Skip to content

publet-cli 0.2.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 03:26
· 129 commits to main since this release
v0.2.1
009fc4c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.2.1 - 2026-10-13

Commit a67aa89d7f93; release record pub:sha2-256:l3lwjvee3svhmkrla5crpndvorz5mioifpxcf77ojemjwz2lhrja.

Added

  • pub sign --rotate --principal=P [--label=L] rotates the workspace's key as Section 10.5 says: a new key object with rotates naming the current key, signed by both keys for the purpose "rotation"; the old secret is kept under .publet/retired/ and author names the new key
  • A key rotated from an object's author continues it: its supersedes is a revision, not a proposal, and heads the authoritative lineage (Graph::rotated_from, Graph::continues_key, ROTATION_PURPOSE)

Internal

  • The published crates' SUPPLY-CHAIN.md is generated by pubkit 0.5.0's pubkit supply-chain, which replaces tools/supply-chain-report.py.
  • TESTING.md is now generated by pubkit doc-coverage (pubkit 0.6.0) instead of tools/doc-coverage.py; only its header line changed

Security checks

  • advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- advisories ok, bans ok, licenses ok, sources ok
  • supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (54 fully audited, 183 exempted)
  • supply-chain reports current: .venv/bin/pubkit supply-chain --check publet-core publet-algorithms (pubkit 0.6.0) -- SUPPLY-CHAIN.md current for publet-core, publet-algorithms
  • RustSec advisory database revision: 57dcc0f2192e025138907a495c1ac9a7e1e3e123 (2026-10-12)
  • audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, zcash

Install:

cargo install --locked --git https://github.com/schryer/publet --tag v0.2.1 publet-cli
Assets 2
Loading