Skip to content

pgextwin CLI v0.3.2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Oct 23:35
· 29 commits to main since this release
cli-v0.3.2
a537f14
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

pgextwin CLI v0.3.2 — verbose diagnostics for reliable Windows downloads

English

Changes in v0.3.2

  • Add opt-in --verbose to the read-only CLI commands. Diagnostics with UTC timestamps go to stderr, leaving normal stdout, including JSON output, unchanged.
  • Observe verification of the Sigstore-signed Catalog selection feed, all immutable Catalog JSON records, and the historical fixed SHA256-pinned Catalog.
  • Trace each extension ZIP from download start through transfer progress (8 MiB intervals for the browser transport), byte count, independent SHA256 recheck, and atomic batch completion.
  • Reject duplicate --verbose or invalid options without bypassing the fail-closed security policy.
  • Preserve v0.3.1's trimmed and compressed, self-contained Windows x64 single-file distribution and latest-by-default / --fixed behavior.

Usage

.\pgextwin.exe download-all --pg all --verbose
.\pgextwin.exe download-all --pg 18 --fixed --verbose
.\pgextwin.exe download-all --pg all --verbose 2> download-verbose.log

Download Windows x64 EXE · Checksums · Detailed usage

Security and provenance

The EXE and signed Catalog feed have their own verified provenance. Original extension ZIPs are checked for byte integrity only, not individually Sigstore-authenticated: INTEGRITY_ONLY remains unchanged. This GitHub CLI prerelease is not an Authenticode-signed installer and does not grant install/publish authority for extensions. Issue #75 GO B/G4/G5 remain gated.

日本語

v0.3.2 の変更点

  • 読み取り専用CLIに --verbose を追加。UTCの時刻付きログを標準エラー出力へ出し、通常の標準出力やJSON結果は変更しません。
  • Sigstore署名付きCatalogの検証、不変CatalogレコードのSHA256照合、過去の固定Catalog取得を順番に表示します。
  • 各ZIPの取得開始、転送量（8 MiB単位）、取得バイト数、SHA256の再照合、一括配置の確定まで追跡できます。
  • --verbose の二重指定と不正な引数は拒否し、既存の安全な失敗処理を維持します。
  • v0.3.1の.NET完全トリミング＋圧縮による軽量なWindows x64単体EXE、最新版の標準取得と --fixed を維持します。

実行例

.\pgextwin.exe download-all --pg all --verbose
.\pgextwin.exe download-all --pg 18 --fixed --verbose
.\pgextwin.exe download-all --pg all --verbose 2> download-verbose.log

Windows x64 EXEを取得 · SHA256一覧 · 詳しい使い方

安全性・検証証跡

EXEとCatalogフィードのSigstore検証と、拡張機能ZIPのSHA256バイト整合性は別です。各ZIPの状態は引き続き INTEGRITY_ONLY であり、CLI自体はWindows Authenticode署名付きインストーラーではありません。拡張機能の正式配布・インストール許可、Issue #75 GO B/G4/G5の未成立ゲートは変更しません。

Assets 7
Loading