Release 2.75.2

Same as 14ee01d8e3.

.github/.cspell/project-dictionary.txt

@@ -45,3 +45,4 @@ watchexec
 worktree
 xbuild
 xscale
+xwin

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: true

.github/ISSUE_TEMPLATE/new_tool.yml

@@ -0,0 +1,46 @@
+name: New tool suggestion
+description: Suggest support for a new tool
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for a new tool suggestion!
+
+        Normally, you don't need to open an issue to request support for a new tool.
+        Instead, please submit a pull request.
+        (See [DEVELOPMENT.md](https://github.com/taiki-e/install-action/blob/main/DEVELOPMENT.md) for how to add support for a new tool.)
+
+        That said, if you have any questions before getting started, or if you’re unable to contribute for any reason, feel free to open an issue.
+  - type: input
+    id: name
+    attributes:
+      label: Tool name
+    validations:
+      required: true
+  - type: dropdown
+    id: pre-built
+    attributes:
+      label: Are official pre-built binaries provided?
+      description: |
+        If "No", this issue will be blocked until official pre-built binaries are provided.<br>
+        If "Unknown", this issue will be blocked until it is determined that it is provided.<br>
+        (When the tool is a Rust crate, it may already be available via fallback even if "No" or "Unknown".)<br>
+      options:
+        - 'Yes'
+        - 'No'
+        - Unknown
+      default: 2
+    validations:
+      required: true
+  - type: input
+    id: url
+    attributes:
+      label: Website or repository link
+    validations:
+      required: true
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Any additional context that you believe may be relevant.

.github/dependabot.yml

@@ -1,9 +1,11 @@
 version: 2
 updates:
-  - package-ecosystem: cargo # zizmor: ignore[dependabot-cooldown] # Unless dependencies are pinned/locked, the effect is limited.
+  - package-ecosystem: cargo
     directory: /
     schedule:
-      interval: daily
+      interval: weekly
+    cooldown:
+      default-days: 14 # Note: Unless dependencies are pinned/locked, the effect is limited.
     commit-message:
       prefix: ''
     ignore:
@@ -13,9 +15,13 @@ updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: daily
+      interval: weekly
     cooldown:
-      default-days: 7
+      default-days: 14
     commit-message:
       prefix: ''
     labels: []
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/ci.yml

@@ -33,20 +33,20 @@ concurrency:
 
 jobs:
   miri:
-    uses: taiki-e/github-actions/.github/workflows/miri.yml@main
+    uses: taiki-e/github-actions/.github/workflows/miri.yml@606d6c78d69927c489d319133073a03157928a7a # main
     with:
       # NB: sync with test job's --exclude option
       args: --exclude install-action-internal-codegen
   msrv:
-    uses: taiki-e/github-actions/.github/workflows/msrv.yml@main
+    uses: taiki-e/github-actions/.github/workflows/msrv.yml@606d6c78d69927c489d319133073a03157928a7a # main
   test-manifest-schema:
-    uses: taiki-e/github-actions/.github/workflows/test.yml@main
+    uses: taiki-e/github-actions/.github/workflows/test.yml@606d6c78d69927c489d319133073a03157928a7a # main
     with:
       # NB: sync with miri job's --exclude option
       test-args: --exclude install-action-internal-codegen
       no-std: false
   tidy:
-    uses: taiki-e/github-actions/.github/workflows/tidy.yml@main
+    uses: taiki-e/github-actions/.github/workflows/tidy.yml@606d6c78d69927c489d319133073a03157928a7a # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # unused (used in `codegen-automerge: true` case)
@@ -95,7 +95,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
       - run: rm -- Cargo.toml
       - name: Generate tool list
@@ -154,7 +154,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
       - run: rm -- Cargo.toml
       - run: env
@@ -187,7 +187,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 60
     steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
       - run: rm -- Cargo.toml
       - run: env
@@ -221,11 +221,13 @@ jobs:
           - ubuntu:22.04 # glibc 2.35
           - ubuntu:24.04 # glibc 2.39
           - ubuntu:26.04 # glibc 2.42
+          - ubuntu:rolling
           - debian:9-slim # glibc 2.24
           - debian:10-slim # glibc 2.28
           - debian:11-slim # glibc 2.31
           - debian:12-slim # glibc 2.36
           - debian:13-slim # glibc 2.41
+          - debian:testing
           - fedora:latest # glibc 2.39 (as of fedora 40)
           - almalinux:8 # glibc 2.28
           - almalinux:8-minimal # glibc 2.28
@@ -264,6 +266,16 @@ jobs:
         if: startsWith(matrix.container, 'debian:9') || startsWith(matrix.container, 'debian:10')
       - name: Install requirements (centos)
         run: |
+          retry() {
+            for i in {1..10}; do
+              if "$@"; then
+                return 0
+              else
+                sleep "${i}"
+              fi
+            done
+            "$@"
+          }
           # In CentOS, the old repositories is removed from the main mirrors just after EoL.
           # https://github.com/rust-lang/rust/pull/126352
           sed -i /etc/yum.repos.d/*.repo -e 's!^mirrorlist!#mirrorlist!' \
@@ -271,22 +283,22 @@ jobs:
           sed -i 's/enabled=1/enabled=0/' /etc/yum/pluginconf.d/fastestmirror.conf
           if [[ "${CONTAINER}" == "centos:6" ]]; then
             # CentOS 6's curl (7.19.7) has no curl has no --proto/--tlsv1.2.
-            yum install -y gcc openssl-devel
+            retry yum install -y gcc openssl-devel
-            curl -fsSL --retry 10 https://curl.se/download/curl-7.34.0.tar.gz | tar xzf -
+            retry curl -fsSL --retry 10 https://curl.se/download/curl-7.34.0.tar.gz | tar xzf -
             cd -- curl-*
             ./configure --prefix=/usr/local --with-ssl
             make
             make install
             # for checkout-action https://github.com/taiki-e/checkout-action/blob/v1.3.0/.github/workflows/ci.yml#L135-L143
-            yum install -y openssh-clients perl perl-Error perl-TermReadKey rsync
+            retry yum install -y openssh-clients perl perl-Error perl-TermReadKey rsync
-            rpm -i \
+            retry rpm -i \
               https://vault.ius.io/el6/x86_64/packages/p/perl-Git18-1.8.5.5-4.ius.el6.noarch.rpm \
               https://vault.ius.io/el6/x86_64/packages/g/git18-1.8.5.5-4.ius.el6.x86_64.rpm
           fi
         env:
           CONTAINER: ${{ matrix.container }}
         if: startsWith(matrix.container, 'centos')
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
       - run: rm -- Cargo.toml
       - name: Generate tool list

.github/workflows/manifest.yml

@@ -33,7 +33,7 @@ concurrency:
 
 jobs:
   manifest:
-    uses: taiki-e/github-actions/.github/workflows/gen.yml@main
+    uses: taiki-e/github-actions/.github/workflows/gen.yml@7e4093bf4e87dd120ac0c3be2e47ebe7f737a47d # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # for gh pr review --approve
@@ -46,3 +46,4 @@ jobs:
       branch: update-manifest
       automerge: true
       install-rust: true
+      install-cosign: true

.github/workflows/release.yml

@@ -1,5 +1,7 @@
 name: Release
 
+# Adapted from https://github.com/taiki-e/github-actions/blob/HEAD/.github/workflows/action-release.yml.
+
 permissions:
   contents: read
 
@@ -36,8 +38,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@7a562dfa955aa2e4d5b0fd6ebd57ff9715c07b0b # v2.73.0
         with:
           tool: parse-changelog
           fallback: none
@@ -60,19 +62,6 @@ jobs:
             printf '::error::%s\n' "$*"
             exit 1
           }
-          normalize_comma_or_space_separated() {
-            # Normalize whitespace characters into space because it's hard to handle single input contains lines with POSIX sed alone.
-            local list="${1//[$'\r\n\t']/ }"
-            if [[ "${list}" == *","* ]]; then
-              # If a comma is contained, consider it is a comma-separated list.
-              # Drop leading and trailing whitespaces in each element.
-              sed -E 's/ *, */,/g; s/^.//' <<<",${list},"
-            else
-              # Otherwise, consider it is a whitespace-separated list.
-              # Convert whitespace characters into comma.
-              sed -E 's/ +/,/g; s/^.//' <<<" ${list} "
-            fi
-          }
           if { sed --help 2>&1 || true; } | grep -Eq -e '-i extension'; then
             in_place=(-i '')
           else
@@ -218,11 +207,16 @@ jobs:
     permissions:
       contents: write # for taiki-e/create-gh-release-action
     steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@7a562dfa955aa2e4d5b0fd6ebd57ff9715c07b0b # v2.73.0
         with:
           tool: parse-changelog
           fallback: none
+      - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        id: push-token
+        with:
+          app-id: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
+          private-key: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
       - name: Create and push release commit and tag
         id: push
         run: |
@@ -310,19 +304,24 @@ jobs:
             )
           fi
 
-          prev_credential_helper=$(git config get --global credential.helper || true)
+          prev_credential_helper=$(git config get --local credential.helper || true)
           if [[ -n "${prev_credential_helper}" ]]; then
             printf 'credential helper is already set (%s)\n' "${prev_credential_helper}"
           else
-            (
-              set -x
-              git config --global credential.helper store
-            )
             protocol="${GITHUB_SERVER_URL%%://*}"
             hostname="${GITHUB_SERVER_URL#*://}"
-            printf '%s\n' "${protocol}://${GITHUB_ACTOR}:${PUSH_TOKEN}@${hostname}" >~/.git-credentials
+            (
+              set -x
+              git config --local credential.helper cache
+            )
+            git credential approve <<EOF
+          protocol=${protocol}
+          host=${hostname}
+          username=${GITHUB_ACTOR}
+          password=${PUSH_TOKEN}
+          EOF
             # Remove credential helper config on exit.
-            trap -- '(set -x; rm -f -- ~/.git-credentials; git config --global --unset credential.helper || true)' EXIT
+            trap -- '(set -x; git credential-cache exit; git config --local --unset credential.helper || true)' EXIT
           fi
 
           (
@@ -423,24 +422,24 @@ jobs:
           BRANCH: main
           PREPARE_REV: ${{ needs.prepare.outputs.rev }}
           # Note that if we use secrets.GITHUB_TOKEN, the pushed commit/tag cannot trigger other workflows.
-          PUSH_TOKEN: ${{ secrets.PUSH_TOKEN }}
+          PUSH_TOKEN: ${{ steps.push-token.outputs.token }}
-      - uses: taiki-e/create-gh-release-action@v1
+      - uses: taiki-e/create-gh-release-action@f67cf7b2dadd83d36b981e674a6b08063997ce68 # v1.10.0
         with:
           changelog: CHANGELOG.md
           title: $version
           branch: main
-          token: ${{ secrets.GITHUB_TOKEN }}
           ref: refs/tags/${{ needs.prepare.outputs.tag }}
 
   release-manifest-schema:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action-manifest-schema'
-    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@main
+    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@606d6c78d69927c489d319133073a03157928a7a # main
     permissions:
       contents: write # for taiki-e/create-gh-release-action
       id-token: write # for rust-lang/crates-io-auth-action
       attestations: write # unused (used when options for uploading binaries are set)
     secrets:
-      PUSH_TOKEN: ${{ secrets.PUSH_TOKEN }}
+      PUSH_TOKEN_APP_CLIENT_ID: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
+      PUSH_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
     with:
       version: ${{ inputs.version }}
       tag-prefix: install-action-manifest-schema-

.github/zizmor.yml

@@ -3,7 +3,4 @@
 
 rules:
   anonymous-definition: { disable: true }
-  unpinned-uses:
+  dependabot-cooldown: { config: { days: 14 } }
-    config:
-      policies:
-        taiki-e/*: any

