Release 0.2.2 - 2026-08-06 · jarimustonen/ossctl

Release Notes

crates.io RegistryQuery for ecosystem rust — the release engine's publish/reconcile
path can now determine a crate@version's already-published state by querying the crates.io
sparse index (index.crates.io, via curl with a bounded --max-time; no new HTTP
dependency). Previously only node (npm) was wired, so a rust cut's publish phase failed
closed with "no registry query wired for ecosystem 'rust' yet" — the last blocker
before the engine could cut ossctl itself. The query is defensively fail-closed: a genuine
registry-unreachable (network error, unexpected HTTP status, malformed index line) returns an
error rather than a false "not published"; a 404/410 is the legitimate "not yet published"
signal (empty result); yanked versions count as published (their version slot is occupied).
This completes the engine's registry-aware defer/idempotency predicate for crates.io — the
cut of ossctl itself now runs end-to-end through its own engine (dogfood).

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/jarimustonen/ossctl/releases/download/v0.2.2/ossctl-installer.sh | sh

powershell -ExecutionPolicy Bypass -c "irm https://github.com/jarimustonen/ossctl/releases/download/v0.2.2/ossctl-installer.ps1 | iex"

File	Platform	Checksum
ossctl-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
ossctl-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ossctl-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
ossctl-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo jarimustonen/ossctl

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>