Turf v0.7.0

Pre-release evaluation software — expect rough edges, and please don't redistribute the binaries.

Highlights

Verifiable, signed releases

Every artifact in this release is cryptographically signed and recorded in the public
Sigstore transparency log:

• the turf CLI carries GitHub-native build provenance and an SBOM
  (gh attestation verify turf --repo turfbuild/turf);
• the turf-mcp-server binary and the new container image are cosign-signed with build
  provenance, a CycloneDX SBOM, and an OpenVEX disposition — verifiable without source access;
• the release ships per-component SBOMs plus an assembly bill-of-materials tying them together,
  and a unified checksums.txt.

See Verify your download below.

Container image

turf-mcp-server is now published as a signed, multi-arch image:

docker pull ghcr.io/turfbuild/turf-mcp-server:v0.7.0   # also :latest

CLI

• New --no-telemetry flag to opt out of telemetry.
• New --worktree for git-isolated HCL authoring.
• up / destroy now align with Terraform — pass -C <dir> instead of a positional path.
• Branded welcome banner in the lean TUI.

Fixes

• Fixed a crash when driving turf up with Google Gemini models (boolean-schema handling in the
  agent runtime).
• Continuous CVE scanning with published dispositions; cleared reachable standard-library advisories.

Verify your download

ID='^https://github.com/turfbuild/turf-mcp-server/'
ISS=https://token.actions.githubusercontent.com

# CLI — provenance + SBOM
gh attestation verify turf --repo turfbuild/turf

# Server binary — cosign (bundle ships on this release)
cosign verify-blob-attestation --type slsaprovenance1 \
  --bundle turf-mcp-server-<os>_<arch>.provenance.sigstore.json \
  --certificate-identity-regexp "$ID" --certificate-oidc-issuer "$ISS" \
  turf-mcp-server-<os>_<arch>

# Container image
cosign verify ghcr.io/turfbuild/turf-mcp-server:v0.7.0 \
  --certificate-identity-regexp "$ID" --certificate-oidc-issuer "$ISS"

checksums.txt is the no-tooling fallback.

Install

brew install turfbuild/tap/turf

---

Note: the released macOS CLI is built without voice capture; text chat and all MCP tooling are
unaffected. (A local make build keeps voice.)