CHANGELOG.md

@@ -10,6 +10,64 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.75.2] - 2026-04-09
+
+- Update `uv@latest` to 0.11.4.
+
+- Update `tombi@latest` to 0.9.16.
+
+- Update `mise@latest` to 2026.4.6.
+
+## [2.75.1] - 2026-04-08
+
+- Update `shfmt@latest` to 3.13.1.
+
+- Update `cosign@latest` to 3.0.6.
+
+## [2.75.0] - 2026-04-07
+
+- Support `cosign`. ([#1677](https://github.com/taiki-e/install-action/pull/1677))
+
+## [2.74.1] - 2026-04-07
+
+- Update `mise@latest` to 2026.4.5.
+
+- Update `tombi@latest` to 0.9.15.
+
+## [2.74.0] - 2026-04-06
+
+- Support `cargo-deb`. ([#1669](https://github.com/taiki-e/install-action/pull/1669))
+
+- Update `just@latest` to 1.49.0.
+
+- Update `mise@latest` to 2026.4.4.
+
+## [2.73.0] - 2026-04-05
+
+- Introduce [dependency cooldown](https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns) when installing with `taiki-e/install-action@<tool_name>`, `tool: <tool_name>@latest`, or `tool: <tool_name>@<omitted_version>` to mitigate the risk of supply chain attacks by default. ([#1666](https://github.com/taiki-e/install-action/pull/1666))
+
+  This action without this cooldown already takes a few hours to a few days for new releases to be reflected (as with other common package managers that verify checksums or signatures), so this should not affect most users.
+
+  See the ["Security" section in readme](https://github.com/taiki-e/install-action#security) for more details.
+
+- Improve robustness for network failure.
+
+- Documentation improvements.
+
+## [2.72.0] - 2026-04-04
+
+- Support `cargo-xwin`. ([#1659](https://github.com/taiki-e/install-action/pull/1659), thanks @daxpedda)
+
+- Support trailing comma in `tool` input option.
+
+- Update `tombi@latest` to 0.9.14.
+
+## [2.71.3] - 2026-04-04
+
+- Update `wasm-tools@latest` to 1.246.2.
+
+- Update `mise@latest` to 2026.4.3.
+
 ## [2.71.2] - 2026-04-02
 
 - Implement workaround for [windows-11-arm runner bug](https://github.com/actions/partner-runner-images/issues/169) which sometimes causes installation failure. ([#1657](https://github.com/taiki-e/install-action/pull/1657))
@@ -6121,7 +6179,15 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.71.2...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.2...HEAD
+[2.75.2]: https://github.com/taiki-e/install-action/compare/v2.75.1...v2.75.2
+[2.75.1]: https://github.com/taiki-e/install-action/compare/v2.75.0...v2.75.1
+[2.75.0]: https://github.com/taiki-e/install-action/compare/v2.74.1...v2.75.0
+[2.74.1]: https://github.com/taiki-e/install-action/compare/v2.74.0...v2.74.1
+[2.74.0]: https://github.com/taiki-e/install-action/compare/v2.73.0...v2.74.0
+[2.73.0]: https://github.com/taiki-e/install-action/compare/v2.72.0...v2.73.0
+[2.72.0]: https://github.com/taiki-e/install-action/compare/v2.71.3...v2.72.0
+[2.71.3]: https://github.com/taiki-e/install-action/compare/v2.71.2...v2.71.3
 [2.71.2]: https://github.com/taiki-e/install-action/compare/v2.71.1...v2.71.2
 [2.71.1]: https://github.com/taiki-e/install-action/compare/v2.71.0...v2.71.1
 [2.71.0]: https://github.com/taiki-e/install-action/compare/v2.70.4...v2.71.0

DEVELOPMENT.md

@@ -21,9 +21,7 @@ See JSON files in `tools/codegen/base` directory for examples of the manifest.
 > GITHUB_TOKEN=$(gh auth token) ./tools/manifest.sh <tool>
 > ```
 
