ipvault v0.3.0

The ipvault CLI for the CI integrations, built by this repository's release workflow from IP Vault source commit 9a392437042da51f0f1cc33bab8f0c2ce6071397.

Check an archive's checksum with sha256sum -c SHA256SUMS --ignore-missing, and its build provenance with gh attestation verify <archive> --repo rev3rse-dev/ipvault-cli (or, with the attached bundle, --bundle ipvault-0.3.0.sigstore.json). Pre-1.0: interfaces may change.

Scanner changes in 0.3.0:

• SDK/public model attribution excluded from IP counts and failures; medium-confidence defaults.
• Firmware, content collection and font-notice inventory; content/font candidates remain informational.
• SARIF 2.1.0 and GitLab SAST security reports with stable identities and explicit error/partial status.
• Aligned/nested MediaPipe task bundles and exact-content reference matching.
• JSON report schema 2.

ipvault v0.2.2

The ipvault CLI for the CI integrations, built by this repository's release workflow from IP Vault source commit e093e1f93a4330d20f7c89edac51afd4efc50f5b.

Check an archive's checksum with sha256sum -c SHA256SUMS --ignore-missing, and its build provenance with gh attestation verify <archive> --repo rev3rse-dev/ipvault-cli (or, with the attached bundle, --bundle ipvault-0.2.2.sigstore.json). Pre-1.0: interfaces may change.

ipvault v0.2.1

The IP Vault CLI, 0.2.1. The same commands as 0.2.0, rebuilt:

• Source paths in panic messages no longer include the build machine's home directory.
• Each archive carries THIRD-PARTY-NOTICES.txt: the open-source crates the binary includes, with their licences.

Use 0.2.1 rather than 0.2.0. Check an archive with sha256sum -c SHA256SUMS --ignore-missing (macOS: shasum -a 256 -c SHA256SUMS --ignore-missing). Before 1.0, commands and formats may change.

ipvault v0.2.0 (withdrawn)

Withdrawn: use 0.2.1, the same commands rebuilt. The 0.2.0 archives were removed because they carried the build machine's home directory in source-path strings.

ipvault v0.1.0

The first release of the IP Vault CLI.

• ipvault release plan | publish | verify | abandon: seal the assets ipvault.toml declares on this machine, register their keys with IP Vault, and check the built package for a missing sealed output or any plaintext input.
• Credentials: the CI job's own OIDC identity on GitHub Actions and GitLab CI, or a CI token in IPVAULT_TOKEN.
• ipvault scan: find models an app package ships in plaintext. No account needed.

Check an archive with sha256sum -c SHA256SUMS --ignore-missing (macOS: shasum -a 256 -c SHA256SUMS --ignore-missing). Before 1.0, commands and formats may change.