Skip to content

v0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Oct 16:55
· 30 commits to main since this release
v0.4.0
8778442
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Releases you can verify, and exempt commands that still run when the pin file is broken.

Fixed

  • A broken .cloudpin.yml no longer blocks exempt commands such as gh auth status, az login or --help (#62):
    they never act on an account and are what you need to investigate. Every other guarded command is still stopped.

Added

  • A GitHub Release for every tag (#53): the package tarball (the same file npm serves), its SHA-256 checksum and a
    signed build-provenance attestation, with the CHANGELOG section and how to verify a download as notes. See
    SECURITY.md, Verifying a release.

Verify this release

cloudpin-0.4.0.tgz is the exact file npm serves (npm packs reproducibly), built and signed by this repository's
release workflow. To check a download:

gh attestation verify cloudpin-0.4.0.tgz --repo paureis/cloudpin   # signed build provenance
sha256sum -c SHA256SUMS                                      # checksum
npm view cloudpin@0.4.0 dist.integrity                  # npm's sha512 for the same file
Assets 5
Loading