Repository navigation
Releases: smormah/vsift
Release list
VSift 0.2.2-rc.1
VSift 0.2.2-rc.1 is a release candidate. It is under qualification, it is not announced, and it is no statement of support or stability: a later candidate, or the release that follows it, may replace it. It is published to npm under the dist-tag next; latest is not touched. Built by the Release workflow from commit 43a033d (tag v0.2.2-rc.1).
Install
The npm package is vsift-cli; the command it installs is vsift. It needs Node.js 22 or later, or Bun 1.2 or later.
npm install --global vsift-cli@next
pnpm add --global vsift-cli@next
bun add --global vsift-cli@nextYarn 4 holds back a version for a day after it is published (npmMinimalAgeGate). Wait a day, or list vsift-cli and @vsift/* under npmPreapprovedPackages in the project's .yarnrc.yml.
The executables are built for the three R0 targets: Windows 11 x64, macOS 15 on Apple silicon, and Linux x64 with glibc 2.35 or later and OpenSSL 3.
Native archives
Each vsift-0.2.2-rc.1-<target>.tar.gz holds the vsift executable, the licences, THIRD-PARTY-NOTICES, a CycloneDX SBOM and the agent skill; each target's SBOM and notices are also attached on their own. Check a download against SHA256SUMS (sha256sum --check --ignore-missing SHA256SUMS, or shasum -a 256 --check --ignore-missing SHA256SUMS on macOS). The executables are not code-signed or notarized, so Windows SmartScreen and macOS Gatekeeper may warn about one downloaded directly. Files installed through npm do not carry the download mark that triggers those two warnings, but Windows Smart App Control, where it is turned on, can block an unsigned program however it was installed; see the installation guide.
Verify the provenance
Every archive, SHA256SUMS, SBOM, notices file and npm tarball has a Sigstore build-provenance attestation from the Release workflow:
gh attestation verify <file> --repo smormah/vsift \
--signer-workflow smormah/vsift/.github/workflows/release.yml \
--source-ref refs/tags/v0.2.2-rc.1 --deny-self-hosted-runnersThe npm packages also carry npm provenance: npm audit signatures in a project that installed vsift-cli@next checks their registry signatures and provenance attestations.
Installation guide: https://github.com/smormah/vsift/blob/v0.2.2-rc.1/docs/operations/install.md
VSift 0.2.1
VSift 0.2.1 is published to npm under the dist-tag latest, so npm install vsift-cli installs it, and it is the latest GitHub release. Built by the Release workflow from commit e9ab6e6 (tag v0.2.1).
What this release promises
The vsift command-line grammar, its exit codes and its v1 JSON contracts. They change only by addition: new commands, fields and failure codes may appear, and what exists keeps its meaning. Nothing else is promised. The accuracy figures were measured on a synthetic corpus; what was tried, and what was not, is in the installation guide and in the register of known limits (https://github.com/smormah/vsift/blob/v0.2.1/docs/planning/known-limits.md).
Install
The npm package is vsift-cli; the command it installs is vsift. It needs Node.js 22 or later, or Bun 1.2 or later.
npm install --global vsift-cli
pnpm add --global vsift-cli
bun add --global vsift-cliYarn 4 holds back a version for a day after it is published (npmMinimalAgeGate). Wait a day, or list vsift-cli and @vsift/* under npmPreapprovedPackages in the project's .yarnrc.yml.
The executables are built for the three R0 targets: Windows 11 x64, macOS 15 on Apple silicon, and Linux x64 with glibc 2.35 or later and OpenSSL 3.
Native archives
Each vsift-0.2.1-<target>.tar.gz holds the vsift executable, the licences, THIRD-PARTY-NOTICES, a CycloneDX SBOM and the agent skill; each target's SBOM and notices are also attached on their own. Check a download against SHA256SUMS (sha256sum --check --ignore-missing SHA256SUMS, or shasum -a 256 --check --ignore-missing SHA256SUMS on macOS). The executables are not code-signed or notarized, so Windows SmartScreen and macOS Gatekeeper may warn about one downloaded directly. Files installed through npm do not carry the download mark that triggers those two warnings, but Windows Smart App Control, where it is turned on, can block an unsigned program however it was installed; see the installation guide.
Verify the provenance
Every archive, SHA256SUMS, SBOM, notices file and npm tarball has a Sigstore build-provenance attestation from the Release workflow:
gh attestation verify <file> --repo smormah/vsift \
--signer-workflow smormah/vsift/.github/workflows/release.yml \
--source-ref refs/tags/v0.2.1 --deny-self-hosted-runnersThe npm packages also carry npm provenance: npm audit signatures in a project that installed vsift-cli checks their registry signatures and provenance attestations.
Installation guide: https://github.com/smormah/vsift/blob/v0.2.1/docs/operations/install.md
VSift 0.2.1-rc.3
VSift 0.2.1-rc.3 is a release candidate. It is under qualification, it is not announced, and it is no statement of support or stability: a later candidate, or the release that follows it, may replace it. It is published to npm under the dist-tag next; latest is not touched. Built by the Release workflow from commit fa38002 (tag v0.2.1-rc.3).
Install
The npm package is vsift-cli; the command it installs is vsift. It needs Node.js 22 or later, or Bun 1.2 or later.
npm install --global vsift-cli@next
pnpm add --global vsift-cli@next
bun add --global vsift-cli@nextYarn 4 holds back a version for a day after it is published (npmMinimalAgeGate). Wait a day, or list vsift-cli and @vsift/* under npmPreapprovedPackages in the project's .yarnrc.yml.
The executables are built for the three R0 targets: Windows 11 x64, macOS 15 on Apple silicon, and Linux x64 with glibc 2.35 or later and OpenSSL 3.
Native archives
Each vsift-0.2.1-rc.3-<target>.tar.gz holds the vsift executable, the licences, THIRD-PARTY-NOTICES, a CycloneDX SBOM and the agent skill; each target's SBOM and notices are also attached on their own. Check a download against SHA256SUMS (sha256sum --check --ignore-missing SHA256SUMS, or shasum -a 256 --check --ignore-missing SHA256SUMS on macOS). The executables are not code-signed or notarized, so Windows SmartScreen and macOS Gatekeeper may warn about one downloaded directly. Files installed through npm do not carry the download mark that triggers those two warnings, but Windows Smart App Control, where it is turned on, can block an unsigned program however it was installed; see the installation guide.
Verify the provenance
Every archive, SHA256SUMS, SBOM, notices file and npm tarball has a Sigstore build-provenance attestation from the Release workflow:
gh attestation verify <file> --repo smormah/vsift \
--signer-workflow smormah/vsift/.github/workflows/release.yml \
--source-ref refs/tags/v0.2.1-rc.3 --deny-self-hosted-runnersThe npm packages also carry npm provenance: npm audit signatures in a project that installed vsift-cli@next checks their registry signatures and provenance attestations.
Installation guide: https://github.com/smormah/vsift/blob/v0.2.1-rc.3/docs/operations/install.md
VSift 0.2.1-rc.2
VSift 0.2.1-rc.2 is a release candidate. It is under qualification, it is not announced, and it is no statement of support or stability: a later candidate, or the release that follows it, may replace it. It is published to npm under the dist-tag next; latest is not touched. Built by the Release workflow from commit 23ad492 (tag v0.2.1-rc.2).
Install
The npm package is vsift-cli; the command it installs is vsift. It needs Node.js 22 or later, or Bun 1.2 or later.
npm install --global vsift-cli@next
pnpm add --global vsift-cli@next
bun add --global vsift-cli@nextYarn 4 holds back a version for a day after it is published (npmMinimalAgeGate). Wait a day, or list vsift-cli and @vsift/* under npmPreapprovedPackages in the project's .yarnrc.yml.
The executables are built for the three R0 targets: Windows 11 x64, macOS 15 on Apple silicon, and Linux x64 with glibc 2.35 or later and OpenSSL 3.
Native archives
Each vsift-0.2.1-rc.2-<target>.tar.gz holds the vsift executable, the licences, THIRD-PARTY-NOTICES, a CycloneDX SBOM and the agent skill; each target's SBOM and notices are also attached on their own. Check a download against SHA256SUMS (sha256sum --check --ignore-missing SHA256SUMS, or shasum -a 256 --check --ignore-missing SHA256SUMS on macOS). The executables are not code-signed or notarized, so Windows SmartScreen and macOS Gatekeeper may warn about one downloaded directly. Files installed through npm do not carry the download mark that triggers those two warnings, but Windows Smart App Control, where it is turned on, can block an unsigned program however it was installed; see the installation guide.
Verify the provenance
Every archive, SHA256SUMS, SBOM, notices file and npm tarball has a Sigstore build-provenance attestation from the Release workflow:
gh attestation verify <file> --repo smormah/vsift \
--signer-workflow smormah/vsift/.github/workflows/release.yml \
--source-ref refs/tags/v0.2.1-rc.2 --deny-self-hosted-runnersThe npm packages also carry npm provenance: npm audit signatures in a project that installed vsift-cli@next checks their registry signatures and provenance attestations.
Installation guide: https://github.com/smormah/vsift/blob/v0.2.1-rc.2/docs/operations/install.md
VSift 0.2.1-rc.1
VSift 0.2.1-rc.1 is a release candidate. It is under qualification, it is not announced, and it is no statement of support or stability: a later candidate, or the release that follows it, may replace it. It is published to npm under the dist-tag next; latest is not touched. Built by the Release workflow from commit cb8cb3a (tag v0.2.1-rc.1).
Install
The npm package is vsift-cli; the command it installs is vsift. It needs Node.js 22 or later, or Bun 1.2 or later.
npm install --global vsift-cli@next
pnpm add --global vsift-cli@next
bun add --global vsift-cli@nextYarn 4 holds back a version for a day after it is published (npmMinimalAgeGate). Wait a day, or list vsift-cli and @vsift/* under npmPreapprovedPackages in the project's .yarnrc.yml.
The executables are built for the three R0 targets: Windows 11 x64, macOS 15 on Apple silicon, and Linux x64 with glibc 2.35 or later and OpenSSL 3.
Native archives
Each vsift-0.2.1-rc.1-<target>.tar.gz holds the vsift executable, the licences, THIRD-PARTY-NOTICES, a CycloneDX SBOM and the agent skill; each target's SBOM and notices are also attached on their own. Check a download against SHA256SUMS (sha256sum --check --ignore-missing SHA256SUMS, or shasum -a 256 --check --ignore-missing SHA256SUMS on macOS). The executables are not code-signed or notarized, so Windows SmartScreen and macOS Gatekeeper may warn about one downloaded directly. Files installed through npm do not carry the download mark that triggers those two warnings, but Windows Smart App Control, where it is turned on, can block an unsigned program however it was installed; see the installation guide.
Verify the provenance
Every archive, SHA256SUMS, SBOM, notices file and npm tarball has a Sigstore build-provenance attestation from the Release workflow:
gh attestation verify <file> --repo smormah/vsift \
--signer-workflow smormah/vsift/.github/workflows/release.yml \
--source-ref refs/tags/v0.2.1-rc.1 --deny-self-hosted-runnersThe npm packages also carry npm provenance: npm audit signatures in a project that installed vsift-cli@next checks their registry signatures and provenance attestations.
Installation guide: https://github.com/smormah/vsift/blob/v0.2.1-rc.1/docs/operations/install.md
VSift 0.2.0
VSift 0.2.0 is published to npm under the dist-tag latest, so npm install vsift-cli installs it, and it is the latest GitHub release. Built by the Release workflow from commit eeb2a22 (tag v0.2.0).
What this release promises
The vsift command-line grammar, its exit codes and its v1 JSON contracts. They change only by addition: new commands, fields and failure codes may appear, and what exists keeps its meaning. Nothing else is promised. The accuracy figures were measured on a synthetic corpus; what was tried, and what was not, is in the installation guide and in the register of known limits (https://github.com/smormah/vsift/blob/v0.2.0/docs/planning/known-limits.md).
Install
The npm package is vsift-cli; the command it installs is vsift. It needs Node.js 22 or later, or Bun 1.2 or later.
npm install --global vsift-cli
pnpm add --global vsift-cli
bun add --global vsift-cliYarn 4 holds back a version for a day after it is published (npmMinimalAgeGate). Wait a day, or list vsift-cli and @vsift/* under npmPreapprovedPackages in the project's .yarnrc.yml.
The executables are built for the three R0 targets: Windows 11 x64, macOS 15 on Apple silicon, and Linux x64 with glibc 2.35 or later and OpenSSL 3.
Native archives
Each vsift-0.2.0-<target>.tar.gz holds the vsift executable, the licences, THIRD-PARTY-NOTICES, a CycloneDX SBOM and the agent skill; each target's SBOM and notices are also attached on their own. Check a download against SHA256SUMS (sha256sum --check --ignore-missing SHA256SUMS, or shasum -a 256 --check --ignore-missing SHA256SUMS on macOS). The executables are not code-signed or notarized, so Windows SmartScreen and macOS Gatekeeper may warn about one downloaded directly. Files installed through npm do not carry the download mark that triggers those two warnings, but Windows Smart App Control, where it is turned on, can block an unsigned program however it was installed; see the installation guide.
Verify the provenance
Every archive, SHA256SUMS, SBOM, notices file and npm tarball has a Sigstore build-provenance attestation from the Release workflow:
gh attestation verify <file> --repo smormah/vsift \
--signer-workflow smormah/vsift/.github/workflows/release.yml \
--source-ref refs/tags/v0.2.0 --deny-self-hosted-runnersThe npm packages also carry npm provenance: npm audit signatures in a project that installed vsift-cli checks their registry signatures and provenance attestations.
