v0.6.0 - Format v1 Freeze, Server Enforcement & Sigstore Provenance

What's Changed in v0.6.0

Format Version 1 Specification Freeze

• Finalized and froze the repository format version 1: envelopes, recipient manifests, WAL journals, and deterministic HMAC cache indexing.

Server-Side Push Protection (git-agecrypt check --pre-receive)

• Native pre-receive hook enforcement rejecting unencrypted secrets, foreign recipient keys, or corrupted ciphertexts on Git servers before acceptance.

Diagnostic & Interoperability Tools (inspect, export-age)

• Added git-agecrypt inspect to inspect ciphertext headers, recipient lists, and metadata without full decryption.
• Added git-agecrypt export-age to export native age-compatible encrypted files for off-platform sharing.

Fail-Closed Rekey Recovery

• Validated atomic transactional rollback during rekeying operations, ensuring keys and journals remain intact until state consistency is verified.

Sigstore Provenance & Release Attestations

• Releases include cryptographically signed provenance attestations and build checksums.

Full Changelog: v0.5.0...v0.6.0