-## Refresh TOOLS.md
+3\. Update `TOOLS.md` with the following command.
-
-To update `TOOLS.md`, run
 
 ```sh
 ./tools/update-markdown.sh

README.md

@@ -23,7 +23,7 @@ GitHub Action for installing development tools (mainly from GitHub Releases).
 | Name | Required | Description | Type | Default |
 | ---- | :------: | ----------- | ---- | ------- |
 | tool | **✓** | Tools to install (whitespace or comma separated list) | String | |
-| checksum | | Whether to enable checksums | Boolean | `true` |
+| checksum | | Whether to enable checksums (strongly discouraged to disable) | Boolean | `true` |
 
 ### Example workflow
 
@@ -100,18 +100,28 @@ See the [development guide](DEVELOPMENT.md) for how to add support for new tool.
 
 ## Security
 
-The `@v<major>` and `@<tool_name>` tags are updated with each release. To enhance workflow stability and security against supply chain attacks, use the `@v<major>.<minor>.<patch>` tag or their hash to pin the version. Since all releases are immutable, pinning the version in either way should have the same effect.
+The `@v<major>` and `@<tool_name>` tags are updated with each release. If you want to enhance workflow stability and security against supply chain attacks, consider using the `@v<major>.<minor>.<patch>` tag or their hash to pin the version and regularly updating with [dependency cooldown]. Since all releases are immutable, pinning the version in either way should have the same effect. Pinning `@<tool_name>` tags by hash is strongly discouraged, as it causes the workflow to reference a [commit that is not present on the repository](https://docs.zizmor.sh/audits/#impostor-commit) when a new version is released.
 
-When installing the tool from GitHub Releases, the tool version that install-action installs with `tool: <tool_name>@latest` or `tool: <tool_name>@<omitted_version>` is associated with the install-action version, so pinning install-action version with the above ways also pins the version of the tool being installed. This also means that if a [dependency cooldown](https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns) applies to the action itself, a cooldown of the same duration or a few days longer will apply to the tools installed by that action.
+<!-- omit in toc -->
+### Security on installation from GitHub Releases
 
-### Security on tool installation
+**Tools covered in this section:** Tools in the [supported tools list](TOOLS.md) where column "Where will it be installed from" is "GitHub Releases".
 
-When installing the tool from GitHub Releases, this action will download the tool or its installer from GitHub Releases using HTTPS with tlsv1.2+. This is basically considered to be the same level of security as [the recommended installation of rustup](https://www.rust-lang.org/tools/install).
+This action will download the tool or its installer from GitHub Releases using HTTPS with tlsv1.2+. This is basically considered to be the same level of security as [the recommended installation of rustup](https://www.rust-lang.org/tools/install).
 
-Additionally, this action will also verify SHA256 checksums for downloaded files in all tools installed from GitHub Releases. This is enabled by default and can be disabled by setting the `checksum` input option to `false`.
+Additionally, this action will also verify SHA256 checksums for downloaded files for all tools covered in this section. This is enabled by default and can be disabled by setting the `checksum` input option to `false` (strongly discouraged to disable).
 
 Additionally, we also verify [artifact attestations](https://docs.github.com/en/actions/concepts/security/artifact-attestations) or signature if the tool publishes artifact attestations or distributes signed archives. Verification is done at the stage of getting the checksum, so disabling the checksum will also disable verification.
 
+When installing with `taiki-e/install-action@<tool_name>`, `tool: <tool_name>`, or `tool: <tool_name>@<omitted_version>`, The tool version is reflects upstream releases with a delay of one to a few days (as with other common package managers that verify checksums or signatures). A delay of at least one day is known as [dependency cooldown] and is intended to mitigate the risk of supply chain attacks (the specific cooldown period may be changed in the future). You can bypass the cooldown by explicitly specifying a version. If you want a longer cooldown, consider using the property described below.
+
+When installing with `tool: <tool_name>` or `tool: <tool_name>@<omitted_version>`, the tool version is associated with the install-action version, so pinning install-action version with the `@v<major>.<minor>.<patch>` tag or their hash also pins the version of the tool being installed. This also means that if a [dependency cooldown] applies to the action itself, a cooldown of one to a few days longer will apply to the tools installed by that action.
+
+[dependency cooldown]: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
+
+<!-- omit in toc -->
+### Security on other installation methods
+
 See the linked documentation for information on security when installed using [snap](https://snapcraft.io/docs) or [cargo-binstall](https://github.com/cargo-bins/cargo-binstall#faq).
 
 See the [Supported tools section](#supported-tools) for how to ensure that fallback is not used.

TOOLS.md

@@ -22,6 +22,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**cargo-careful**](https://github.com/RalfJung/cargo-careful) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/RalfJung/cargo-careful/releases) | Linux, macOS, Windows | [MIT](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-APACHE) |
 | [**cargo-cyclonedx**](https://github.com/CycloneDX/cyclonedx-rust-cargo) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/CycloneDX/cyclonedx-rust-cargo/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/CycloneDX/cyclonedx-rust-cargo/blob/main/LICENSE) |
 | [**cargo-deadlinks**](https://github.com/deadlinks/cargo-deadlinks) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/deadlinks/cargo-deadlinks/releases) | Linux, macOS, Windows | [MIT](https://github.com/deadlinks/cargo-deadlinks/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/deadlinks/cargo-deadlinks/blob/master/LICENSE-APACHE) |
+| [**cargo-deb**](https://github.com/kornelski/cargo-deb) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/kornelski/cargo-deb/releases) | Linux | [MIT](https://github.com/kornelski/cargo-deb/blob/main/LICENSE) |
 | [**cargo-deny**](https://github.com/EmbarkStudios/cargo-deny) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/EmbarkStudios/cargo-deny/releases) | Linux, macOS, Windows | [MIT](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-APACHE) |
 | [**cargo-dinghy**](https://github.com/sonos/dinghy) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sonos/dinghy/releases) | Linux, macOS | [MIT](https://github.com/sonos/dinghy/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/sonos/dinghy/blob/main/LICENSE-APACHE) |
 | [**cargo-export**](https://github.com/bazhenov/cargo-export) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bazhenov/cargo-export/releases) | Linux, macOS, Windows | [MIT](https://github.com/bazhenov/cargo-export/blob/master/LICENSE) |
@@ -43,8 +44,10 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**cargo-tarpaulin**](https://github.com/xd009642/tarpaulin) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/xd009642/tarpaulin/releases) | Linux, macOS, Windows | [MIT](https://github.com/xd009642/tarpaulin/blob/develop/LICENSE-MIT) OR [Apache-2.0](https://github.com/xd009642/tarpaulin/blob/develop/LICENSE-APACHE) |
 | [**cargo-udeps**](https://github.com/est31/cargo-udeps) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/est31/cargo-udeps/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/est31/cargo-udeps/blob/HEAD/LICENSE) |
 | [**cargo-valgrind**](https://github.com/jfrimmel/cargo-valgrind) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/jfrimmel/cargo-valgrind/releases) | Linux, macOS, Windows | [MIT](https://github.com/jfrimmel/cargo-valgrind/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/jfrimmel/cargo-valgrind/blob/master/LICENSE-APACHE) |
+| [**cargo-xwin**](https://github.com/rust-cross/cargo-xwin) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-cross/cargo-xwin/releases) | Linux, macOS, Windows | [MIT](https://github.com/rust-cross/cargo-xwin/blob/main/LICENSE) |
 | [**cargo-zigbuild**](https://github.com/rust-cross/cargo-zigbuild) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-cross/cargo-zigbuild/releases) | Linux, macOS, Windows | [MIT](https://github.com/rust-cross/cargo-zigbuild/blob/main/LICENSE) |
 | [**coreutils**](https://github.com/uutils/coreutils) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/uutils/coreutils/releases) | Linux, macOS, Windows | [MIT](https://github.com/uutils/coreutils/blob/main/LICENSE) |
+| [**cosign**](https://github.com/sigstore/cosign) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/sigstore/cosign/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/sigstore/cosign/blob/main/LICENSE) |
 | [**covgate**](https://github.com/jesse-black/covgate) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/jesse-black/covgate/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/jesse-black/covgate/blob/main/LICENSE) |
 | [**cross**](https://github.com/cross-rs/cross) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cross-rs/cross/releases) | Linux, macOS, Windows | [MIT](https://github.com/cross-rs/cross/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/cross-rs/cross/blob/main/LICENSE-APACHE) |
 | [**cyclonedx**](https://github.com/CycloneDX/cyclonedx-cli) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/CycloneDX/cyclonedx-cli/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/CycloneDX/cyclonedx-cli/blob/main/LICENSE) |
@@ -85,7 +88,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**trunk**](https://github.com/trunk-rs/trunk) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/trunk-rs/trunk/releases) | Linux, macOS, Windows | [MIT](https://github.com/trunk-rs/trunk/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/trunk-rs/trunk/blob/main/LICENSE-APACHE) |
 | [**typos**](https://github.com/crate-ci/typos) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/crate-ci/typos/releases) | Linux, macOS, Windows | [MIT](https://github.com/crate-ci/typos/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/crate-ci/typos/blob/master/LICENSE-APACHE) |
 | [**ubi**](https://github.com/houseabsolute/ubi) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/houseabsolute/ubi/releases) | Linux, macOS, Windows | [MIT](https://github.com/houseabsolute/ubi/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/houseabsolute/ubi/blob/master/LICENSE-APACHE) |
-| [**uv**](https://github.com/astral-sh/uv) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/astral-sh/uv/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT) |
+| [**uv**](https://github.com/astral-sh/uv) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/astral-sh/uv/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT) |
 | [**vacuum**](https://github.com/daveshanley/vacuum) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/daveshanley/vacuum/releases) | Linux, macOS, Windows | [MIT](https://github.com/daveshanley/vacuum/blob/main/LICENSE) |
 | [**valgrind**](https://valgrind.org/) | `/snap/bin` | [snap](https://snapcraft.io/install/valgrind/ubuntu) | Linux | [GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD) |
 | [**wait-for-them**](https://github.com/shenek/wait-for-them) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/shenek/wait-for-them/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/shenek/wait-for-them/blob/v0.4.0/Cargo.toml#L7) |

action.yml

@@ -7,7 +7,7 @@ inputs:
     required: true
     # default: #publish:tool
   checksum:
-    description: Whether to enable checksums
+    description: Whether to enable checksums (strongly discouraged to disable)
     required: false
     default: 'true'
   fallback:
@@ -40,19 +40,18 @@ runs:
             exit 1
           fi
         fi
+        bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
       shell: sh
-      if: runner.os == 'Linux'
-    - run: bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
-      shell: bash
       env:
-        # NB: Sync with non-Windows case.
+        # NB: Sync with Windows case.
         INPUT_TOOL: ${{ inputs.tool }}
         INPUT_CHECKSUM: ${{ inputs.checksum }}
         INPUT_FALLBACK: ${{ inputs.fallback }}
         DEFAULT_GITHUB_TOKEN: ${{ github.token }}
         ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
       if: runner.os != 'Windows'
-    # Use pwsh and retry on bash startup failure to work around windows-11-arm runner bug: https://github.com/actions/partner-runner-images/issues/169
+    # Use pwsh and retry on bash startup failure to work around windows-11-arm runner bug:
+    # https://github.com/actions/partner-runner-images/issues/169
     - run: |
         Set-StrictMode -Version Latest
         for ($i=1; $i -le 10; $i++) {

main.sh

@@ -35,7 +35,7 @@ normalize_comma_or_space_separated() {
   if [[ "${list}" == *","* ]]; then
     # If a comma is contained, consider it is a comma-separated list.
     # Drop leading and trailing whitespaces in each element.
-    sed -E 's/ *, */,/g; s/^.//' <<<",${list},"
+    sed -E 's/ *, */,/g; s/^.//; s/,,$/,/' <<<",${list},"
   else
     # Otherwise, consider it is a whitespace-separated list.