Installation guide: https://github.com/smormah/vsift/blob/v0.2.0/docs/operations/install.md
VSift 0.2.0-rc.3
VSift 0.2.0-rc.3 is a release candidate. It is under qualification, it is not announced, and it is no statement of support or stability: a later candidate, or the release that follows it, may replace it. It is published to npm under the dist-tag next; latest is not touched. Built by the Release workflow from commit 83dca85 (tag v0.2.0-rc.3).
Install
The npm package is vsift-cli; the command it installs is vsift. It needs Node.js 22 or later, or Bun 1.2 or later.
npm install --global vsift-cli@next
pnpm add --global vsift-cli@next
bun add --global vsift-cli@nextYarn 4 holds back a version for a day after it is published (npmMinimalAgeGate). Wait a day, or list vsift-cli and @vsift/* under npmPreapprovedPackages in the project's .yarnrc.yml.
The executables are built for the three R0 targets: Windows 11 x64, macOS 15 on Apple silicon, and Linux x64 with glibc 2.35 or later and OpenSSL 3.
Native archives
Each vsift-0.2.0-rc.3-<target>.tar.gz holds the vsift executable, the licences, THIRD-PARTY-NOTICES, a CycloneDX SBOM and the agent skill; each target's SBOM and notices are also attached on their own. Check a download against SHA256SUMS (sha256sum --check --ignore-missing SHA256SUMS, or shasum -a 256 --check --ignore-missing SHA256SUMS on macOS). The executables are not code-signed or notarized, so Windows SmartScreen and macOS Gatekeeper may warn about one downloaded directly. Files installed through npm do not carry the download mark that triggers those two warnings, but Windows Smart App Control, where it is turned on, can block an unsigned program however it was installed; see the installation guide.
Verify the provenance
Every archive, SHA256SUMS, SBOM, notices file and npm tarball has a Sigstore build-provenance attestation from the Release workflow:
gh attestation verify <file> --repo smormah/vsift \
--signer-workflow smormah/vsift/.github/workflows/release.yml \
--source-ref refs/tags/v0.2.0-rc.3 --deny-self-hosted-runnersThe npm packages also carry npm provenance: npm audit signatures in a project that installed vsift-cli@next checks their registry signatures and provenance attestations.
Installation guide: https://github.com/smormah/vsift/blob/v0.2.0-rc.3/docs/operations/install.md
VSift 0.2.0-rc.2
VSift 0.2.0-rc.2 is a release candidate. It is under qualification, it is not announced, and it is no statement of support or stability: a later candidate, or the release that follows it, may replace it. It is published to npm under the dist-tag next; latest is not touched. Built by the Release workflow from commit 7c722d1 (tag v0.2.0-rc.2).
Install
The npm package is vsift-cli; the command it installs is vsift. It needs Node.js 22 or later, or Bun 1.2 or later.
npm install --global vsift-cli@next
pnpm add --global vsift-cli@next
bun add --global vsift-cli@nextYarn 4 holds back a version for a day after it is published (npmMinimalAgeGate). Wait a day, or list vsift-cli and @vsift/* under npmPreapprovedPackages in the project's .yarnrc.yml.
The executables are built for the three R0 targets: Windows 11 x64, macOS 15 on Apple silicon, and Linux x64 with glibc 2.35 or later and OpenSSL 3.
Native archives
Each vsift-0.2.0-rc.2-<target>.tar.gz holds the vsift executable, the licences, THIRD-PARTY-NOTICES, a CycloneDX SBOM and the agent skill; each target's SBOM and notices are also attached on their own. Check a download against SHA256SUMS (sha256sum --check --ignore-missing SHA256SUMS, or shasum -a 256 --check --ignore-missing SHA256SUMS on macOS). The executables are not code-signed or notarized, so Windows SmartScreen and macOS Gatekeeper may warn about one downloaded directly. Files installed through npm do not carry the download mark that triggers those two warnings, but Windows Smart App Control, where it is turned on, can block an unsigned program however it was installed; see the installation guide.
Verify the provenance
Every archive, SHA256SUMS, SBOM, notices file and npm tarball has a Sigstore build-provenance attestation from the Release workflow:
gh attestation verify <file> --repo smormah/vsift \
--signer-workflow smormah/vsift/.github/workflows/release.yml \
--source-ref refs/tags/v0.2.0-rc.2 --deny-self-hosted-runnersThe npm packages also carry npm provenance: npm audit signatures in a project that installed vsift-cli@next checks their registry signatures and provenance attestations.
