ReproCrate v0.8.0 (CLI and Desktop distribution and integrity pre-release)

ReproCrate v0.8.0 — distribution and integrity (developer pre-release)

Candidate until the gated release workflow completes and GitHub Releases confirms publication. This is not a stable v1.0.0 release and does not provide signed installers.

What's new

• Offline SHA-256 verification in the Rust core and CLI using reprocrate verify-download ARCHIVE --checksum ARCHIVE.sha256. The verifier streams archives instead of loading them entirely, refuses symlinks/nonregular files, enforces exact filenames, accepts only a single strict checksum record and fails on corruption.
• Static documentation website in site/ with responsive design, keyboard skip link, no runtime JavaScript, restrictive CSP and no third-party CDN or hosted font requirements.
• GitHub Pages delivery workflow, isolated from CLI/desktop features. Deployment requires Pages to be enabled for the repository; a workflow file alone is not proof of live site availability.
• Dependency inventory generator using only the Python standard library to enumerate locked Cargo and npm packages without declaring unknown licenses. Includes deterministic tests and machine-readable CI artifact.
• Weekly/manual advisory workflows to check both Rust lockfiles against RustSec and the npm desktop lockfile against npm advisories. Failing scans require review; no vulnerability-free or license-compliance claims.
• Cross-platform distribution reference and verified download procedures with real-world limitations about unsigned preview binaries, code signing and OS dependencies.
• Preserves local-only CLI and desktop behavior, previous report schema and existing v0.7.0 commands.

Security limits

Checksum equality is integrity only: sidecars are not signed, and matching bytes do not prove trusted origin. A dependency inventory is not a verified SBOM, vulnerability scan or license clearance. Scans can miss future or unpublished issues. Web documentation being published does not cause the desktop/CLI to send telemetry or diagnostic data online.

Release gate

Publish genuine unsigned CLI/desktop artifacts for Linux x86-64, Windows x86-64 and macOS ARM64 only if all three-OS build-upload jobs, validation and the final publication checks pass, and every archive has its own SHA-256 file. Confirm the non-draft, pre-release status and all 12 real assets via GitHub Releases API before advertising publication.

See the download verifier, distribution guide, dependency audits, security policy and handoff.