0.3.7 - 2026-08-27

Release Notes

Added

• Limits::DEFAULT, the defaults as a constant. Default::default is not
  const and the struct is #[non_exhaustive], so without it a caller outside
  this crate cannot say the defaults, with this one changed in a const —
  which is where a caller with a considered bound wants to put it.

Security

• Rewriting a container in place no longer launders it. Destination::in_place
  replaces a file the way an editor does: it writes a fresh file beside the
  original and renames it over the top. A fresh file carries no mark, so
  whatever the platform had recorded about where the original came from —
  com.apple.quarantine, a Zone.Identifier stream, user.xdg.origin.url —
  was gone the moment anything rewrote the container. slipcase repack --meta
  on a container marked as downloaded returned it unmarked, and every payload
  unpacked from it afterwards was unmarked too, because provenance::carry
  copies from the container. True since in_place existed.

  This is the defect 0.3.5 fixed on the unpacking side arriving through a door
  nobody had looked at. commit now carries the mark onto the replacement
  before the rename, so the file that appears at the path is complete at the
  instant it appears. Destination::new is unchanged and inherits nothing: a
  caller naming an output file is creating one, there is no original whose
  origin it takes, and inventing one would be claiming a download that never
  happened. That is the line new already took about permissions.

  slipcase repack -o <new> carries it too, in the CLI rather than the library,
  because only the caller knows which container the bytes came out of. It warns
  rather than failing where it cannot: what the failing rule in unpack guards
  is a payload about to be handed to the operating system, and a container is
  opened by nothing but this tool, which reports provenance rather than acting
  on it.

Changed

• The default metadata bound is 1 MiB, down from the 16 MiB 0.3.6 shipped a
  few hours earlier. That number rested on an estimate — that a parsed
  document costs several times its source — which was wrong by more than an
  order of magnitude. Measured against the densest conformant shape, shortest
  legal keys and shortest legal values: 256 KiB of metadata parses to 22 MB
  resident and 1 MiB to 85 MB, about 85 times, because toml_edit keeps a key's
  decor, span and representation so that a rewrite can put back what it did not
  touch. 16 MiB was therefore about 1.4 GB parsed, and several times that again
  in anything that renders the document.

  The multiplier follows key count rather than size, so the number is chosen
  against the dense shape. 1 MiB costs 85 MB at worst and is generous against
  every legitimate document: the format defines two keys, SPEC §2.2's example is
  four lines, and the largest metadata member in the conformance corpus is
  64 KiB.

• fs implies provenance. Not convenience: without the carry above,
  enabling fs in order to replace containers is enabling a laundering bug, and
  a security property should not depend on a caller having guessed that a second
  feature was involved. It costs one crate on Unix — xattr itself, whose tree
  of rustix, bitflags and linux-raw-sys tempfile already brings in — and
  nothing on Windows, where an alternate data stream is reached through
  std::fs. The other direction is unchanged: provenance does not imply fs.

Install slipcase 0.3.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/excelano/slpc-rust/releases/download/v0.3.7/slipcase-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/excelano/slpc-rust/releases/download/v0.3.7/slipcase-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install excelano/tap/slipcase

Download slipcase 0.3.7

File	Platform	Checksum
slipcase-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
slipcase-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
slipcase-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
slipcase-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
slipcase-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum