mkit 0.1.0

mkit 0.1.0

Content-addressed VCS for creative work.

Verifying downloads

Every archive is signed with cosign keyless via GitHub OIDC; the
signing certificate embeds the workflow identity and a Rekor
transparency log entry is public. See docs/release/SIGNING.md
in the repo for full verification steps.

cosign verify-blob \
  --certificate-identity-regexp "https://github.com/officialunofficial/mkit/.github/workflows/release.yml@refs/tags/v.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle <archive>.cosign.bundle \
  <archive>

SBOM

A CycloneDX SBOM (sbom.cdx.json) is attached. Reflects the
Rust crate graph (blake3, reqwest/rustls, ed25519-dalek, etc.)
plus toolchain and OS libraries.

What's Changed

• ci: install Zig via direct download (fixes failing CI) by @christopherwxyz in #1
• ci(actions)(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3 in the actions-minor group by @dependabot[bot] in #2
• ci(actions)(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #3
• ci(actions)(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #4
• ci(actions)(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #5
• ci(actions)(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #6
• Upgrade to Zig 0.16.0 by @christopherwxyz in #8
• chore: strip remaining zmit residue from src, tests, docs, CHANGELOG by @christopherwxyz in #7
• fix(blame): integer-overflow panic in formatAuthorShort by @christopherwxyz in #9
• fix(e2e): wire the three e2e scripts up to the current mkit CLI by @christopherwxyz in #14
• test(e2e): wire-level e2e harness for mkit+ssh:// transport by @christopherwxyz in #15
• release: v0.2.0 by @christopherwxyz in #16
• ci: add -Djemalloc smoke on ubuntu-latest by @christopherwxyz in #17
• ci: run tests/e2e-ssh.sh on every PR by @christopherwxyz in #18
• chore: drop 0.1.0-specific language from distribution metadata by @christopherwxyz in #19
• fix(ssh): derive wire CLIENT_VERSION/SERVER_VERSION from cli.cli_version by @christopherwxyz in #20
• fix(file-transport): actually fsync the containing dir after rename by @christopherwxyz in #21
• release: v0.2.1 by @christopherwxyz in #22
• ci(release): add workflow_dispatch trigger as escape hatch by @christopherwxyz in #23
• security: input validation + resource limits across parsers, transports, and on-disk code by @christopherwxyz in #24
• feat(attestations): native in-toto v1 + DSSE attestation subsystem; remove Notary trait by @christopherwxyz in #26
• rewrite(rust): CI — rust.yml + rust-security.yml (Phase 10 prep) by @christopherwxyz in #28
• rewrite(rust): Phase 0.5+1 — hash, object, serialize + golden vectors by @christopherwxyz in #29
• rewrite(rust): Phase 2 store + review follow-ups (serialize fallible, more goldens, spec §13) by @christopherwxyz in #30
• rewrite(rust): Phase 6 sign — Ed25519 + DSSE-prefixed signing (mkit.commit, mkit.remix) by @christopherwxyz in #31
• rewrite(rust): Phase 8 — mkit-attest (JCS + in-toto v1 + DSSE + signers) by @christopherwxyz in #32
• rewrite(rust): Phase 3 — fastcdc (chunker) + delta + pack + fuzz harnesses by @christopherwxyz in #33
• rewrite(rust): Phase 4 — refs + index + worktree + ignore + repo_lock by @christopherwxyz in #34
• rewrite(rust): Phase 5a — diff, graph, merge, cherry_pick by @christopherwxyz in #35
• rewrite(rust): Phase 5b — rebase, bisect, blame, stash, restore by @christopherwxyz in #36
• rewrite(rust): Phase 7a — protocol trait (7 verbs + SSH framing + backoff) by @christopherwxyz in #37
• rewrite(rust): Phase 7b — memory + file Transport impls by @christopherwxyz in #39
• rewrite(rust): Phase 7c — HTTP/HTTPS Transport impl (reqwest/rustls) by @christopherwxyz in #38
• rewrite(rust): Phase 7d — S3 / R2 Transport (SigV4 + rustls) by @christopherwxyz in #41
• rewrite(rust): Phase 7e — SSH Transport (framed, OP_HELLO first) by @christopherwxyz in #40
• rewrite(rust): Phase 9 — mkit-cli binary + snapshot tests by @christopherwxyz in #42
• ci(rust): port reproducible-build.yml to Rust; audit supply-chain.yml by @christopherwxyz in #43
• docs(rust): Zig archival plan + dry-run script (soak-window follow-up) by @christopherwxyz in #44
• attest(rust): derive golden keyid from pubkey + SPEC-ATTESTATIONS §3 prose fix by @christopherwxyz in #45
• rewrite(rust): ops::diff::status_diff + CLI wire-up by @christopherwxyz in #46
• rewrite(rust): CLI completeness — worktree checkout, push/pull packs, $EDITOR, author identity by @christopherwxyz in #47
• rewrite(rust): wire 9 stubbed CLI subcommands by @christopherwxyz in #48
• rewrite: Rust port (Phases 0–10 cutover prep) by @christopherwxyz in #27
• ops(rust): stash show diff renderer + bisect skip exclusion set by @christopherwxyz in #57
• cli(rust): wire HTTP/S3/SSH transports into remote_dispatch by @christopherwxyz in #55
• ssh(rust): promote per-verb decoders to pub; dedupe CLI serve.rs copies by @christopherwxyz in #56
• ci(actions)(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #49
• ci(actions)(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #51
• deps(rust)(deps): bump md-5 from 0.10.6 to 0.11.0 in /rust by @dependabot[bot] in #50
• deps(rust)(deps): bump getrandom from 0.3.4 to 0.4.2 in /rust by @dependabot[bot] in #54
• deps(rust): bump sha2 0.11 + hmac 0.13 (paired) by @christopherwxyz in #58
• sign(rust): verify with strict ZIP-215 rules + regression guard by @christopherwxyz in #59
• cleanup: reset to v0.1.0 — fresh CHANGELOG + scrub prior-impl references by @christopherwxyz in #60
• docs: replace CHANGELOG with fresh v0.1.0 entry by @christopherwxyz in #61

New Contributors

• @christopherwxyz made their first contribution in #1
• @dependabot[bot] made their first contribution in #2

Full Changelog: https://github.com/officialunofficial/mkit/commits/v0.1.0