Skip to content

Unpin v1.4.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Aug 22:44
Immutable release. Only release title and notes can be modified.
v1.4.2
2fc9c06
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Unpin v1.4.2

v1.4.2 makes the tag-triggered release workflow safe to rerun after an
immutable GitHub release has already been published. It changes delivery
automation and release metadata only; Unpin's runtime behavior is unchanged.

Highlights

  • An existing draft still refreshes only after the workflow confirms that no
    provider-matrix evidence is attached.
  • An already-published immutable release is now an explicit non-mutating
    success path, so incident recovery does not fail merely because publication
    completed before a job rerun.
  • Missing releases still create a draft or draft prerelease and are never
    published directly by the workflow.

Upgrading from v1.4.1

This is a compatible delivery-only patch update. The CLI, terminal UI, desktop
workbench, MCP protocol editions, provider paths, configuration formats, and
mutation safety model are unchanged.

On macOS, install the CLI and unpin-credential-broker from the same verified
archive. A compatible update preserves the already installed stable broker
byte-for-byte, so this release does not require another Keychain authorization
unless the broker is deliberately replaced or the signing certificate changes.

Artifacts

The release provides three CLI archives and two native desktop archives:

  • unpin-v1.4.2-aarch64-apple-darwin.tar.gz
  • unpin-v1.4.2-x86_64-apple-darwin.tar.gz
  • unpin-v1.4.2-x86_64-unknown-linux-gnu.tar.gz
  • unpin-desktop-v1.4.2-aarch64-apple-darwin.tar.gz
  • unpin-desktop-v1.4.2-x86_64-apple-darwin.tar.gz

Every archive has a CycloneDX SBOM, GitHub build-provenance and SBOM
attestations, and an entry in SHA256SUMS.

Delivery-only verification

This release uses the maintainer-approved delivery-only exception because it
changes no program logic. Publication is contingent on workflow tests, locked
metadata, a version smoke, verified GNU/Linux glibc compatibility, and a Debian
12 artifact smoke. The tag workflow must produce all signed archives, SBOMs,
attestations, and checksums before the draft is published.
Post-tag verification also downloads the draft assets, checks checksums and
attestations, and confirms the expected certificate fingerprint and executable
identifiers in every macOS CLI and desktop archive.

Trust boundary

The Unpin-specific personal certificate gives the stable credential broker a
consistent designated requirement. It is not an Apple Developer ID certificate,
and the artifacts are not notarized, so it does not establish Gatekeeper trust.
Verify checksums and GitHub attestations before using Finder's Control-click
Open flow. Do not disable Gatekeeper or strip quarantine metadata. The
release uses timestamp mode none and does not claim secure timestamping.

Assets 14
Loading