Skip to content

v0.6.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jul 17:29
v0.6.3
This tag was signed with the committer’s verified signature.
Cliftonz Zac Clifton
SSH Key Fingerprint: kBE3PN8y73G0km42vo+O/iJR5ugoIx+G5am6Dad59pQ
Verified
Learn about vigilant mode.
d572cf1
This commit was signed with the committer’s verified signature.
Cliftonz Zac Clifton
SSH Key Fingerprint: kBE3PN8y73G0km42vo+O/iJR5ugoIx+G5am6Dad59pQ
Verified
Learn about vigilant mode.

First release under the gate model (see docs/release-testing.md):
soaked as v0.6.3-rc.1 for the 24h patch window because it changes the
update chain.

Security:

  • install.sh / install.ps1 checksum verification actually fires
    now.     Two stacked bugs meant curl | bash and PowerShell installs
    were silently skipping integrity verification: SHA256SUMS.txt
    entries carry build paths that the lookup never matched, and under
    PowerShell 7 the sums file arrived as raw bytes that never split into
    lines. Both installers now match entries by basename and decode the
    manifest explicitly — a tampered download aborts the install on every
    platform. Caught by the new installer end-to-end suite on its first
    run. SHA256SUMS.txt entries are also generated as bare asset names
    going forward (the pathed entries likewise broke Chocolatey's publish
    step on v0.6.1).

Fixes:

  • jarvy update --rollback no longer fails with Text file busy on
    Linux — the restore path wrote over the running executable; it now
    uses the same atomic temp-rename as the forward update. The consumed
    backup also no longer leaves an orphaned file in ~/.jarvy/backup/.
  • Windows binary updates retry the final swap (3× with backoff) when
    Defender or an indexer briefly holds the freshly extracted binary
    (Access is denied flake).
  • Release binaries embed the exact release tag: an rc build reports
    jarvy 0.6.3-rc.1 from --version instead of the bare crate
    version, and the update checker compares true prerelease versions —
    beta-channel users were previously never offered the next rc.
  • Unknown subcommands (jarvy rollback, typos) exit 2 in
    non-interactive contexts instead of printing a menu prompt and
    exiting 0 — scripts and CI can no longer mistake a typo for
    success. Humans at a TTY still get the interactive menu.

Changed:

  • Hooks run under bash (or sh) on Unix instead of the user's
    $SHELL. zsh's lack of word splitting silently broke POSIX-style
    hooks depending on who ran them — the same jarvy.toml now behaves
    identically for every developer. Opt back into a specific shell with
    [hooks.config] shell = "zsh".
  • A pinned node version installs through nvm when nvm is configured
    (nvm install <ver> && nvm alias default <ver>), so node = "24"
    is honored and a second package-manager node no longer shadows nvm's.
    Ranges and latest keep the platform installer.

Known issues:

  • Upgrading from v0.6.2 on Windows with jarvy update --method binary can intermittently fail with Access is denied — the retry
    fix ships in this release but the binary performing that upgrade is
    v0.6.2's. Re-run the update or use the install script. Upgrades from
    v0.6.3 onward retry automatically.

Internal:

  • Release pipeline hardening after the v0.6.1 incident: a
    draft-verification gate (checksums, cosign, SBOMs, and a binary
    --version smoke) must pass before any release publishes; the
    Cargo.toml↔tag guard refuses to build a mislabeled tag; and the
    installer/package e2e suites now actually run on every release.
    Soak-window automation is bump-kind aware and no longer labels
    force-dispatched validation runs (#53).

Full Changelog: v0.6.3-rc.1...v0.6.3

Installation

Quick Install (Unix)

curl -fsSL https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.sh | bash

Quick Install (Windows PowerShell)

irm https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.ps1 | iex

Homebrew

brew install Cliftonz/tap/jarvy

Cargo

cargo install jarvy

Early-Release Channel

Pre-release tags (-rc.N, -beta.N) are routed through the beta channel.
Opt in: JARVY_CHANNEL=beta on the install script, or jarvy update --channel beta.
See docs/release-testing.md.

See installation docs for more options.

Security

Verify Signatures

All release artifacts are signed with Sigstore keyless OIDC. Verify any artifact:

# Substitute a triple that matches your platform, e.g.
# aarch64-apple-darwin, x86_64-unknown-linux-musl,
# aarch64-unknown-linux-gnu, x86_64-pc-windows-msvc (.zip).
ARTIFACT=jarvy-v0.6.3-x86_64-unknown-linux-musl.tar.gz
BASE=https://github.com/Cliftonz/jarvy/releases/download/v0.6.3
curl -LO $BASE/$ARTIFACT
curl -LO $BASE/$ARTIFACT.sig
curl -LO $BASE/$ARTIFACT.pem
cosign verify-blob \
  --signature $ARTIFACT.sig \
  --certificate $ARTIFACT.pem \
  --certificate-identity-regexp '^https://github\.com/Cliftonz/jarvy/\.github/workflows/release\.yml@refs/tags/v[0-9.]+(-[A-Za-z0-9.]+)?$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  $ARTIFACT

Tag Signature

This release was cut from a signed git tag. Verify with:

git -c gpg.ssh.allowedSignersFile=.github/allowed_signers tag --verify v0.6.3

SBOM

Software Bill of Materials in SPDX 2.3 (sbom.spdx.json) and CycloneDX 1.4 (sbom.cdx.json).

Checksums

SHA256 checksums for all artifacts are in SHA256SUMS.txt.

Assets 71
Loading