     # Convert whitespace characters into comma.
@@ -56,7 +56,7 @@ download_and_checksum() {
     checksum=''
   fi
   info "downloading ${url}"
-  retry curl --proto '=https' --tlsv1.2 -fsSL "${url}" -o tmp
+  retry curl --proto '=https' --tlsv1.2 -fsSL --retry 10 -o tmp "${url}"
   if [[ -n "${checksum}" ]]; then
     info "verifying sha256 checksum for $(basename -- "${url}")"
     if type -P sha256sum >/dev/null; then
@@ -161,6 +161,17 @@ download_and_extract() {
         esac
       fi
       ;;
+    *.deb)
+      if ! type -P dpkg-deb >/dev/null; then
+        case "${base_distro}" in
+          debian | fedora | suse | arch | alpine)
+            printf '::group::Install packages required for installation (dpkg)\n'
+            sys_install dpkg
+            printf '::endgroup::\n'
+            ;;
+        esac
+      fi
+      ;;
   esac
 
   mkdir -p -- "${tmp_dir}"
@@ -194,6 +205,12 @@ download_and_extract() {
             mv -- "${tmp}" "${bin_dir}/"
           done
           ;;
+        *.deb)
+          dpkg-deb -x tmp .
+          for tmp in "${bin_in_archive[@]}"; do
+            mv -- "${tmp}" "${bin_dir}/"
+          done
+          ;;
         *)
           for tmp in "${installed_bin[@]}"; do
             mv -- tmp "${tmp}"
@@ -233,7 +250,7 @@ read_manifest() {
       # TODO: don't hardcode tool name and use 'immediate_yank_reflection' field in base manifest.
       case "${tool}" in
         cargo-nextest)
-          crate_info=$(retry curl --user-agent "${ACTION_USER_AGENT}" --proto '=https' --tlsv1.2 -fsSL "https://crates.io/api/v1/crates/${rust_crate}" || true)
+          crate_info=$(retry curl --user-agent "${ACTION_USER_AGENT}" --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${rust_crate}" || true)
           if [[ -n "${crate_info}" ]]; then
             while true; do
               yanked=$(jq -r ".versions[] | select(.num == \"${exact_version}\") | .yanked" <<<"${crate_info}")
@@ -443,13 +460,19 @@ case "$(uname -s)" in
   Linux)
     host_os=linux
     ldd_version=$(ldd --version 2>&1 || true)
-    if grep -Fq musl <<<"${ldd_version}"; then
+    if [[ "${ldd_version}" == *'musl'* ]]; then
       host_env=musl
     else
       host_env=gnu
       host_glibc_version=$(grep -E "GLIBC|GNU libc" <<<"${ldd_version}" | sed -E "s/.* //g")
     fi
-    if [[ -e /etc/os-release ]]; then
+    if [[ -e /etc/redhat-release ]]; then
+      # /etc/os-release is available on RHEL/CentOS 7+
+      base_distro=fedora
+    elif [[ -e /etc/debian_version ]]; then
+      # /etc/os-release is available on Debian 7+
+      base_distro=debian
+    elif [[ -e /etc/os-release ]]; then
       if grep -Eq '^ID_LIKE=' /etc/os-release; then
         base_distro=$(grep -E '^ID_LIKE=' /etc/os-release | cut -d= -f2)
         case "${base_distro}" in
@@ -463,12 +486,6 @@ case "$(uname -s)" in
         base_distro=$(grep -E '^ID=' /etc/os-release | cut -d= -f2)
       fi
       base_distro="${base_distro//\"/}"
-    elif [[ -e /etc/redhat-release ]]; then
-      # /etc/os-release is available on RHEL/CentOS 7+
-      base_distro=fedora
-    elif [[ -e /etc/debian_version ]]; then
-      # /etc/os-release is available on Debian 7+
-      base_distro=debian
     fi
     case "${base_distro}" in
       fedora)
@@ -597,7 +614,10 @@ fi
 enable_checksum="${INPUT_CHECKSUM:-}"
 case "${enable_checksum}" in
   true) ;;
-  false) enable_checksum='' ;;
+  false)
+    enable_checksum=''
+    warn "checksums have been disabled by 'checksum' input option; this is strongly discouraged for security reasons"
+    ;;
   *) bail "'checksum' input option must be 'true' or 'false': '${enable_checksum}'" ;;
 esac
 
@@ -855,8 +875,8 @@ for tool in "${tools[@]}"; do
       iai-callgrind-runner) ;;
       # cargo-zigbuild/cargo-insta has no --version flag on `cargo $tool_bin_stem` subcommand.
       cargo-zigbuild | cargo-insta) rx "${tool_bin_stem}" --version ;;
-      # deepsource has version command instead of --version flag.
+      # these packages have version command instead of --version flag.
-      deepsource | vacuum) rx "${tool_bin_stem}" version ;;
+      cosign | deepsource | vacuum) rx "${tool_bin_stem}" version ;;
       cargo-*)
         case "${tool_bin_stem}" in
           # cargo-valgrind 2.1.0's --version flag just calls cargo's --version flag

manifests/cargo-deb.json

@@ -0,0 +1,37 @@
+{
+  "rust_crate": "cargo-deb",
+  "template": {
+    "x86_64_linux_gnu": {
+      "url": "https://github.com/kornelski/cargo-deb/releases/download/v${version}/cargo-deb_${version}-1_amd64.deb",
+      "bin": "usr/bin/cargo-deb"
+    }
+  },
+  "license_markdown": "[MIT](https://github.com/kornelski/cargo-deb/blob/main/LICENSE)",
+  "latest": {
+    "version": "3.6.3"
+  },
+  "3": {
+    "version": "3.6.3"
+  },
+  "3.6": {
+    "version": "3.6.3"
+  },
+  "3.6.3": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE63F58EBB06E1",
+      "hash": "e4b8c1a499a8f4e5b96d72f0d1ec9da8005ba379aee95aaeef83860991c831c3"
+    }
+  },
+  "3.6.2": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE0A5D04840934",
+      "hash": "a0053e0089f0efb194013e9629087c247d1de6cb439b7381b4109e21153b991e"
+    }
+  },
+  "3.6.1": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DDE4DDD98766C4",
+      "hash": "c7c890cc90dae8c4f5f9ad0ff3d7675fec74fbb57ff89c4f27cfbbab34676e93"
+    }
+  }
+}

manifests/cargo-xwin.json

@@ -0,0 +1,406 @@
+{
+  "rust_crate": "cargo-xwin",
+  "template": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/rust-cross/cargo-xwin/releases/download/v${version}/cargo-xwin-v${version}.x86_64-unknown-linux-musl.tar.gz"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/rust-cross/cargo-xwin/releases/download/v${version}/cargo-xwin-v${version}.universal2-apple-darwin.tar.gz"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/rust-cross/cargo-xwin/releases/download/v${version}/cargo-xwin-v${version}.windows-x64.zip"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/rust-cross/cargo-xwin/releases/download/v${version}/cargo-xwin-v${version}.aarch64-unknown-linux-musl.tar.gz"
+    }
+  },
+  "license_markdown": "[MIT](https://github.com/rust-cross/cargo-xwin/blob/main/LICENSE)",
+  "latest": {
+    "version": "0.21.4"
+  },
+  "0.21": {
+    "version": "0.21.4"
+  },
+  "0.21.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE600B46A93E96",
+      "hash": "fe3e4afd02c24f90da1333fc9a5896813d3daee3bd0e5c5d89a4800eb58b9687"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE600B4A82E719",
+      "hash": "ddaeb84691027edd7b5012f617ac59d5dedf8b2d3472798c1e4521808cf1be78"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE600B35C26780",
+      "hash": "6136ba7c320265a8ee6c663fad9c84bbe55185d9f6bccec8f61ae7f5798400e8"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE600AF0A1F960",
+      "hash": "c5f125e9da3ac89ec1e2fa6888afedff2b75b8c025c381150c3676817762f7cf"
+    }
+  },
+  "0.21.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE5DA9F883D575",
+      "hash": "cc4c322d4dfd5480bb4e39efa80fc51b08a65af5105d2d4f6607e9dc58ae72e2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE5DAADCC5C6A6",
+      "hash": "6e96509d70fe79224d79505e9e9467137a3f299acc57ecaafa8c701af855b537"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE5DAA849F88C7",
+      "hash": "53284aec3e9a012712123b9c155145891dcd457aad63408b5557d82281cc172e"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE5DAA3406E74D",
+      "hash": "885554586b7976de6d497be4230a22e8905d6d975b6275650a81461ee6b2fd41"
+    }
+  },
+  "0.21.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE556CBE19F2B9",
+      "hash": "b4f6305c9e9277a017caf229be21ee3a9eabafb569e48fb94bd19462374d5a0d"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE556CF3C7F023",
+      "hash": "e5668a9c89f631485a56f259671a102501854e049f48dc554d47d65ad0d64d81"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE556C77269749",
+      "hash": "e4397af02b47c11fd2dd4ef6837350c9aa85fd1ec2707cbc616f9938f48b0c1b"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE556CC89C2946",
+      "hash": "551e0fb484ebdb2528cda57982e2862ed6dc401fa94b03e6a448dc784b4a70bc"
+    }
+  },
+  "0.21.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE556BA913B810",
+      "hash": "a2854076543226e3fe7cd13b8fe3944a86aa1ec786bca2a17050fd5f10679f9e"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE556B9DEE31AE",
+      "hash": "fd7fc2dbc3a25d29855a16c0229e2faf8b7813e3583803664219a1976a8149fe"
+    }
+  },
+  "0.21.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE556A00F6F0D7",
+      "hash": "3a6cf133224c7892f3ce9a759def219a9da9b91828a1ff4c014b050f612dab40"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE556A52036390",
+      "hash": "804cb91204ca021916de2dc74861ec977656b850ac1cc1dd8c1c465eb15e9d21"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE556A42974548",
+      "hash": "d7116616379104c0a152c570750e54a62621062f64aedc82ff8dc849b87e879a"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE5569FDEE043A",
+      "hash": "b4deede6f6ab774cd508e8892eb68926542e4cd19d9329a79dbb084921fecc17"
+    }
+  },
+  "0.20": {
+    "version": "0.20.2"
+  },
+  "0.20.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE1B943AB4AF33",
+      "hash": "81eb698b63fc196ad0601167dbc4bd191fdf7543b48ff1ab6cded6eb354f92bd"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE1B942F56F595",
+      "hash": "94c9249218c0c8595d265ec0ba3780954f1ff7799fd3ab2c773669ced39ad514"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE1B93D8EF8707",
+      "hash": "02ce726fc1a89054e86eaae28315715f41e920ac8b24ae9da2c733ca5b6bae71"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE1B941A8C4951",
+      "hash": "71420b6949774eb75fc89704191b5e858146645083ef7ffba11cd008030a9a0f"
+    }
+  },
+  "0.20.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE0A454A67227E",
+      "hash": "779286435b8cfe24069ce7d21c7953d8cc1b297110b2cfc645234b511ad150f2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE0A45AF373CB0",
+      "hash": "7e2ef1b2eae202957babc595d7bc2be1f09fe8757e27ce8f3ecffac14936783a"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE0A452EB50C40",
+      "hash": "51545a33e45c7b4c26feb6fae9eeb35ab9d936bbe4ee1c15bbb6e1a06c99a91e"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE0A456EFDE36A",
+      "hash": "b7dc2239f051675e96240b1b617b2a3bcc94b58d20ee3dde329f272a8c876dfa"
+    }
+  },
+  "0.20.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE072F952C41EB",
+      "hash": "083fdc00067f69eed2ddd2b40b37436b55d417104101b4f618157c35e4125d49"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE072FC97A9F36",
+      "hash": "025ac0e6b5e5d8f7a5364e97bbe23a49297437aa4063c4cef608b5689b547293"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE072FE1FFF088",
+      "hash": "6f450cf62ec8e1dece73eea487174d83311762122a1a8196f5b229a5fb109904"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE072F974E68F2",
+      "hash": "4b35a5e69347fa29b8b051a4ece87cb74129d2bbdfcecaf35f18f6025d9cb0ce"
+    }
+  },
+  "0.19": {
+    "version": "0.19.2"
+  },
+  "0.19.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DDD4FA6C5995C9",
+      "hash": "89af8a9cef823e01c0d2f612ade731b4b638b0d199dc1dc09957017ff53a39cb"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DDD4FA0504038C",
+      "hash": "65522dbb52ddc0c59d19c594c3993a1daa4345d8b526b938f7b2da3d65dde31e"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DDD4FA6D526ECB",
+      "hash": "860473eb378e6c146bcaef7ed84deff4b465602a9300cf39442c2f9bb1f35152"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DDD4FA5CCE5810",
+      "hash": "5986e73691f67a8d97921ff0e4add4bd3c2c758867f0049e07d4468cd4f5e439"
+    }
+  },
+  "0.19.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DDBDE32F5348B4",
+      "hash": "baa5b908620ce60636a07b5cd54948f4466d6b1f4372bb17e371fa58bdfd7f95"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DDBDE30AD344DB",
+      "hash": "67b2c2d4ffd1cbe926b805b8766346b2521250650eae5b93fc397efdbe69f322"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DDBDE37F279D0D",
+      "hash": "e1e4bc3b9b52c026491a291125a7408bb74f2dd898d491b791b7a84a6753b4bd"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DDBDE2DF764B7D",
+      "hash": "85569f88ad728ae417c61350aadd4b71cc956d38f8f3eca1717cf98371d16642"
+    }
+  },
+  "0.19.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DDB266A6D4BD7C",
+      "hash": "f5bc724b6fd5af8c294b2cc9890e0600a7de47137cd84f2f0835fd3ebc885581"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DDB266C4F4C65B",
+      "hash": "1c7f4f7a161e207b7173b2b569d198f64927ba2bffaa61812b7447aa3ab59bd4"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DDB266F0C1CB68",
+      "hash": "ca1253ce4d4d287e8a03690fc644f986aef5bbdd6ed08f1438ac443c461b5d77"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DDB266AFDC5848",
+      "hash": "b40cf06a0f84221b5a722a9490c2b95a37bb562a8a1c24375107f459894f6249"
+    }
+  },
+  "0.18": {
+    "version": "0.18.6"
+  },
+  "0.18.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DDA7E03CFB71A8",
+      "hash": "5bf295561ae2fdb9aaba1a4d7b10acff125d657f0d356f20f46db788b05910d8"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DDA75324488DFA",
+      "hash": "aa6cb652d108e87175b43be8941f2ac944498310cd8525be40de03a2707f1e77"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DDA7532EA841D5",
+      "hash": "1e9cc537f098a32909242829d36c462c3e09c7f0238c80da375a8c511e071a06"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DDA7E034FF1090",
+      "hash": "ffa3d74b644883988ee41597284925c97aad183dd77f5f29db64bb6d331f29f6"
+    }
+  },
