v0.1.0

The reference implementation of the Ledvar protocol — a small
Rust library and a CLI that represent the state of a system as a canonical, content-addressed tree,
so two snapshots can be compared and the drift between them named exactly.

Three crates, versioned in lock-step:

• ledvar-core — the data model, the canonical form, content-addressed hashing, well-formedness.
  Depends on serde and sha2, nothing else.
• ledvar-diff — the optional companion: comparing two snapshots into a StateStatus.
• ledvar — the CLI: validate, hash, diff, canon, schema.

Protocol MAJOR 0 (draft). JSON is the canonical format; YAML is opt-in behind a feature flag, so
the default build carries no unsafe and no C.

Full notes: CHANGELOG.md

Downloads

Static, dependency-free binaries. Pick your platform:

Platform	File
Linux x86_64	ledvar-v0.1.0-x86_64-unknown-linux-musl.tar.gz
Linux aarch64	ledvar-v0.1.0-aarch64-unknown-linux-musl.tar.gz
macOS Apple Silicon	ledvar-v0.1.0-aarch64-apple-darwin.tar.gz
macOS Intel	ledvar-v0.1.0-x86_64-apple-darwin.tar.gz
Windows x86_64	ledvar-v0.1.0-x86_64-pc-windows-msvc.zip

Or from source: cargo install ledvar

Every binary is built on a native runner of its own architecture and runs the protocol's conformance
vectors there before release: the golden hashes must match, and every malformed vector must be
refused. A platform-specific bug cannot reach you unnoticed.

Verifying what you downloaded

Each artifact ships with a .sha256 and a .asc. They are not the same thing:

File	Proves
.sha256	integrity — the download did not corrupt in transit
.asc	authenticity — the file is genuinely ours and nobody swapped it

A checksum alone protects against nothing hostile: whoever can replace a binary can replace the
checksum sitting next to it. The signature cannot be forged without the private key — which never
touches CI. Releases are signed locally, and once published they are immutable: the binaries here
can never be replaced.

# import the key — once
gpg --import ledvar-public-key.asc     # https://ledvar.org/ledvar-public-key.asc

# confirm it is the RIGHT key
gpg --fingerprint 911CCB7A80D349FB
#   750F 73CA 0EC5 9FB3 D945  CA12 911C CB7A 80D3 49FB

# verify
gpg --verify ledvar-v0.1.0-x86_64-unknown-linux-musl.tar.gz.asc \
             ledvar-v0.1.0-x86_64-unknown-linux-musl.tar.gz

The fingerprint is published both in the protocol repository and
on ledvar.org — checking one against the other is what makes the signature mean
something.

---

Docs: ledvar.org · Protocol: ledvar/ledvar · Apache-2.0