Skip to content

v0.6.3-rc.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Jul 16:29
v0.6.3-rc.1
This tag was signed with the committer’s verified signature.
Cliftonz Zac Clifton
SSH Key Fingerprint: kBE3PN8y73G0km42vo+O/iJR5ugoIx+G5am6Dad59pQ
Verified
Learn about vigilant mode.
d3c758e
This commit was signed with the committer’s verified signature.
Cliftonz Zac Clifton
SSH Key Fingerprint: kBE3PN8y73G0km42vo+O/iJR5ugoIx+G5am6Dad59pQ
Verified
Learn about vigilant mode.
  • fix(release): basename-match SHA256SUMS entries in the draft gate (d3c758e)
  • fix(release): enable globstar in the draft gate's artifact collection (db7d4c2)
  • fix(release): draft gate verifies local artifacts + API asset cross-check (2515113)
  • chore(release): bump version to 0.6.3 (cd46ab0)
  • feat(release): gate model — verify the draft before publishing, rc only for update-chain changes (d0be5d2)
  • fix(security): make the re-enabled security workflow actionable (2b9b1b9)
  • feat(tools): route pinned node through nvm; deterministic hook shell; doc fixes (5a40713)
  • fix(update): tag-aware version + Windows self-replace retry (c05c773)
  • fix(ci): soak gate waits for the real bump-kind window before labeling (#53) (7ca3a81)
  • fix(ci): repair four broken/dead automation paths (0b04dd9)
  • fix(update): atomic temp-rename in rollback restore — ETXTBSY on Linux (9a44fe9)
  • fix(cli): exit 2 on unknown command without a TTY; fix Path 4 rollback invocation (4cf3411)
  • fix(ci): install cosign before release-paths Path 2 update step (4ec0f16)

Full Changelog: v0.6.2...v0.6.3-rc.1

Installation

Quick Install (Unix)

curl -fsSL https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.sh | bash

Quick Install (Windows PowerShell)

irm https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.ps1 | iex

Homebrew

brew install Cliftonz/tap/jarvy

Cargo

cargo install jarvy

Early-Release Channel

Pre-release tags (-rc.N, -beta.N) are routed through the beta channel.
Opt in: JARVY_CHANNEL=beta on the install script, or jarvy update --channel beta.
See docs/release-testing.md.

See installation docs for more options.

Security

Verify Signatures

All release artifacts are signed with Sigstore keyless OIDC. Verify any artifact:

# Substitute a triple that matches your platform, e.g.
# aarch64-apple-darwin, x86_64-unknown-linux-musl,
# aarch64-unknown-linux-gnu, x86_64-pc-windows-msvc (.zip).
ARTIFACT=jarvy-v0.6.3-rc.1-x86_64-unknown-linux-musl.tar.gz
BASE=https://github.com/Cliftonz/jarvy/releases/download/v0.6.3-rc.1
curl -LO $BASE/$ARTIFACT
curl -LO $BASE/$ARTIFACT.sig
curl -LO $BASE/$ARTIFACT.pem
cosign verify-blob \
  --signature $ARTIFACT.sig \
  --certificate $ARTIFACT.pem \
  --certificate-identity-regexp '^https://github\.com/Cliftonz/jarvy/\.github/workflows/release\.yml@refs/tags/v[0-9.]+(-[A-Za-z0-9.]+)?$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  $ARTIFACT

Tag Signature

This release was cut from a signed git tag. Verify with:

git -c gpg.ssh.allowedSignersFile=.github/allowed_signers tag --verify v0.6.3-rc.1

SBOM

Software Bill of Materials in SPDX 2.3 (sbom.spdx.json) and CycloneDX 1.4 (sbom.cdx.json).

Checksums

SHA256 checksums for all artifacts are in SHA256SUMS.txt.

Soak window (24h): PASSED — see #65 for the audit trail.

Assets 71
Loading