+  "0.18.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DDA1E6413EA875",
+      "hash": "97470b43878dd14f3c9c08b5f3eb5fbd8b3111e36597ae62bbb50b636b36fc52"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DDA1E64A45AE82",
+      "hash": "479013ccd59d69c3aa4b83a8f02da454b1c092f580d16757eb753194d145ae17"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DDA1E6B46DF128",
+      "hash": "2deb364f2d894ea5b50a2e0f26e96410d7f12701e1ad3286108905e2b9b8ecdc"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DDA1E661868FDE",
+      "hash": "58151eac78e2bafc9600dadc2b77607bfc1f61b95efba8707824bff455aa9824"
+    }
+  },
+  "0.18.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD33C5EAB5DD19",
+      "hash": "35d05e10b12e0f8d56bf25a4bb77700c1369e7d8db63e82a09c2dcf536c6ed71"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD33C612B24250",
+      "hash": "40ddf40369453bfbd39cdecf0e90d81718f28e7cfd64327e6d0ba963b0b2f33c"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD33C672C4572E",
+      "hash": "55600c9a0d3d85bd86afd5bd5fd5d93e18d96b7b9c9f966fd7a45337bacf5d17"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD33C5EA9BBBDC",
+      "hash": "a68290b2b2cdc4a3bc368e5e8fe25a62bf9f4a4fa53290fc8779a73d7b7b881f"
+    }
+  },
+  "0.18.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD242CB4BFE521",
+      "hash": "44136f6357c030d0f5f3f597e5a2a53e5aa8ada45ac78fffb33ab8761bbc91d5"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD242CABFC2F64",
+      "hash": "d22a3d5536dd6dea65600b3cdc006304c7416e1f930b2afd336ec5936a320f5d"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD242CE656CE47",
+      "hash": "3d0ab25517a8dcc6b0390197bdbe7ac945892a153d4f67ddd517f379cd1db86d"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD242C8D2C07DB",
+      "hash": "8bde55860b086ec502f858d988db2ca0651219cf1388ac0157fdaf325f254785"
+    }
+  },
+  "0.18.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD2340A85DD30C",
+      "hash": "2f3a954422c2f7295a64e9c7e8bfbd0c7ea160e87a0920e59e5fc8dd5bb1de4b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD2340D8DD8135",
+      "hash": "32629286ef6e16083cf89a61e027084f2f463aa5e0dc230de720dd5699f96b4d"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD2341097D16D7",
+      "hash": "35c2248edf1a48b9c1c1923de05f99ce578ce7df80615caee77a3cc7194f9e28"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD2340AA0A1674",
+      "hash": "6d21c208b33694303213c5b91e6d516f2bd2fc67bd027d210e2d72eef7b7f0d5"
+    }
+  },
+  "0.18.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD228CA218670D",
+      "hash": "24f5d63d18ab73dcb464c206fab27a60081755416d294b0f728f9dd8db2ae8fe"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD228CAA0EB75B",
+      "hash": "2271128452ef93e42f8506d086b4e86e9963b61cae727e09eb3f05174dfe43b2"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD228CD42423C6",
+      "hash": "34b78fe4abbc4723c631f987d5d1188db2498ea6dbb1b9dcdc7ce4f72ea451fe"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD228C99F2FE57",
+      "hash": "01bfbbd8f69ef64fcffac87e674c027dbdcceb5243535a31dfc97b9e94d58faa"
+    }
+  },
+  "0.18.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD21AF3AB5C8AF",
+      "hash": "c5f23cc01d0c091c67153e93ee34d92160443166ce74595d8fdbf802b5ec09cc"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD21AF54F99F2B",
+      "hash": "af9d29b44da4a8790f5cb424f73bf3dd1c4b611798f3c6789f230b5cf3b45347"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD21AF80BD488B",
+      "hash": "dc82808c5c951009f1e67fe88bace45f0e35eb8c038282c1887f080db5b10704"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD21AF349141F0",
+      "hash": "91457ab107212193b0638b5da234bbd18d8898e4ac901a0f32f5e3b1e4e7fa38"
+    }
+  },
+  "0.17": {
+    "version": "0.17.6"
+  },
+  "0.17.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD1E925AB4F528",
+      "hash": "d391b26b356bac0f642f4e94abbfb8c94d86735951ec25f8404f152468331133"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD1E9266DF9B94",
+      "hash": "50d1f80fd5b364f756dd93670f70f2b967d97839e618e6c000cbfa509bceb059"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD1E929A149415",
+      "hash": "ba6cf8ea22e0721737ccfd6dbda6d90543eabf45947a480d995334832f7719d1"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD1E925A93AFF2",
+      "hash": "c0da934baa028356ed20f57f3d10cfad33781dd457a1960e9f8b3e8f039a2e56"
+    }
+  },
+  "0.17.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD1214BD639CD2",
+      "hash": "4f179d3f543dfe6569fb00fa6655bf1939f782c50df83b7d9704b58ef84a4a81"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD1214C233ADC7",
+      "hash": "a61d590cbddca4ab898f1f1742428ce125a8e795fb8034ad76a307e7830da612"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD121501CF2759",
+      "hash": "5f0e3c1fb9ca39cc157f8f10aeb8af49980863f5f5ae140bdfbb68a2582356ac"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD1214C0F1E9E2",
+      "hash": "cb90d3e070187677c8d71aa17a1d4fd795cb39a2283bbbb71be9ae2d7f04570f"
+    }
+  },
+  "0.17.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD10EA9265F332",
+      "hash": "029bc3e5b4fc1b845dc65bb494813462ec24733ec9fee6b05b2bdfecb3d6d981"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD10EC876C59B6",
+      "hash": "b5a423b7d0fdc946af9ce51424c1b60d71082a0cd4cd01e3a14b7a601fe8d5df"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD10EAE5D42438",
+      "hash": "e88603cb77e5491730bafab5287d8f1465abd2cce731b062cd76d22d70734ac2"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD10EA59E6D198",
+      "hash": "86ac0e9a4f2697259f21fccc291ce121bfc6a39b7d264c58a781bcf89731c79e"
+    }
+  }
+}

manifests/coreutils.json

@@ -5,6 +5,50 @@
   "latest": {
     "version": "0.6.0"
   },
+  "0.8.0": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-x86_64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DE941D3DECEE20",
+      "hash": "b8977997a49b677169f7ce65bfc2ad658d4943c4f02f0493b1a802137202b0bf",
+      "bin": "coreutils-0.8.0-x86_64-unknown-linux-musl/coreutils"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-x86_64-apple-darwin.tar.gz",
+      "etag": "0x8DE941DCF25AA9A",
+      "hash": "8ac6299b298eb3ba995973b42aece162578e19f9243425a5945d9c4bd8135b0a",
+      "bin": "coreutils-0.8.0-x86_64-apple-darwin/coreutils"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DE941D6E03C003",
+      "hash": "db464cf2a6ecbfd42c85f46ed2d749be574df4df47feca1f08988fd760f324f3",
+      "bin": "coreutils-0.8.0-x86_64-pc-windows-msvc/coreutils.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-aarch64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DE941C4BA7DC07",
+      "hash": "e592200ef784deecc5ac2328b0617422c89f62b9bb841eb114528ed938ccb725",
+      "bin": "coreutils-0.8.0-aarch64-unknown-linux-musl/coreutils"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-aarch64-apple-darwin.tar.gz",
+      "etag": "0x8DE941D614F7398",
+      "hash": "add95b420f9f1b69a0a7cb7b2672648fc72cf1294384344791e8e064bdc5e8c2",
+      "bin": "coreutils-0.8.0-aarch64-apple-darwin/coreutils"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-aarch64-pc-windows-msvc.zip",
+      "etag": "0x8DE941BAE10C59A",
+      "hash": "1dfa62f18b64c70b664936b06fb1be20f0f6afa9ff041dd95dda629e987435a9",
+      "bin": "coreutils-0.8.0-aarch64-pc-windows-msvc/coreutils.exe"
+    },
+    "riscv64_linux_musl": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-riscv64gc-unknown-linux-musl.tar.gz",
+      "etag": "0x8DE941BF13F7832",
+      "hash": "6e6c8823d7319f0d83a932515e248df0eb531e07f3a9193aaf05fdfb9dd63698",
+      "bin": "coreutils-0.8.0-riscv64gc-unknown-linux-musl/coreutils"
+    }
+  },
   "0.7.0": {
     "x86_64_linux_musl": {
       "url": "https://github.com/uutils/coreutils/releases/download/0.7.0/coreutils-0.7.0-x86_64-unknown-linux-musl.tar.gz",

manifests/cosign.json

@@ -0,0 +1,243 @@
+{
+  "rust_crate": null,
+  "template": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-amd64"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-darwin-amd64"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-windows-amd64.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-arm64"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-darwin-arm64"
+    },
+    "powerpc64le_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-ppc64le"
+    },
+    "riscv64_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-riscv64"
+    },
+    "s390x_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-s390x"
+    }
+  },
+  "license_markdown": "[Apache-2.0](https://github.com/sigstore/cosign/blob/main/LICENSE)",
+  "latest": {
+    "version": "3.0.6"
+  },
+  "3": {
+    "version": "3.0.6"
+  },
+  "3.0": {
+    "version": "3.0.6"
+  },
+  "3.0.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9427E4F4F66D",
+      "hash": "c956e5dfcac53d52bcf058360d579472f0c1d2d9b69f55209e256fe7783f4c74"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE942809604B8D",
+      "hash": "4c3e7af8372d3ca3296e62fa56f23fcbb5721cc6ac1827900d398f110d7cd280"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9427FF1A8F49",
+      "hash": "9b85a88ebff2d9dd30ff4984a6f61f2cedc232dd87d81fa7f2ff3c0ed96c241c"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE94280251A997",
+      "hash": "bedac92e8c3729864e13d4a17048007cfafa79d5deca993a43a90ffe018ef2b8"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9427F9B353E4",
+      "hash": "5fadd012ae6381a6a29ff86a7d39aa873878852f1073fc90b15995961ecfb084"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE9427F2F77DC2",
+      "hash": "08c3e5e0a09c440f49e9a69d8639d37fbec522ec8c5c0ac805243b098e6ea512"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE9427F6775D14",
+      "hash": "e25952e798958b0f9168d044153ccc353f5469ca4b71a1707dffad0534d27017"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE9427EF733685",
+      "hash": "3cf4b769258ed9cc3c2a93268c0d5c1cc3fbd094af8df21035cbac8fb0d7c088"
+    }
+  },
+  "3.0.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE6FF25F78B056",
+      "hash": "db15cc99e6e4837daabab023742aaddc3841ce57f193d11b7c3e06c8003642b2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE6FF25A90279D",
+      "hash": "e032c44d3f7c247bbb2966b41239f88ffba002497a4516358d327ad5693c386f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE6FF2745A020C",
+      "hash": "44e9e44202b67ddfaaf5ea1234f5a265417960c4ae98c5b57c35bc40ba9dd714"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE6FF265833D25",
+      "hash": "d098f3168ae4b3aa70b4ca78947329b953272b487727d1722cb3cb098a1a20ab"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE6FF25CFDD02F",
+      "hash": "4888c898e2901521a6bd4cf4f0383c9465588a6a46ecd2465ad34faf13f09eb7"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE6FF26DA417A7",
+      "hash": "ccd07709a25fd549dc3987eb378c4fecc1d7b851c904a59528cae8144f725c36"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE6FF27042D22A",
+      "hash": "9d108e72249dacb6ef5685320f34efcd0d85b842df90552b8fd7903a39a11c98"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE6FF26AFDC493",
+      "hash": "45ebd52e4cb3c1c5dc0661f76728fa9ee7a510ae211b0cde3c43e4d8bebade86"
+    }
+  },
+  "3.0.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE4FCA2BF218E5",
+      "hash": "10dab2fd2170b5aa0d5c0673a9a2793304960220b314f6a873bf39c2f08287aa"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE4FCA39840E0E",
+      "hash": "4dbafca16d29be06a6a740d517a9f63de67c78be3a64d048e42520401d88facc"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE4FCA28D7404D",
+      "hash": "a3a0dc4e8c745f9bd855ec18db346538b78ab2c4d6d510ae4186bb4a03f35438"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE4FCA1C26496E",
+      "hash": "c12fc6150195758ec0b1aeb1aade3381a1d3a299584982b66543f22bab04535b"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE4FCA3CB7AA05",
+      "hash": "7098c46809c0818d970e63f7acd10f44c6919d3b4a261a63972a60694a9c9f66"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE4FCA2210A074",
+      "hash": "784dc5461a588dd8611e7969a4c988620f08bcb7f173beb77321b7acfc9a2b5f"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE4FCA250DB25B",
+      "hash": "9ec0c4ec477aaed0dbf6d3a294405441b2cc93fff0d23482eba5c2e84af5aba4"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE4FCA35FC9609",
+      "hash": "0516fe2ea7d3c039cb6ed99aefbd86b69d661ff35956484c16fb480c29f3897d"
+    }
+  },
+  "3.0.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE378193840B57",
+      "hash": "052363a0e23e2e7ed53641351b8b420918e7e08f9c1d8a42a3dd3877a78a2e10"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE378184E3D243",
+      "hash": "6c75981e85e081a73f0b4087f58e0ad5fd4712c71b37fa0b6ad774c1f965bafa"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE37818A249E3E",
+      "hash": "2593655025b52b5b1c99e43464459b645a3acbe5d4a5a9f3a766e77beec5a441"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE37819892DC0D",
+      "hash": "81398231362031e3c7afd6a7508c57049460cd7e02736f1ebe89a452102253e5"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE378186BF54D2",
+      "hash": "38349e45a8bb0d1ed3a7affb8bdd2e9d597cee08b6800c395a926b4d9adb84d2"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE37819135D5B6",
+      "hash": "6af9ed378d289ffd1bce9b6de02a47a25f9bf32d01a2f6b0f43f0fbb544f14c6"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE3781829B3B92",
+      "hash": "86bbb2c0da0a80107fbe6d500da4148c3f84fa2595f76db68d4499664da2b90d"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE37818ED171E1",
+      "hash": "e8cda1bb6b6719e46fe72a89789852971a228d364063cc961d065c3cd4e3db4b"
+    }
+  },
