Skip to content

CodeTruss CLI v0.2.36

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Aug 05:57
· 20 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.2.36
ed7debb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A Windows correctness release. The repository walk emitted whatever path separator the host used, so a Windows run produced src\users.ts while every other surface in the CLI — receipts, git snapshots, policy globs, scope inference — used src/users.ts.

That had three consequences, all fixed by normalizing at the source:

  • A signed receipt's findings table and its changed-files table named the same file two different ways. A receipt disagreed with itself.
  • Receipt bytes differed by platform for an identical tree, so a cross-platform reproduction could not match.
  • Vendored-directory exclusion (.claude/, vendor/, …) silently stopped matching on Windows, pulling tooling payloads back into analysis.

changedFindings() now compares paths separator-agnostically as well, as defense in depth.

Install

curl -fsSL https://codetruss.com/install.sh | sh

Verify what you installed

sha256  953e3f48725a7471043b48a55aedd33ef78854615a341dd95881d90eeae3e814

gh attestation verify codetruss-cli-0.2.36.tgz --repo CodeTruss/codetruss-cli

The archive ships with a CycloneDX SBOM and SLSA build provenance. You should not have to take our word for what is in it.

Assets 6
Loading