start-registry v1.1.0

What's Changed

• A registry can declare a description. info set-description stores markdown (a
  LocaleString, so it can carry translations), info returns it, and the marketplace shows it
  above the registry's services while that registry is selected.

• A client can follow the registry index over a websocket instead of re-fetching it.
  db.subscribe returns /index as it stands plus a continuation id; connecting to
  /ws/rpc/<id> then streams its JSON patches. Callers can select /index or any subpath,
  including the package or OS index, while the endpoint remains unauthenticated.

• An indexed package version now advertises which installed versions can migrate into it, so a
  client asking for an upgrade path is offered a version it can actually install. Entries already
  in an index keep their permissive value until that version is published again.

• Package metadata exposes hardware virtualization support. Packages can declare access to
  /dev/kvm with hardwareVirtualization; manifests that omit the field remain compatible.

• os asset remove can be run. Its iso/img/squashfs handlers were registered as
  RPC-only with no CLI counterpart, so remove parsed as a leaf that accepts no arguments — it
  listed with a blank description and rejected os asset remove iso 0.4.0 x86_64 as an
  unexpected argument. The three subcommands now take <VERSION> <PLATFORM>, mirroring
  os asset get. Dropping a version's index entry for a single platform no longer requires
  removing the whole version and re-adding every other platform. Asking to remove a platform the
  version has no asset for now says so instead of reporting success.

• start-registry works on a registry host that listens on a non-loopback address. With no
  --registry, the CLI derives the registry's address from registry-listen and authenticates
  with the local authcookie — but it only sent that token when the derived URL was literally
  loopback. A registry reachable from anywhere but the host itself listens on 0.0.0.0:5959, so
  every local command went out unauthenticated and came back Unauthorized. A wildcard listen
  address is now dialled over loopback, and an address derived from the registry's own listen
  configuration counts as naming this machine. An explicit --registry URL is unchanged: the
  token still goes only to a loopback URL.

start-registry packages Checksums

SHA-256

9954b75b38fa028fef088be20b6527fdc98a19e1a887d96133159e6cc37f31fb  start-registry_1.1.0_amd64.deb
7c2cdbe30aa604d5a895cccc783c3793198858cb8fa857562e9dd9821530cf78  start-registry_1.1.0_arm64.deb
139c607f312f4b2cb88092daff6a8878526edf606ce8b4f7cdef15975ae9a1c8  start-registry_1.1.0_riscv64.deb

BLAKE-3

e20950b7428be7f469393b849a755cefaada32d3effc4090b1b1601c07038020  start-registry_1.1.0_amd64.deb
28f846e60514decd55f6f2e8afa396fea53ea51a35085437bcb40a36ff6dd5e5  start-registry_1.1.0_arm64.deb
2279e9a35affb1b99b3848553f5c6566f7bc955d2da773d4d2a7dd113d06f0b5  start-registry_1.1.0_riscv64.deb