v0.9.0

kache 0.9.0 — supply-chain hardening and read-only remote caching for CI

kache is a content-addressed build cache that plugs in as a RUSTC_WRAPPER (and a C/C++ compiler wrapper). 0.9.0 makes kache safe to drop into more environments: a read-only remote mode for GET-only CI, profiler-friendly debug remapping, and a round of supply-chain hardening.

Why

Two friction points kept kache out of otherwise-ideal setups. Fork/PR CI usually has read-only cache credentials, but kache assumed it could write — so it couldn't consume a shared cache there. And path normalization (what makes a cache shareable across checkouts) rewrote debug-info paths, which then broke profilers trying to resolve source. 0.9.0 fixes both, and hardens the supply chain along the way.

What's new

• Read-only remote consumer mode. KACHE_REMOTE_READONLY=1 (or [cache] remote_readonly) keeps remote reads/restores but suppresses every upload — the daemon upload path, the sync push phase, and manifest/shard saving. Built for GET-only-credential environments like fork/PR CI and shared read-only caches.
• Profiler-resolvable debug remaps. Remapped debug-info paths now resolve back to real source for profilers (rustc + cc), and KACHE_RUSTC_PATH_NORMALIZE lets you opt a build out of rustc path remapping entirely.
• CLI ergonomics. kache clean -y runs non-interactively (with -n as a dry-run alias), and shell completions are generated from clap.

Hardening

This is the first kache release published as a GitHub immutable release — the tag and its assets can't be altered or re-pointed after publication, so what you download is provably what was released. Supply-chain: every GitHub Action is now pinned to a full commit SHA (just pin-actions, via pinact) so a repointed @vN tag can't inject code; cargo-deny now audits advisories/licenses/bans; and RUSTSEC-2026-0204 (crossbeam-epoch, transitive via surrealdb) is patched. Cache-key portability: build-path-portable hashing for GNU static= archives and path-local coverage build keys.

These notes were drafted with LLM assistance and edited by the maintainers (@jleni, @emmanuelm41).

---

What's Changed

• fix(cache-key): build-path-portable hash for GNU static= archives (#471) by @emmanuelm41 in #476
• chore(release): bump kache to v0.9.0-rc.1 by @emmanuelm41 in #483
• feat(rustc): KACHE_RUSTC_PATH_NORMALIZE opt-out for path remapping (#480) by @emmanuelm41 in #484
• fix(cache-key): make coverage build keys path-local (#480 follow-up) by @emmanuelm41 in #486
• docs: unify README badges by @jleni in #488
• docs: drop failing Docs.rs badge from kache README by @jleni in #489
• fix(link): show affected path in Windows no-CoW copy-restore warning (#490) by @emmanuelm41 in #492
• chore(deps): adopt cargo-deny for dependency audit and bump dependencies by @jleni in #487
• feat(cli): add shell completions from clap by @aksheyd in #494
• feat(remote): add read-only remote consumer mode by @Ysh204 in #491
• feat(remap): resolvable debug-info remap targets for profilers (rustc + cc) by @jleni in #495
• chore(release): bump kache to v0.9.0-rc.2 by @emmanuelm41 in #496
• chore(release): kache v0.9.0 (+ RUSTSEC-2026-0204 fix, SHA-pin CI actions) by @emmanuelm41 in #499
• feat(clean): non-interactive kache clean -y + -n dry-run alias by @emmanuelm41 in #500

New Contributors

• @aksheyd made their first contribution in #494
• @Ysh204 made their first contribution in #491

Full Changelog: v0.8.0...v0.9.0