pip-rns 1.6.0

Packaging and platform support

• Requires Python 3.10 or newer (3.8 and 3.9 dropped)
• Linux installs now pull landlockpy and seccompy, Quad4's Landlock LSM
  and seccomp-BPF bindings, for downstream sandboxing
• Dev tooling refreshed (ruff, mypy, hypothesis) and workflow action
  pins updated

Security fixes

• opip kit runtime tarballs extract member-by-member: path traversal,
  escaping links, device nodes, and setuid bits are rejected; symlinks
  become payload copies on Windows where os.symlink needs a privilege
• get-opip.py and self-install reject zip members that escape the
  destination (zip-slip)
• Remote-controlled values (URLs, refs, release tags) can no longer be
  smuggled through as git or rngit options; -- separators and explicit
  validation cover clone, fetch, and release paths
• pip-rns install WHEEL --venv creates the venv before picking the
  backend instead of failing on a missing interpreter

Docs

• Docs moved from Docsify to Zensical at pip-rns.quad4.io: dark-first
  void/paper theme that follows the browser preference, and a version
  selector backed by mike (dev on master, latest on releases)

Testing and repository

• scripts/e2e.py runs a real end-to-end smoke (wheel, venv install,
  zipapps, self-install, offline bundle roundtrip) on Linux, macOS,
  and Windows in CI
• New adversarial tests cover tar and zip traversal plus CLI option
  injection
• Issue templates, maintainer slash commands (/fixed, /needs-info),
  and stale issue cleanup
• Zizmor findings fixed across all workflows; every grant is scoped
  and documented

pip-rns 1.5.1

• Fix pip-rns install swallowing the remote as rns://install when using
  pip-rns install rns://... (install-command inject used the wrong argv index)

pip-rns 1.5.0

Zipapps, kits, and no-pip bootstrap

• Signed zipapps (opip.pyz, pip-rns.pyz) run with only a Python interpreter
• self-install places opip and pip-rns on PATH via manual extract, uv, or ensurepip
• get-opip.py builds those zipapps from a browser-downloaded wheel or Tor URL
• opip kit create / kit verify builds USB airgap kits with optional portable CPython
• kit create --as-app writes AppImage-style ./Run launchers
• HTTP(S) and SOCKS5(h) proxy for create and kit downloads (--proxy, OPIP_PROXY)
• --break-system-packages and --backend manual for installs when pip is absent
• pip-rns local wheel install falls back to uv or manual extract when pip is missing
• Help topics: opip help airgap, pip-rns help bootstrap

Docs and repository hardening

• Docsify docs site on GitHub Pages (pip-rns.quad4.io)
• GitHub Actions supply-chain hardening (Harden Runner first, pinned workflows)
• Scorecard and CodeQL fixes (TLS 1.2 floor, safer URL handling, dependency policy)

pip-rns 1.4.0

• Browse can listen, save, scan, and optionally install in one flow
• Search across aliases, indexes, and discovered packages
• Interactive help and package picker when you run install with no arguments
• Install local wheels from a file or export directory
• Doctor --fix suggests commands to repair your setup
• Auto-alias prompt after browse or discover scan
• Install hints and defaults use short package names
• Trust prompt when a remote is unpinned
• Branch installs hint when a release wheel already exists
• opip prefers stable PyPI releases over prereleases (PEP 440 compare)
• opip install prompts to recover from PEP 668 (venv, --user, or --target)
• opip --user retries with --break-system-packages on Arch-style PEP 668
• opip refuses or recreates a venv when its Python version mismatches the bundle
• opip filters incompatible wheels and rejects unreadable venv interpreters
• CI test matrix covers Ubuntu, Windows, and macOS
• opip update reinstalls with replace (no uninstall-first), restores dest/venv, and can re-sign
• opip create from private indexes, local find-links, or offline wheel dirs
• opip create from uv.lock, poetry.lock, or pip-tools hashed locks
• opip SBOM is CycloneDX 1.5
• opip extract to a wheelhouse or PEP 503 simple index
• opip install with pip or uv backend
• opip json and quiet output for CI
• opip trust uses the shared pip-rns trust store
• opip update reuses unchanged wheels
• opip delta and apply for thin update packs