Release 0.2.1 - 2026-08-06 · jarimustonen/ossctl

Release Notes

Multi-crate cuts with =-pinned internal deps now cut through the engine. For a workspace
whose dependent crate pins its workspace dep by exact version (ossctl → ossctl-core = "=X.Y.Z"),
ossctl release cut no longer fails in the build phase trying to package the dependent before its
dep exists on the crates.io index. The cargo adapter now defers packaging a dependent whose
=-pinned dep is not yet published into that target's dep-ordered cargo publish — so the dep
is published and index-visible first, then the dependent packages and publishes against it. The
decision is registry-aware and fail-closed (deferral applies only to a not-yet-published internal
dep). The outer phase barrier, coordinator-only tagging, and post-tag Homebrew phase are preserved
(ADR-0002 amendment; ADR-0004 one-target-one-publish-unit intact). This is the fix that lets ossctl
cut itself through its own engine.

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/jarimustonen/ossctl/releases/download/v0.2.1/ossctl-installer.sh | sh

powershell -ExecutionPolicy Bypass -c "irm https://github.com/jarimustonen/ossctl/releases/download/v0.2.1/ossctl-installer.ps1 | iex"

File	Platform	Checksum
ossctl-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
ossctl-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ossctl-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
ossctl-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo jarimustonen/ossctl

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>