+  "3.0.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE082BF53266ED",
+      "hash": "46dbdcb5467a3dfec2526923d0b3365e40c8d9dc00ec23d5aca3437449e8cbfd"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE082BF2D094CE",
+      "hash": "0fc2b6f16b900abdfda3153b11fc435a8cbe3830e8e820fe8ad5fe4149a5b472"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE082C03974CE8",
+      "hash": "7a137280d8686665ceb4d8565df2a0ac63f28031e014cdcae5d56891a6c8a400"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE082C0648458F",
+      "hash": "17fd784737ca54d7d8a343c82da6c5d6dbdee971e66644d923d1b057fb97d7ed"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE082C0064BD15",
+      "hash": "3823b044de184da21e300bc5e20dd29d3fa9243af3ba70c4a5da1712f3385d46"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE082C0B62CF31",
+      "hash": "650aefe9d2bf0ee5282e8e40a7fc93ef6d66ef718a83ac3c3ec06b22b797ff00"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE082C0E28E598",
+      "hash": "0ffd9125ada732d3d3f0f1702fefd8031c04383d070cda895c5df2dfaca6e7b8"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE082BFDC4C845",
+      "hash": "f45331cfa5dfb6f908a5ed4f20f6fda4f31716028d6f0dcff9c775f006d486df"
+    }
+  },
+  "3.0.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE05F22B41933C",
+      "hash": "23c9ff889672f03676b673539de07d5ad4e8efc8247a3ad55c9bc00169aa2305"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE05F23E3EC0F5",
+      "hash": "260c174b80d6401a7d2703109eb32f6a0bdbddd2ac91d3268dc96a51238d96ab"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE05F21CA08FF9",
+      "hash": "21843dbb2e910097531ca23e9f87d0ca2ae9a412e056009eae670b090418e8ed"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE05F232E5B6D9",
+      "hash": "8f5bb6899118d521d7b12252f06d5808fba4e6cb0a23ff120ed6c14d7c87863a"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE05F2419FF210",
+      "hash": "dad2a161d91fba199d1ebae7e5652a4c2dd412cbb1ab6b4cc8ad6a15378319fe"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE05F2278FB689",
+      "hash": "82ed1e2c4b37927fc39c488dd1871f2a51ea40140a8c7911ed90026b8d8bf2cd"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE05F23A221742",
+      "hash": "07b7ce941bf9918bf245153bf029d53873f4f0b1bc5e8f9141876b3523c1de0b"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE05F22438B32A",
+      "hash": "6e30ae5e33014197a888b9492728e49aaf72343e31e26da8f7b3720518e8f6df"
+    }
+  }
+}

manifests/dprint.json

@@ -30,6 +30,32 @@
   "latest": {
     "version": "0.53.2"
   },
+  "0.54.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE95A483BDB8E6",
+      "hash": "859ae94e596105201faa59a3fb4bedc8316e226e3e154ae410f9373461e1e41c"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE95A483D34B85",
+      "hash": "fdbffa16cf0890ca30e958ffdabe7748e733867651a438ede1501f0e1a7b5e91"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE95A483BAAF19",
+      "hash": "3fd881acaf7fd4fbc5d07c3030ce79b965a4cb7128fe0eb1ebe725188ccd2715"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE95A483BBBF52",
+      "hash": "9a66b5931ca30402a3dd2933c432c6b6316eedd08037ab0aeb8d24cd17b2a301"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE95A483BA138A",
+      "hash": "1d6a8fb14d66cba0f049738edd4ab3b1afc1de6d936cd32e483e33284cfd1ade"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE95A483C85B52",
+      "hash": "9aa7df605ade001ada4154e24f2806527d0be45ba0f465422efa62a23316f305"
+    }
+  },
   "0.53": {
     "version": "0.53.2"
   },

manifests/just.json

@@ -22,10 +22,39 @@
   },
   "license_markdown": "[CC0-1.0](https://github.com/casey/just/blob/master/LICENSE)",
   "latest": {
-    "version": "1.48.1"
+    "version": "1.49.0"
   },
   "1": {
-    "version": "1.48.1"
+    "version": "1.49.0"
+  },
+  "1.49": {
+    "version": "1.49.0"
+  },
+  "1.49.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE92D62FFEE2CA",
+      "hash": "05eb2f068b641b06e5b318796c2e27d4dcca608e65b34329a08c1b9f582611bd"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE92D6315E20A9",
+      "hash": "e0b83a9352952ab25e5cf13f6cb03dd1872416e5d89388b56d6ca58f11b0a3a8"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE92D65DAA4399",
+      "hash": "657338772efd17a31d67285bb5ed691da87741e44311c0366273c6cb7d913b15"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE92D633E8329E",
+      "hash": "993b78f51004248114af22368f69715541542b3c9941c80e02f8ae10eb404ae0"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE92D61E96BBDE",
+      "hash": "d21b20df01ec9b9762b0ef08e56ae8dccf3738770edeafa8d2b3a750aee06d78"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE92D65E1C5B47",
+      "hash": "e73cd7b3c4fb363f703f99caaa71d4ab114a92205b2ef313212f3b2085d3ee64"
+    }
   },
   "1.48": {
     "version": "1.48.1"

manifests/martin.json

@@ -37,6 +37,24 @@
   "1": {
     "version": "1.4.0"
   },
+  "1.5.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9606A16881B6",
+      "hash": "29cebebba0bc6bc8cd3f089d4c8e06abecef1a1754b9c816ef4dbf6ae41b6f63"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9606A093D120",
+      "hash": "c50589f9fd2ad018adb3c085b9f31fe73b9b5587949cc04f6ae37c18cd0cc390"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9606A0994946",
+      "hash": "11b9305afc987e71d0edc0a7454d1b3f9a7b42d3b2603870729c21bba924ad20"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9606A08CFAF6",
+      "hash": "c52a2851aae177cfdcd2adf019e391ac4512eaa1566c4f7de3bd4a4746bb60d7"
+    }
+  },
   "1.4": {
     "version": "1.4.0"
   },

manifests/mise.json

@@ -28,13 +28,143 @@
   },
   "license_markdown": "[MIT](https://github.com/jdx/mise/blob/main/LICENSE)",
   "latest": {
-    "version": "2026.4.1"
+    "version": "2026.4.6"
   },
   "2026": {
-    "version": "2026.4.1"
+    "version": "2026.4.6"
   },
   "2026.4": {
-    "version": "2026.4.1"
+    "version": "2026.4.6"
+  },
+  "2026.4.7": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE962B67CA1C09",
+      "hash": "494865907326bb864a31e4ca22bf6ed7572ceedea14ff8e82c783f604551dde3"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE962B6A6B1EA5",
+      "hash": "fdffa9feeba79fd0d87494fa61af0d8b32b9e54c8200d5157a0365302ad531c1"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE962B6B48C5C8",
+      "hash": "86ee64104d1d4202cc2347a325ed22b53fe28462519079b005d95a144de73933"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE962B6482E5D0",
+      "hash": "58040a3fd0d8ac18ce99e7e5ebe79be50d49dc8a5a57f7e48441ab42c083cde0"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE962B698763DB",
+      "hash": "311c41004d74519f97d180f404a623f8945366d9747d3c7b1c545a291d2c168e"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE962B6AD54FFD",
+      "hash": "98ab2597f455e8e114445e30547a89007188cb57a4a2d3211cd7ae159cd2f72a"
+    }
+  },
+  "2026.4.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9505278268D0",
+      "hash": "a99603adb9b185da342a1ff81e93390c42e6a90737086d130e929ddc6af774cc"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE950529B1EF40",
+      "hash": "8c38ef6bdbe87a007d4e428d3974ab4e7b657c5dcf61d288edb69882070e2d0b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE95052A93FE38",
+      "hash": "1ccca1e747e1e5ddf0621b1a19cc02bd33f740542f0c3e5481ffa26062c05d01"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE950524131738",
+      "hash": "bf5877c2ff7fd734f22ab1ed055f557d4bc865a54810fb59c3ebb175b238e6e7"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE95052911F638",
+      "hash": "3f3e5584a9d563b62d07e0422100be5a9f7f56f0fc5555d4f0a17c3661757107"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE95052A84A627",
+      "hash": "a2bb99b42571471a6bc5ff333a50841b3c8965db79e1a79644082cc7c05904a6"
+    }
+  },
+  "2026.4.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE93CF28627B72",
+      "hash": "8fa8eb3f3df6054089c1b8d8ab328927add851216053f83e681374f0cf34e4aa"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE93CF2AE7FEDD",
+      "hash": "a6915b8b25548a1556a3880a3d2f75dd8544ccd67ce49cc70f13661fa4eee24c"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE93CF2BA1F279",
+      "hash": "f379f668f5c51e27fab90a70007d7b5140bbabae1a78be85ef9ddef243c936b6"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE93CF253B2C4C",
+      "hash": "384fe2cf9864b1bd0c91beb65c38a0d59b01c7ce1d82f05bd6ea5136e119a6c2"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE93CF29D221B3",
+      "hash": "e2b3e912ab9405daacb79ac283a99ad5b1a04667ad4c0a69dd7ab406ba0ceba9"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE93CF2B2BC09D",
+      "hash": "0dd01e1e456e79db7de39a135e8d73218841d9489b69560ce9e010141b3f21ae"
+    }
+  },
+  "2026.4.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE92B8CD42D7A7",
+      "hash": "3d746d5a137e63ed88e4e2213a9706a43dff68c995376fabb753a90ec799af18"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE92B8CF701697",
+      "hash": "e3fe092643f3e68c3a2be9eef217937f241accb81891332678550c15224627c0"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE92B8D03C1E31",
+      "hash": "5c879723f693514f6f8f725270724561cd8ebdf913188839ad1f879900bf5719"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE92B8CA044A7E",
+      "hash": "e2da1fd598b4aa347761daf373e51608cbc4465c6b076b60b22cb1ef659cf97e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE92B8CEAE639C",
+      "hash": "22459d2852b716f5dbbdb07173ae0fb28d99b701589f6f6a73d85ac47a497de8"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE92B8D051630C",
+      "hash": "6cada4eeeef1a9cd074962a76fa9a6f107b5b791b01839fc3355d3f3b1604c85"
+    }
+  },
+  "2026.4.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE918787D0FCD3",
+      "hash": "b700ef056f6671a738d824ed5b02b17615b470d6659adf548a49eda1f51bb770"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE91878B96BFCE",
+      "hash": "f7dd16c3ad36e3b631a3f4c85c24be4c2577bfe693858df85bef46aff6f8acec"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE91878C86A1E4",
+      "hash": "a564ed07eb2c41c403a59ac03238d053d0f250aa4e55225dc0456d63bb6589cb"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE91878239E45C",
+      "hash": "1678e69b2fdbc9e0b8eea0c6e091922a1873a3c42e4a87bb13805a4f2613a7b5"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE91878A44E083",
+      "hash": "c00791c18b8e1192685e995fd5b6ba136a19b01d16256a0367155274056a3aa8"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE91878C56793B",
+      "hash": "02a27c60b23c5fb8d894a82af01d2ceb1f2e6d1d14db7463cb6ddb30489b0f5f"
+    }
   },
   "2026.4.1": {
     "x86_64_linux_musl": {

manifests/rclone.json

@@ -36,6 +36,32 @@
   "1.73": {
     "version": "1.73.3"
   },
+  "1.73.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9573A5AC74E7",
+      "hash": "abc0e6e0f275a469d94645f7ef92c7c7673eed20b6558acec5ff48b74641213c"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE957478A87CEE",
+      "hash": "4ef15279d857372f3ff84b967ad68fc1c3b113d631effb9c09a18e40f8a78fa7"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9574B24AE740",
+      "hash": "4ad32977eec7f77aef98c035865c333f2005be2478dd6b04c9456d1df7b326bf"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9573BDB7D24C",
+      "hash": "00c9e230f0004ab5e3b45c00edf7238ba5bff5fc7ea80f5a86a7da5568de6d1c"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9574816FB321",
+      "hash": "8cfffacc3ce732b1960645a2f7d2ce97c2ac9ba4f2221c13af6378c199a078f9"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9574BA07586F",
+      "hash": "db0cbec2eee4e852762d65afc5fe1c06cee5ba246c0ea8b765f4a5cf2aaa009a"
+    }
+  },
   "1.73.3": {
     "x86_64_linux_musl": {
       "etag": "0x8DE892EC705086A",

manifests/shfmt.json

@@ -19,13 +19,35 @@
   },
   "license_markdown": "[BSD-3-Clause](https://github.com/mvdan/sh/blob/master/LICENSE)",
   "latest": {
-    "version": "3.13.0"
+    "version": "3.13.1"
   },
   "3": {
-    "version": "3.13.0"
+    "version": "3.13.1"
   },
   "3.13": {
-    "version": "3.13.0"
+    "version": "3.13.1"
+  },
+  "3.13.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9425968D392A",
+      "hash": "fb096c5d1ac6beabbdbaa2874d025badb03ee07929f0c9ff67563ce8c75398b1"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9425982BD0F0",
+      "hash": "6feedafc72915794163114f512348e2437d080d0047ef8b8fa2ec63b575f12af"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE942594A8E60E",
+      "hash": "60cd368533d0ad73fa86d93d5bbf95ef40587245ce684ed138c1b31557b5fe97"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE942595A9A537",
+      "hash": "32d92acaa5cd8abb29fc49dac123dc412442d5713967819d8af2c29f1b3857c7"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9425979B56CB",
+      "hash": "9680526be4a66ea1ffe988ed08af58e1400fe1e4f4aef5bd88b20bb9b3da33f8"
+    }
   },
   "3.13.0": {
     "x86_64_linux_musl": {

manifests/syft.json

@@ -44,6 +44,40 @@
   "1.42": {
     "version": "1.42.3"
   },
+  "1.42.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE95AFF8B22211",
+      "hash": "590650c2743b83f327d1bf9bec64f6f83b7fec504187bb84f500c862bf8f2a0f"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE95AFF8BA2F4D",
+      "hash": "4a14affad1b90f0bfa38fdb784279f01598b6099df40686391d814620e9de226"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE95AFF8B46965",
+      "hash": "a712f912e8fc83ce2bf6a7cea213c2d5185778d66ea2e07d42c767817f77e381"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE95AFF85E45C7",
+      "hash": "5029bad1ed372649527b1e443cbceef7f5d6ae1cfe52c16e721559f94267128b"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE95AFF7CD5703",
+      "hash": "0797b64cf8841c904682e6007a695f9cd3e72103f064dd286723c0a56a2273e2"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE95AFF8296773",
