v4.3.0

6 commits, 1 contributor, 21 hours since v4.2.3.

Features

• vulnerabilities: name and link every suppressed ID (168872f)
• security: link and sort acknowledged vulnerabilities (5d300ff)

Bug fixes

• deps: bump kiota.ch/projectfile/core/v2 to v2.20.4 (ec04cbc)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/bridge:v4.3.0

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/bridge/v4/cmd/pf-bridge@v4.3.0

Then run pf-bridge --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-bridge https://github.com/projectfile-org/bridge/releases/download/v4.3.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-bridge
~/.local/bin/pf-bridge --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-bridge.

Usage

pf-bridge

$ pf-bridge --help
pf-bridge — keep every project file in sync with your projectfile document

A projectfile (projectfile.yaml) is the single source of truth for a project:
identity, people, links, and tool config. pf-bridge copies that data out
into the files each tool already reads — README.md, package.json,
CITATION.cff, forge settings — and reads two-way files back.
Spec: https://projectfile.org/specification/

Usage:
  pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
  pf-bridge all [flags]       update every file from the projectfile [rw]
  pf-bridge check [flags]     verify declared files match, write nothing [ro]
  pf-bridge to all            write projectfile out to every file [rw]
  pf-bridge from all          read every two-way file back in [rw]
  pf-bridge --list            list installed bridges
  pf-bridge completion SHELL  print completion script (bash|zsh|fish)

[rw] updates files, [ro] only reads or compares. `check` without names
covers the bridges this project declares; `check <name>…` narrows it,
`check --all` covers every installed bridge instead.

Shared flags (also accepted after a bridge name):
  --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
  --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
  Drift warns by default; --fail-on-drift makes it fatal.

Tools:
  cache                Manage the local SPDX and include cache
  forge                Push projectfile metadata out to the repository forge
  init                 Scaffold a new projectfile document (prefer pf-cli init)
  release-notes        Render release notes from git
  scan                 Run scanners to refresh projectfile metadata from filesystem signals
Package manifests:
  composer   [rw]  composer.json — two-way sync
  npm        [rw]  package.json — two-way sync
  pyproject  [rw]  pyproject.toml — two-way sync
  shard      [rw]  shard.yml — two-way sync
Citation and ownership:
  cff          [rw]  CITATION.cff — two-way sync
  codeowners   [rw]  CODEOWNERS — two-way sync
  funding      [ro]  FUNDING.yml — one-way render
  fundingjson  [ro]  funding.json — one-way render
Documentation:
  ai-policy     [ro]  AI_POLICY.md — one-way render
  coc           [ro]  CODE_OF_CONDUCT.md — one-way render
  contributing  [ro]  CONTRIBUTING.md — one-way render
  dei           [ro]  DEI.md — one-way render
  fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
  readme        [ro]  README.md — one-way render
  security      [ro]  SECURITY.md — one-way render
  support       [ro]  SUPPORT.md — one-way render
Repository setup:
  browserslist     [ro]  .browserslistrc — one-way render
  gitattributes    [ro]  .gitattributes — one-way render
  ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
  license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
  releaserc        [ro]  .releaserc.yaml — one-way render
  vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
  yamllint         [ro]  .yamllint — one-way render

Help per bridge: pf-bridge <bridge> --help

Examples and every command’s help are in Usage.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/bridge:v4.3.0
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/bridge:v4.3.0

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-bridge.asc https://github.com/projectfile-org/bridge/releases/download/v4.3.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-bridge.asc ~/.local/bin/pf-bridge

# every downloaded asset at once
gpg --verify pf-bridge-SHA256SUMS.asc pf-bridge-SHA256SUMS
sha256sum --check --ignore-missing pf-bridge-SHA256SUMS

Full changes: 3.7.0...v4.3.0