew

brew install Cliftonz/tap/jarvy

Cargo

cargo install jarvy

Early-Release Channel

Pre-release tags (-rc.N, -beta.N) are routed through the beta channel.
Opt in: JARVY_CHANNEL=beta on the install script, or jarvy update --channel beta.
See docs/release-testing.md.

See installation docs for more options.

Security

Verify Signatures

All release artifacts are signed with Sigstore keyless OIDC. Verify any artifact:

# Substitute a triple that matches your platform, e.g.
# aarch64-apple-darwin, x86_64-unknown-linux-musl,
# aarch64-unknown-linux-gnu, x86_64-pc-windows-msvc (.zip).
ARTIFACT=jarvy-v0.5.2-x86_64-unknown-linux-musl.tar.gz
BASE=https://github.com/Cliftonz/jarvy/releases/download/v0.5.2
curl -LO $BASE/$ARTIFACT
curl -LO $BASE/$ARTIFACT.sig
curl -LO $BASE/$ARTIFACT.pem
cosign verify-blob \
  --signature $ARTIFACT.sig \
  --certificate $ARTIFACT.pem \
  --certificate-identity-regexp '^https://github\.com/Cliftonz/jarvy/\.github/workflows/release\.yml@refs/tags/v[0-9.]+(-[A-Za-z0-9.]+)?$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  $ARTIFACT

Tag Signature

This release was cut from a signed git tag. Verify with:

git -c gpg.ssh.allowedSignersFile=.github/allowed_signers tag --verify v0.5.2

SBOM

Software Bill of Materials in SPDX 2.3 (sbom.spdx.json) and CycloneDX 1.4 (sbom.cdx.json).

Checksums

SHA256 checksums for all artifacts are in SHA256SUMS.txt.