Release 0.2.3 - 2026-08-07 · jarimustonen/ossctl

Release Notes

The engine's Homebrew release leg is now self-sufficient — no local brew toolchain required.
For a configured tap with an existing formula, the dist phase renders Formula/<name>.rb from the
verified sha256 and pushes it directly to the tap (git/API write), instead of shelling to
brew bump-formula-pr (which ran brew audit internally and could abort a cut on an unrelated
audit/lint error, as it did on the 0.2.2 cut). The write verifies the sha against the fetched
archive, guards formula existence/symlinks, and is idempotent (a byte-identical formula is a no-op).
brew bump-formula-pr is retained only for the homebrew-core path. This makes an engine cut's
Homebrew leg deterministic and hands-off.
False-positive homebrew_tap contract warning removed. The normalizer no longer warns
"homebrew_tap is set but no homebrew installer" when the contract declares a homebrew-registry
target — that target IS the tap consumer, so the tap is updated. The warning now fires only when
a tap has neither a homebrew installer nor a homebrew target (the genuinely-orphaned case).

Forward-compat capture on the nested distribution block. The Distribution struct and its
sub-structs now preserve unknown sub-keys in extra_fields (mirroring the top-level Contract), so
an older ossctl reading a newer contract round-trips distribution keys instead of dropping them.
Installer↔platform coherence warning. The normalizer now warns when distribution.installers
targets an OS absent from distribution.platforms (e.g. msi without a Windows triple, homebrew
without a macOS or Linux triple), catching dead installer config; npm/shell/powershell are
OS-agnostic and ungated.

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/jarimustonen/ossctl/releases/download/v0.2.3/ossctl-installer.sh | sh

powershell -ExecutionPolicy Bypass -c "irm https://github.com/jarimustonen/ossctl/releases/download/v0.2.3/ossctl-installer.ps1 | iex"

File	Platform	Checksum
ossctl-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
ossctl-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ossctl-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
ossctl-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo jarimustonen/ossctl

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>