Installation guide: https://github.com/smormah/vsift/blob/v0.2.0-rc.2/docs/operations/install.md
VSift 0.2.0-rc.1
VSift 0.2.0-rc.1 is a release candidate. It is under qualification, it is not announced, and it is no statement of support or stability: a later candidate, or the release that follows it, may replace it. It is published to npm under the dist-tag next; latest is not touched. Built by the Release workflow from commit d5792ce (tag v0.2.0-rc.1).
Install
The npm package is vsift-cli; the command it installs is vsift. It needs Node.js 22 or later, or Bun 1.2 or later.
npm install --global vsift-cli@next
pnpm add --global vsift-cli@next
bun add --global vsift-cli@nextYarn 4 holds back a version for a day after it is published (npmMinimalAgeGate). Wait a day, or list vsift-cli and @vsift/* under npmPreapprovedPackages in the project's .yarnrc.yml.
The executables are built for the three R0 targets: Windows 11 x64, macOS 15 on Apple silicon, and Linux x64 with glibc 2.35 or later and OpenSSL 3.
Native archives
Each vsift-0.2.0-rc.1-<target>.tar.gz holds the vsift executable, the licences, THIRD-PARTY-NOTICES, a CycloneDX SBOM and the agent skill; each target's SBOM and notices are also attached on their own. Check a download against SHA256SUMS (sha256sum --check --ignore-missing SHA256SUMS, or shasum -a 256 --check --ignore-missing SHA256SUMS on macOS). The executables are not code-signed or notarized, so Windows SmartScreen and macOS Gatekeeper may warn about one downloaded directly. Files installed through npm do not carry the download mark that triggers those two warnings, but Windows Smart App Control, where it is turned on, can block an unsigned program however it was installed; see the installation guide.
Verify the provenance
Every archive, SHA256SUMS, SBOM, notices file and npm tarball has a Sigstore build-provenance attestation from the Release workflow:
gh attestation verify <file> --repo smormah/vsift \
--signer-workflow smormah/vsift/.github/workflows/release.yml \
--source-ref refs/tags/v0.2.0-rc.1 --deny-self-hosted-runnersThe npm packages also carry npm provenance: npm audit signatures in a project that installed vsift-cli@next checks their registry signatures and provenance attestations.
Installation guide: https://github.com/smormah/vsift/blob/v0.2.0-rc.1/docs/operations/install.md
VSift 0.1.0
VSift 0.1.0 is a pre-release. It is published to npm under the dist-tag next; latest stays the vsift-cli@0.0.0 placeholder until a stable release. Built by the Release workflow from commit 011bc4d (tag v0.1.0).
Install
The npm package is vsift-cli; the command it installs is vsift. It needs Node.js 22 or later, or Bun 1.2 or later.
npm install --global vsift-cli@next
pnpm add --global vsift-cli@next
bun add --global vsift-cli@nextYarn 4 holds back a version for a day after it is published (npmMinimalAgeGate). Wait a day, or list vsift-cli and @vsift/* under npmPreapprovedPackages in the project's .yarnrc.yml.
Machines this release targets: Windows 11 x64, macOS 15 on Apple silicon, and Linux x64 with glibc 2.35 or later and OpenSSL 3.
Native archives
Each vsift-0.1.0-<target>.tar.gz holds the vsift executable, the licences, THIRD-PARTY-NOTICES, a CycloneDX SBOM and the agent skill; each target's SBOM and notices are also attached on their own. Check a download against SHA256SUMS (sha256sum --check --ignore-missing SHA256SUMS, or shasum -a 256 --check --ignore-missing SHA256SUMS on macOS). The executables are not code-signed or notarized, so Windows SmartScreen and macOS Gatekeeper may warn about one downloaded directly. Files installed through npm do not carry the download mark that triggers those two warnings, but Windows Smart App Control, where it is turned on, can block an unsigned program however it was installed; see the installation guide.
Verify the provenance
Every archive, SHA256SUMS, SBOM, notices file and npm tarball has a Sigstore build-provenance attestation from the Release workflow:
gh attestation verify <file> --repo smormah/vsift \
--signer-workflow smormah/vsift/.github/workflows/release.yml \
--source-ref refs/tags/v0.1.0 --deny-self-hosted-runnersThe npm packages also carry npm provenance: npm audit signatures in a project that installed vsift-cli@next checks their registry signatures and provenance attestations.
Installation guide: https://github.com/smormah/vsift/blob/v0.1.0/docs/operations/install.md