+      "hash": "6596227b24729d54e727917d5d59e3a6a49fc59cd505aae5a6d7eb630d871e82"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE95AFF78EE682",
+      "hash": "9a54460ae5f6c3484c6f9913187306e4996ba21267e185434783872856dc836d"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE95AFF8AF65FA",
+      "hash": "8b2d019bbed41cc991be32f5c2a630b3dfb8cd76f8c45d815f18c4afd56b280e"
+    }
+  },
   "1.42.3": {
     "x86_64_linux_musl": {
       "etag": "0x8DE85DA2631AC06",

manifests/tombi.json

@@ -22,10 +22,88 @@
   },
   "license_markdown": "[MIT](https://github.com/tombi-toml/tombi/blob/main/LICENSE)",
   "latest": {
-    "version": "0.9.13"
+    "version": "0.9.16"
   },
   "0.9": {
-    "version": "0.9.13"
+    "version": "0.9.16"
+  },
+  "0.9.16": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE95275403B11A",
+      "hash": "93f0b5febc18f60c172a7d4008325183f6b90d3c2a2454e27bbc7aaa662c25de"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE952753DFFD89",
+      "hash": "847a696cf655e642d7402560badde15c6fbb2b34a7e21fa33ba2614d74816a4e"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE952754763D72",
+      "hash": "a08e144e55fa8b998e46bf2923c9d8fae1f454771c6411fd213febd9e182ae48"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE952754627D8A",
+      "hash": "0549ee34fbbaf462ae8b17c41fc30dbfdada8e2adadc058b1f92d6d0070ca70e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE952753D14101",
+      "hash": "4a33dff421e644c03708b26cf73b235f7f146ef6af9ba631b66aa97cb10244ae"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE952753D6E00A",
+      "hash": "1002d0cff2b146eb70d6670e20f8417a31a15a620755ec7b182f35b4f8816f68"
+    }
+  },
+  "0.9.15": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE93A3FAF30C3B",
+      "hash": "5be8b5d8d01044d135d9a08b407ad08ca1a6c7fd2e214eb892442968cdca7cf5"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE93A3FB045DDD",
+      "hash": "3cf44fa8853b08c895d72583303a3fc402a97c933869c517a006f9b72c30819b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE93A3FB001D02",
+      "hash": "6fd8dde2c095ac060c22a1797377c8b30c7e6f6fb56a4a4dde482303e5ec62f0"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE93A3FB846F95",
+      "hash": "ba5b907a945a40aa544ba1519434037018fd88b25d2134882c3e774e4702499a"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE93A3FAF6D883",
+      "hash": "d9235496e896874ab8799b4d7efa9c8dff61962478bce6647dbbb81b1937e822"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE93A3FB6A2752",
+      "hash": "015b47b6d266c49cd6b7d43b4bae82726be6134971dd2232092b020d555b9976"
+    }
+  },
+  "0.9.14": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE91E8D04C6FA6",
+      "hash": "0c6a3141cfa53948bb02148ec48b9cd2afad636b782b6f4770104d306caa8d95"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE91E8D02B514D",
+      "hash": "e7d2adeef03a9b65d280e31ddca75510fe11dcc1864ee443b75a1872b9a47937"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE91E8CF98900F",
+      "hash": "449c28b597c902862d799ad99d67d9de05eb2bb142e6f81e29c25ab95567c3a3"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE91E8CF650FD6",
+      "hash": "983aab4bba3dd9a8aafd4f6e7922f0d687564101199f66d48cd6b670c2c996d6"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE91E8CF5C6701",
+      "hash": "9fc05caf7bf58a37d9a925e2fc1e17d7bf0591120790665bb2142c0076ca3f15"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE91E8CF87B31E",
+      "hash": "70202f4fcdfa081ad928052757cd16bae99b445fd775eaac6b1d0ef8a7265775"
+    }
   },
   "0.9.13": {
     "x86_64_linux_musl": {

manifests/trivy.json

@@ -96,446 +96,5 @@
       "etag": "0x8DE77C6B3B3F88B",
       "hash": "557b9b1ad75e9aa6762f64a338fa7f581f50375e054b946c67361d88b3f762be"
     }
-  },
-  "0.69.1": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DE64B81CF95EEF",
-      "hash": "dd93975bc1e58053810a9bafea89923e5df42ddd3f99905fdf840fd797145157"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DE64B819F91DC6",
-      "hash": "1054f37ba02173a7e1a05e2bcc1179d7573124cea1502a37cc59de89582de307"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DE64B819F13777",
-      "hash": "7a37fafd7a62fef07d4ebe9c5a90bb079e929eac78d691863b013eec14d57eac"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DE64B81CCE12EB",
-      "hash": "7a98c13e6c5799fc46219c94fa500b807532b4555501cce85fa4eead9f755516"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DE64B81B7978AC",
-      "hash": "ae5ce4a7b9bf2bd3794ccb3c257993526fa47470b3814d729a73788d36aff3d0"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DE64B81A1B2572",
-      "hash": "b4314efdb60e19567072586c0ae0120053fa3453ca6f3f93b7002cfb98848759"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DE64B81BB8F941",
-      "hash": "5a813df48a525d0ed5a87c92a49b715bc1142787bb51562fc84156f28c68e9c1"
-    }
-  },
-  "0.69.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DE5FE98E1231FF",
-      "hash": "fff5813d6888fa6f8bd40042a08c4f072b3e65aec9f13dd9ab1d7b26146ad046"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DE5FE98CD6F5A8",
-      "hash": "4264e4fcc73259de36a68c112a586d65bf6cd488ef2aea857f37d00d8cb5c4e6"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DE5FE98CABA986",
-      "hash": "4b34440f0a854428e846b1d2329eede3f0663bec8eff865ae2dffca42542a076"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DE5FE98B60C75A",
-      "hash": "425e883f37cad0b512478df2803f58532e7d235267303375a3d0f97e4790a1ca"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DE5FE98CCAF53A",
-      "hash": "bd35348d963d3f661ff4d7d138e65a75fedbfade0378689f3a349c824c6e5b75"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DE5FE98B58BA1E",
-      "hash": "719963fc7ba3b0c1db69dd39c4410c7e01f4a13d4bf8cbd7085f2f7e7b5cf22c"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DE5FE98B514869",
-      "hash": "f747c09a5b6b401c573d36e9b7bece73c95c685de566f8077c0ddc8adfb718f4"
-    }
-  },
-  "0.68": {
-    "version": "0.68.2"
-  },
-  "0.68.2": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DE3D36FA8B041A",
-      "hash": "3d933bbc3685f95ec15280f620583d05d97ee3affb66944d14481d5d6d567064"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DE3D36F8E8C779",
-      "hash": "c0790530cd717b6bdd02ed437be0710f5c7043078fafaf6841be7c865bf251ce"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DE3D36FBDA4DDA",
-      "hash": "2aaa0ce06f9f2221a6bb21e1fc0e0ecc6aeb56362bc5c9463e9fd7b06983c3c3"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DE3D36FA31D6BE",
-      "hash": "33c87995fd0c3d1559086c3e18fd3148051296dfd0ca2a67583eb64f89998c91"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DE3D36FBE6276F",
-      "hash": "dfbe15ffe47426dad9fd3e0d52aeacf3dbbb25ca5dbc66049f5920834435988d"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DE3D36F8C75B58",
-      "hash": "e8e0391fb23706885371aa26d98bf7d43ed330dda2dce5cd0098444955d3b071"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DE3D36FA754A9D",
-      "hash": "fd45fc808622ecb11393f4c27d1fbd20e1d78838148a282b1129624964dd0628"
-    }
-  },
-  "0.68.1": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DE3251848BE364",
-      "hash": "63e37242088e418651931f891963c19554faa19f0591fe6b40b606152051df2f"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DE3251830BD5BF",
-      "hash": "d5b5bd3b3c3626d223c3981cc40f4709f00a6327a681b588d2fc64a3aa9d02c5"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DE325185F54E47",
-      "hash": "600fc65bdb486e160efeedf8fff8ef6be8e9d2e82f2ea4db82ad23263ed5f902"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DE325182E5186B",
-      "hash": "b29ea550f573afbcae3c86fb2b5e0ebba76b7cb0965e3787c4e8cb884d2c1d57"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DE32518617A3C8",
-      "hash": "4dd3d2e74e1b6f6f7fd5fbf55489727698f586d6a6a0cff3421031a05b80bcac"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DE325182EA1BD7",
-      "hash": "85fad2f54d695044ff4c7cfbf527a339bbba624e248ca78c81b24d3ff505ec36"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DE325184AA45AE",
-      "hash": "5fd10a554ffc2a82bdc0212112352f0641d1ccf46b60f7c3be8b1f6c9e98a291"
-    }
-  },
-  "0.67": {
-    "version": "0.67.2"
-  },
-  "0.67.2": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DE080439A9226F",
-      "hash": "546511a5514afc813c0b72e4abeea2c16a32228a13a1e5114d927c190e76b1f9"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DE08043B0FD1EC",
-      "hash": "4a5b936a8d89b508ecdc6edd65933b6fe3e9a368796cbdf917fd0df393f26542"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DE0804388E4204",
-      "hash": "ad6a7a706902ec3248d8905a32d0c15630958ab3040b8ea0373a6f5a2da30a94"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DE0804398EB34F",
-      "hash": "e4f28390b06cdaaed94f8c49cce2c4c847938b5188aefdeb82453f2e933e57cb"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DE08043AF0386A",
-      "hash": "6b3163667f29fc608a2ed647c1bd42023af5779349286148190a168c5b3f28f1"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DE0804383BC3C5",
-      "hash": "168f8a8009433de6fb82f4119370b873f96dbbe115968899100aff5512204fb7"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DE080439F69D3F",
-      "hash": "82ae68e011861a91adad87efa88d85d9a2f3a35099a531edd255999a36b07428"
-    }
-  },
-  "0.67.1": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DE072A82C7AB42",
-      "hash": "945c004188970dddb634db8bbac332b00f477858918a2026866367268a810678"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DE072A813C381F",
-      "hash": "36001046e4a52885b664b7a5f40da5f0e1883c07a72763dee57c7d5b9676d901"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DE072A8320FFA5",
-      "hash": "f68c6b04c8984766d95413fcb438e6a6e242eadb9d5e9b6ca4d1ba9c84ffa4cb"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DE072A82CFB88B",
-      "hash": "dbc17ea23d75c9f93d3e781468cf0fd82d46e2e772353a4ff9da6d88919a1052"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DE072A81571BFA",
-      "hash": "81e24fd39ddecda180cc9abefaea184e0c22c331d7b683993a9bc89e67d07bb9"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DE072A815A7387",
-      "hash": "3def8ad164495d431eca7643671a5076b12364a7875f7dae53d01b0b179aede0"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DE072A842C87F8",
-      "hash": "ac9c61256a890cf99cca33415fbd7d0931f5489575c4bcf9e6cdde8e22723e84"
-    }
-  },
-  "0.67.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DDFFF9F277E803",
-      "hash": "5b10e9bba00a508b0f3bcb98e78f1039f7eee26b57c9266961a415642a9208ab"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DDFFF9F4297CF7",
-      "hash": "ae8a13d8c3abf7f7e7981ac1a5f5ec094d68835f2aac67da102d4ba36e820c3c"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DDFFF9F465316A",
-      "hash": "cbdc0dea7563da0f1258bedb5c6782dfe762ec8b4377db2629555fbdd7e6425f"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DDFFF9F5C29C5E",
-      "hash": "0f3ac33954dd918cad708bdf06731b4aa8cc14b12e879932b4ceef2f22640a9e"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DDFFF9F2834CFC",
-      "hash": "feea8727b501f654683774fe0f98a9c1a128c7d8bcd7c942a8e6f6d05b33bd4b"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DDFFF9F5DDA710",
-      "hash": "f1a685c309679ff23bca2dd42e017a22d235d0d9dbc0b129d1221590d9e1bc1b"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DDFFF9F4253BFB",
-      "hash": "f4b09750400c4a4ed68b5fe7a744fbe1b0ea14fc797d122119c9fa82ef167165"
-    }
-  },
-  "0.66": {
-    "version": "0.66.0"
-  },
-  "0.66.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DDEA4865EC0918",
-      "hash": "93678741c3223c15120934ac00671ca7e797c9a5a4d89148db9ffca9184a5f0d"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DDEA486A0448AA",
-      "hash": "284a3d3346429837f3da11aa6c25bf196e4fe5431733d4f6f99eac8578b329ed"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DDEA4867FEFF09",
-      "hash": "402d083f7b6b75005bef6dcc75613c41fc09c0ba735bbdbbcce418d7b3250ad6"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DDEA4868075A08",
-      "hash": "a51268845bdeb68f5f885f7de6c92fe33b64d630392e546eec0e16f79cfd42e8"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DDEA4865C5C055",
-      "hash": "964bb69fc0e652891b38514fed4ee31de004a58ac22ea2a23c6891728bb6b6eb"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DDEA486824D2F2",
-      "hash": "dbcf43998bafcd1adae26fc57ea6128f8a1c66da1523096e37fe29c30c68990f"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DDEA4865B3FA0A",
-      "hash": "8d5387862cec090d0f4922b3d2969291774097965649624d0d968e241d53a65e"
-    }
-  },
-  "0.65": {
-    "version": "0.65.0"
-  },
-  "0.65.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DDCFFB2522E989",
-      "hash": "f0c5e3c912e7f5194a0efc85dfd34c94c63c4a4184b2d7b97ec7718661f5ead2"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DDCFFB23C5CCA2",
-      "hash": "b022f86ac91d1c4e79cc548f3e470880a2f8150a369058fbd055bee537aca798"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DDCFFB23CC2E24",
-      "hash": "736ea5990e1a8432624039b0438324b6b7542e94810f9bc83a56f37c56a05b87"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DDCFFB23875C2C",
-      "hash": "013c67e6aff35429cbbc9f38ea030f5a929d128df08f16188af35ca70517330b"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DDCFFB26795759",
-      "hash": "3076e27024b92d634fe09947934d36dc8b651a8539ff1d69b4cfac008dfb59ce"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DDCFFB236CC627",
-      "hash": "6c54d2393322e493bd80ed2a208708fcca1d30e5ae9b0bfcbd3acb1c3212627e"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DDCFFB2546EAE0",
