Unpin v1.4.0

Unpin v1.4.0

v1.4.0 moves persistent macOS Keychain access into a create-once,
Unpin-specific credential broker so ordinary application updates no longer
replace the executable that holds Keychain authorization.

Highlights

• macOS CLI and desktop archives include a separately signed
  unpin-credential-broker companion with the stable
  dev.unpin.credential-broker identifier.
• The CLI verifies the packaged companion before installing it under the Unpin
  app-state root. Ordinary updates preserve those exact installed bytes rather
  than rebuilding or overwriting the authorized broker.
• Broker requests use authenticated local IPC. The broker verifies client
  identity and peer ownership before allowing a Keychain operation, and the
  client verifies that it connected to the expected broker.
• Release automation now requires the protected Unpin-specific signing
  identity and verifies the CLI, desktop app, bundled bridge, and credential
  broker identifiers. The unrelated certificate used by earlier releases is
  retired from active automation.
• Update responses explicitly report whether the stable credential broker was
  preserved, and the desktop updater refuses to relaunch when that preservation
  cannot be proven.

Upgrading from v1.3.0

This release is a deliberate one-time trust migration. The signing certificate
used through v1.3.0 was unrelated to Unpin, so the built-in updater must not
silently carry it forward or rotate the credential boundary.

Download the matching v1.4.0 archive and verify its SHA256SUMS entry and
GitHub attestation. CLI users must manually install both unpin and
unpin-credential-broker from that same CLI archive. Desktop users must
manually replace the application with the verified desktop archive, which
contains its matching bridge and broker companion. On the first credential
operation, Unpin verifies and installs the broker under the app-state root and
macOS asks you to authorize it once. Later compatible CLI and desktop updates
leave that installed broker unchanged, so rebuilding the application alone no
longer causes another Keychain prompt.

A deliberate broker upgrade or future certificate rotation remains a separate
manual migration and requires renewed authorization.

Artifacts

The release provides three CLI archives and two native desktop archives:

• unpin-v1.4.0-aarch64-apple-darwin.tar.gz
• unpin-v1.4.0-x86_64-apple-darwin.tar.gz
• unpin-v1.4.0-x86_64-unknown-linux-gnu.tar.gz
• unpin-desktop-v1.4.0-aarch64-apple-darwin.tar.gz
• unpin-desktop-v1.4.0-x86_64-apple-darwin.tar.gz

Every archive has a CycloneDX SBOM, GitHub build-provenance and SBOM
attestations, and an entry in SHA256SUMS.

Trust boundary

The Unpin-specific personal certificate gives the broker a stable designated
requirement after the one-time migration. It is not an Apple Developer ID
certificate, and the artifacts are not notarized, so it does not establish
Gatekeeper trust. Verify checksums and GitHub attestations before using Finder's
Control-click Open flow. Do not disable Gatekeeper or strip quarantine
metadata. The release uses timestamp mode none and does not claim secure
timestamping. Full instructions are in the desktop guide, and
certificate expiry and rotation are covered in the release
guide.

Verification

This is an ordinary program release. Publication remains blocked until the
exact merged release commit passes the locked Rust workspace checks, macOS
XCTest suite, live Pi and OpenCode validation, and finalized provider matrix.
The draft artifacts must then pass complete checksum, attestation, stable
signature, exact-identifier, designated-requirement, authenticated broker and
bridge handshakes, and fresh-download verification. The approved
provider-matrix evidence bundle is attached before publication.

Known limitations

• The first credential operation after upgrading from v1.3.0 or earlier
  requires one new Keychain authorization for the stable broker.
• Broker upgrades and certificate rotation are intentionally not automatic and
  require a separately verified manual migration.
• No Developer ID signing or notarization.
• Desktop support remains macOS-only and architecture-specific.
• crates.io, Homebrew, Linux ARM64, and Windows distribution remain deferred.