Skip to content

v1.3.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Aug 20:31
· 168 commits to main since this release
v1.3.1
bfb1e58
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

nSelf CLI v1.3.1

Channel: stable

Changelog

[1.3.1] — 2026-08-25

Fixes found by installing the 1.3.0 plugins with the 1.3.0 binary. Upgrade if
you install plugins.

Fixed

  • Plugin signatures were not being verified (SECURITY) — the registry cache
    dropped authorPublicKey, signature and status when it wrote itself to
    disk. The cache is read on every run after the first, so from the second
    install onward the verifier received three empty strings. That is the "no
    signature supplied" path, which refuses only when the publish status is
    stable — and the status had been dropped too, so it returned success. A
    signed, stable plugin installed without its signature being checked, on every
    cache-warm run, with nothing printed.
  • A plugin providing two commands installed only one of them — cliCommands
    never reached the manifest, so the installer fell back to the single
    binaryName. nself install tenant published nself-tenant and not
    nself-billing, after reporting success. The archive had contained both.
  • Twenty further manifest fields were dropped the same way, among them
    author, homepage, entryPoint, arch_support, deprecation and
    graphql. A test now fills every field, round-trips it through the cache and
    the registry parser, and fails naming anything that comes back empty — this is
    the third time this class of omission has reached production, and it is the
    first time a test can see it.
  • nself install sentry installed the wrong thing — sentry is an alias of
    the paid ɳSentry bundle, and bundles resolve first, so the command tried the
    bundle and failed on a missing licence while the free plugin stayed
    unreachable. The plugin is now sentry-cli, matching claw-cli and ai-cli,
    which exist for the same reason. nself sentry and nself sentry-server are
    unchanged and still work once installed.

Commits since previous release

  • Bump to 1.3.1 (#250) (bfb1e58)
  • Stop the registry cache dropping fields, including the signature (#249) (8d4c26e)

Install

brew install nself-org/nself/nself
# or download a tarball below for your platform

Verify (Sigstore keyless)

cosign verify-blob \
  --bundle <tarball>.tar.gz.sig \
  --certificate-identity-regexp '^https://github.com/nself-org/cli/\.github/workflows/release\.yml@refs/tags/v1.3.1$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  <tarball>.tar.gz

Full signing + verification details: release-signing.md

Artifacts

  • Platform tarballs (linux/darwin × amd64/arm64) + Windows zips (amd64/arm64)
  • checksums.txt — SHA-256 of all tarballs
  • sbom.spdx.json + per-tarball SBOMs — SPDX software bill of materials
  • provenance.intoto.jsonl — SLSA v1.0 provenance attestation
  • *.sig — Sigstore cosign signature bundles for every artifact above
Assets 23
Loading