Skip to content

v0.6.0-rc1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Aug 20:13
· 236 commits to dev since this release
v0.6.0-rc1
ad6470c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The Rust oracle is retired and tan is Python end to end — plus a workflow-injection fix and a sweep through the commands that reported success while doing something else.

This is a release candidate. latest still resolves to v0.5.1, so nothing upgrades onto it — install it deliberately.

Highlights

  • The Rust oracle is gone. crates/tan-core, crates/tan-cli, Cargo.toml and Cargo.lock are deleted; python/tan/ is the implementation, not a port.
  • Workflow-injection fix in parity.yml — an attacker-controlled repository_dispatch payload reached four run: blocks.
  • Every uses: in .github/workflows/ is pinned to a full commit SHA, with persist-credentials: false on 31 of 32 checkouts.
  • Five commands and the Flow D planner stopped reporting success for something they did not do — flash, doctor, quality, init and monitor, plus a declared-null jlink_flash_device no longer downgrading Flow D to the SE-UART path.
  • tan doctor gained scope (host or project) on every check, plus a libraries row for the project's curated-library selection.
  • tan explain --code <ALP-Bxxx|ALP_ERR_*> — diagnostic-code lookup, ported from alp-sdk.
  • ALP_FLASH_REQUIRE_DPIDR=1 makes an unarmed write refuse instead of warn, on every flash method that has a wrong-board guard.
  • A planner re-sync proposer — python/scripts/planner_resync.py opens the port PR when alp-sdk's scripts/alp_orchestrate/ moves.

Removed

  • The Rust oracle — see above. Existing v0.5.x assets are unaffected; this changes the repo, not the CLI's behaviour.

Fixed

  • tan flash refuses a run that wrote nothing instead of reporting ok: true and exit 0, and the confirm gate finally has a reachable --confirm flag (#719).
  • tan doctor refuses a --sdk-root that is not an alp-sdk checkout rather than reporting [pass] sdk for a path tan build correctly rejects (#727).
  • tan quality exits non-zero on a [FAIL]ing check, and refuses a profile that selected no checks at all (#721).
  • tan monitor accepts every port pyserial can open — /dev/serial/by-id/... symlinks and socket:// / rfc2217:// URLs, not just what comports() enumerates (#569).
  • tan doctor's sevenZip check runs on every Windows host, not only while zephyrSdk is already failing (#736).
  • A declared-null jlink_flash_device reaches flash_args as a present key instead of silently downgrading Flow D to the SE-UART path (#734).
  • tan init no longer emits cores that do not exist on the requested SKU, nor copies build output into a new project (#494).
  • The installers' header comments no longer claim latest resolves to v0.4.1 — it resolves to the newest non-prerelease, v0.5.1 today (#749).

Install

Four binaries, one per host, plus checksums.txt and envelope-contract.json. There is no -musl asset — install.sh probes for musl and refuses before downloading rather than failing at exec time.

Host Asset
Windows x86_64 tan-x86_64-pc-windows-msvc.zip
macOS Intel tan-x86_64-apple-darwin.tar.gz
macOS Apple silicon tan-aarch64-apple-darwin.tar.gz
Linux x86_64 tan-x86_64-unknown-linux-gnu.tar.gz

The Linux binary is built inside python:3.12-slim-bullseye (Debian 11). Its measured glibc floor is GLIBC_2.30, scanned over the 63 native files in the frozen payload — not read off the PyInstaller bootloader, which reports a container-invariant GLIBC_2.14 under any build image. It is a glibc binary and will not run on Alpine or another musl distro.

Verify what you downloaded:

gh attestation verify <downloaded-file> --repo alplabai/tan-cli

Because this is a prerelease, install.sh and install.ps1 resolve latest through GitHub and will keep installing v0.5.1 — download this one by hand.

Full detail: CHANGELOG.md · full diff

Assets 8
Loading