-      "hash": "383c80b9fee80c46d5232da40237fe1886baa76db9275adb5028184bba90adc0"
-    }
-  },
-  "0.64": {
-    "version": "0.64.1"
-  },
-  "0.64.1": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DDBA3D4C6732DE",
-      "hash": "1a09d86667b3885a8783d1877c9abc8061b2b4e9b403941b22cbd82f10d275a8"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DDBA3D4E2ADC31",
-      "hash": "107a874b41c1f0a48849f859b756f500d8be06f2d2b8956a046a97ae38088bf6"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DDBA3D4C6E56C5",
-      "hash": "d03bce6326ff75d041f2499e801357d3da6b08a28be085580d9b0bdf84971d12"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DDBA3D4C3CD009",
-      "hash": "a57d4d48a90f8ed875b821fc3078ba5a8572f86e90adfea0995cefd51d583bd7"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DDBA3D4C4000C5",
-      "hash": "7489c69948cda032adc2862923222917cd025411abc4bba8517a8d581aed226c"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DDBA3D4DECB971",
-      "hash": "98a9d625e614d16fbb6e467777282a0a43ab1505fcc1a77c0b97aafab1d9baf8"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DDBA3D4FB6EB18",
-      "hash": "4a8249d6fc7a9ca80179902923d1988ce4942359cc22c5ee68131b50ebd3a3f7"
-    }
-  },
-  "0.64.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DDB87C74419214",
-      "hash": "e50755b3be29ae515091a45c96a2bc126846334210c30202331b797b9ae6e366"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DDB87C72C4B5BC",
-      "hash": "f7c649c3e9598fde7074bb34b024d11f5b836d230c391a0cdde319db73e0fedc"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DDB87C75CF7247",
-      "hash": "7f34d0cd2813cf7f89064ffbc04af891f7839f673e9a0a0505cf91391d07826e"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DDB87C72D67BFC",
-      "hash": "c7e78d67af98dad178f18b4b8d20929b7f9d267e9c556f8ad815f8997035bcd9"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DDB87C7591EB49",
-      "hash": "77e70dd2fdbac5986cc02a8def382bdaf78777f0050fc37af72916cc47b56a20"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DDB87C7505B2B4",
-      "hash": "13322bad430380ed58d52cafa706dd68127a20dcba5707ecea24ee00b7ad44ba"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DDB87C7452482B",
-      "hash": "a13059cf174a0de9c4790bd11e1626d5529265550637474fe8442755bb73062a"
-    }
-  },
-  "0.63": {
-    "version": "0.63.0"
-  },
-  "0.63.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DD9EDB240EAE38",
-      "hash": "ea91fa393cfcb802da22832c96e99a4c8a295a8ba8faefd824c7168b7f0a741e"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DD9EDB25C39AD1",
-      "hash": "01659b540a885ee9bd1273c8c75ade1ce046fc9d6e5933d5978d9125a6a1cf6c"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DD9EDB25D2CBF6",
-      "hash": "33ba726ec9c37f15490efa1d51044c21f0db6acb9be56492d5e1429f404b602f"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DD9EDB26DF8B6D",
-      "hash": "9aeecf81e8a1dc5625dd96a1a6fbea92a1f8e51c4160cfc0e412ef5f641ea1ac"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DD9EDB26DD1D32",
-      "hash": "784f687759c647ffad54e4d7f55ed953647e4fff5ea1e38dbaf877a135254972"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DD9EDB25608D60",
-      "hash": "f810c4fe9b3cf58022ce034db27780db3e64e91834dda23450407f1e6da13dab"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DD9EDB271FA7BE",
-      "hash": "af14cc441197d862d513926a7610111c8683548efb4c82202bb2d856d4603fc4"
-    }
-  },
-  "0.62": {
-    "version": "0.62.1"
-  },
-  "0.62.1": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DD8CD66B2C973F",
-      "hash": "7da92b2ca503d08eb15e717585fa4ffb95ef2c5dc4c554204882d7d26d386a6a"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DD8CD66B02A920",
-      "hash": "819bf4dad9c3bb4e78bbd11d08b61bdc4663b33777121b3f43372986f7cb3d3e"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DD8CD66CA4E62B",
-      "hash": "f6d9b422f10af2d7a21b4924d36400d8a76932c9159b5feefaa8aee3e45a82bd"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DD8CD669AB51A2",
-      "hash": "50e13c5cdd3e3b610e0dc554e3bc58bc6f58eabe3e42a6b28961a23ac6eff0df"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DD8CD66C735F7B",
-      "hash": "0bbfa581a4139c6fef21f4129233ae6f02a9f4b53039327e62eccd7956af2ba1"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DD8CD66C56CFD2",
-      "hash": "682f1b82e1def454a231f1aef7cadc58cf15aca48b8837caaec49cb41d8b5d2f"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DD8CD66981D82D",
-      "hash": "e36efe2d7b421960fd58e635e77f850e2a9934001c2033dc48431f5727e1b3b5"
-    }
-  },
-  "0.62.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DD880CCF3EE84C",
-      "hash": "1be4420999ffde59b9a6900f2c2481a2f4e50fd2e0ac738ad028944563ee6c60"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DD880CCD4C9C5F",
-      "hash": "8f6d54c7de5c7247bb92b51d29d2542be8006111515ceaf50fe8185adb59ad89"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DD880CCD7359BB",
-      "hash": "b30da5d15587824335cbb88a62585f00a3aac18f3f754d3ad74d68327e2efc46"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DD880CCF085E40",
-      "hash": "82c8acca00390bf5e014b26abb03e24ba754824c4f87ead5564cd56375df07c1"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DD880CCF853F18",
-      "hash": "727a8865c2caf6841a1f4668fd7702f442ae088fd08e3c3719e4f731c1f11333"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DD880CD0DCBCA1",
-      "hash": "fba4b69f5d3a792dc21b93e88c9304329e711eec699dd9b2067dca0297ff92b5"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DD880CCD7DD530",
-      "hash": "a11cbdbb1b72f041f39004610a20a0b7f4b2aad4788dbd735b33b58e58190aca"
-    }
   }
 }

manifests/uv.json

@@ -69,10 +69,124 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT)",
   "latest": {
-    "version": "0.11.3"
+    "version": "0.11.4"
   },
   "0.11": {
-    "version": "0.11.3"
+    "version": "0.11.4"
+  },
+  "0.11.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE963141E5ABBF",
+      "hash": "aa342a53abe42364093506d7704214d2cdca30b916843e520bc67759a5d20132"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE96314155CD4C",
+      "hash": "8e0ed5035eaa28c7c8cd2a46b5b9a05bfff1ef01dbdc090a010eb8fdf193a457"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9631418497F4",
+      "hash": "99aa60edd017a256dbf378f372d1cff3292dbc6696e0ea01716d9158d773ab77"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE96313E817163",
+      "hash": "d14ebd6f200047264152daaf97b8bd36c7885a5033e9e8bba8366cb0049c0d00"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE96313DD22057",
+      "hash": "4b69a4e366ec38cd5f305707de95e12951181c448679a00dce2a78868dfc9f5b"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE96313E396EC1",
+      "hash": "bee7b25a7a999f17291810242b47565c3ef2b9205651a0fd02a086f261a7e167"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE9631407C196A",
+      "hash": "153397d3d82e45e68fb1f4a40ee9898245ec8ed86fd03fcaacaf6e793316acf7"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE963140D2B1B5",
+      "hash": "0e3ead8667b51b07b5fb9d114bcd1914a5fe3159e6959a584dc2f89c6724e123"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE963140E38EA9",
+      "hash": "6e3d4338da2db2c63326721f1eb3b4f32d9bde24aeff11208d397e1aeba8678e"
+    }
+  },
+  "0.11.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE95AE7EB11D35",
+      "hash": "ee8a52743ce3979e52872b49c5e58ffa541048cb95132142bff23fe5608d73ea"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE95AE7DE783E0",
+      "hash": "b8964bed538143f9016d807e421e28f0237a29589851fc79e8159751ac64779a"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE95AE7E0A74F6",
+      "hash": "3fa5b6ea9de9256a035e0471f5ef0bb5d95344659723d6eb063e27c76431515d"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE95AE7B8822B5",
+      "hash": "d73860013061c62d6a89f3370527d4c407214038af331147773ae2fd8f6394c1"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE95AE7A8FE593",
+      "hash": "470993e87503874c7c48861daa308b48a7c367e117235bbecf19368b9fdd35b2"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE95AE7AE8EC23",
+      "hash": "9b9b99a985cccf249225aaad76412823e9d9736d605dc2252151172a7f6ab3db"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE95AE7D14317E",
+      "hash": "c4dabaaa36a13989ab04389263064ca5c27093eb2e7c851ab62d50b6312d9800"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE95AE7D2FD7C9",
+      "hash": "6ae3ec3cf1aab72604bc6aa8486faf4b473066422c49d9c42ea8366ff3039de4"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE95AE7E0B8533",
+      "hash": "1309f1e462462dab2da6a55c37012a228d1c06a55c5b43f8ef901ba1599d9e12"
+    }
+  },
+  "0.11.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9512CAD2F111",
+      "hash": "36ce1c5d8997db9b6a24d0f41646d5509b6d1d8b9448c7325f8248a6ea5d4b00"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9512CA554DA7",
+      "hash": "c326edaf3fd492f53d1c58777f3459c0d87bf9dae8d89e80aec4b0da6622dcf3"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9512CAABBF06",
+      "hash": "26d84455a40b0272b2ab4785cad298ff2c89cd0765b482e9f85b5a1bd880a863"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE9512C842305D",
+      "hash": "a02ec7667d7bb1d33cdb7e1de22f7e4242967e3df7e350bac6212515e3bce8ac"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9512C7959B5C",
+      "hash": "9b9cb6c6f58c3246dbf3351ed4e97c500bc3266f5f237d2fd620b66e1c31dc56"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE9512C7C21EA2",
+      "hash": "708b1c210109e50ff520bcd9b6d29cbd8cee584bb55e84d3d1941bf75ab0893d"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DE9512C9A51354",
+      "hash": "3ddb764538a5dcb4967d7375fde193ce5391e37ddd4d1242012d04cf3848479f"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE9512C9D2A6CB",
+      "hash": "93db93607a824d677c47003ee828936913cfdeb2c871bb34cd79c3ec4481e2b1"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE9512CA14BCB1",
+      "hash": "07361e1fb32e870841a27d3d7b0b20c4a81e0cc25eeb8b9115425bfd227d2d05"
+    }
   },
   "0.11.3": {
     "x86_64_linux_musl": {

manifests/wasm-tools.json

@@ -24,13 +24,35 @@
   },
   "license_markdown": "[Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasm-tools/blob/main/LICENSE-APACHE) OR [Apache-2.0](https://github.com/bytecodealliance/wasm-tools/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/bytecodealliance/wasm-tools/blob/main/LICENSE-MIT)",
   "latest": {
-    "version": "1.246.1"
+    "version": "1.246.2"
   },
   "1": {
-    "version": "1.246.1"
+    "version": "1.246.2"
   },
   "1.246": {
-    "version": "1.246.1"
+    "version": "1.246.2"
+  },
+  "1.246.2": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE91C3E7F1C282",
+      "hash": "f0df9428792225322e9b4344ca581f03b1740d509d6bdad33d14a810009be9ec"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE91C3E7EB3A2E",
+      "hash": "fd89fb34457e7d2f7e221f3971b023674fa1ca5ac650b9685320a3324082ddb6"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE91C3E7FDE9D4",
+      "hash": "1be1934e9a630ff95ab869eba85bba30d652b61b0e6bfb88aac76d0ee3892035"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE91C3E7887ABE",
+      "hash": "cd28f8086297b491d857a5a8118d0de3b910f785d0b465defb4ca4d3826937dc"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE91C3E77F0F87",
+      "hash": "0ff7b4594d6ef643df282f8672ee2af6cec85d006bb83fa9d69c805b8cc6eabf"
+    }
   },
   "1.246.1": {
     "x86_64_linux_gnu": {

tools/ci/tool-list.sh

@@ -8,6 +8,7 @@ cd -- "$(dirname -- "$0")"/../..
 # They don't provide prebuilt binaries for musl or old glibc host.
 # version `GLIBC_2.35' not found
 glibc_pre_2_39_incompat=(
+  cargo-deb
   zizmor
 )
 glibc_pre_2_35_incompat=(
@@ -68,7 +69,7 @@ case "$(uname -s)" in
   Linux)
     host_os=linux
     ldd_version=$(ldd --version 2>&1 || true)
-    if grep -Fq musl <<<"${ldd_version}"; then
+    if [[ "${ldd_version}" == *'musl'* ]]; then
       incompat_tools+=("${musl_incompat[@]}")
     else
       host_glibc_version=$(grep -E "GLIBC|GNU libc" <<<"${ldd_version}" | sed "s/.* //g")
@@ -116,6 +117,9 @@ case "$(uname -s)" in
     if [[ "${runner}" == "ubuntu:14.04" ]]; then
       incompat_tools+=(cyclonedx)
     fi
+    if [[ "${runner}" == "almalinux:10"* ]]; then
+      incompat_tools+=(cargo-deb) # no dpkg in package manager
+    fi
     ;;
   Darwin) host_os=macos ;;
   MINGW* | MSYS* | CYGWIN* | Windows_NT) host_os=windows ;;
@@ -232,4 +236,9 @@ for tool in "${tools[@]}"; do
     2) list+=$' \t ' ;;
   esac
 done
+if [[ "${comma_sep}" == "1" ]]; then
+  case $((RANDOM % 2)) in
+    0) list+=',' ;;
+  esac
+fi
 printf 'tool=%s\n' "${list}"

tools/codegen/Cargo.toml

@@ -8,6 +8,7 @@ install-action-manifest-schema = { path = "../manifest-schema" }
 anyhow = "1"
 flate2 = "1"
 fs-err = "3"
+jiff = { version = "0.2", default-features = false, features = ["std", "serde"] }
 minisign-verify = "0.2"
 ring = "0.17"
 semver = { version = "1", features = ["serde"] }

tools/codegen/base/cargo-deb.json

@@ -0,0 +1,12 @@
+{
+  "repository": "https://github.com/kornelski/cargo-deb",
+  "license_markdown": "[MIT](https://github.com/kornelski/cargo-deb/blob/main/LICENSE)",
+  "tag_prefix": "v",
+  "rust_crate": "${package}",
+  "platform": {
+    "x86_64_linux_gnu": {
+      "asset_name": "${package}_${version}-1_amd64.deb",
+      "bin": "usr/bin/${package}"
+    }
+  }
+}

tools/codegen/base/cargo-xwin.json

@@ -0,0 +1,18 @@
+{
+  "repository": "https://github.com/rust-cross/cargo-xwin",
+  "license_markdown": "[MIT](https://github.com/rust-cross/cargo-xwin/blob/main/LICENSE)",
+  "tag_prefix": "v",
+  "rust_crate": "${package}",
+  "asset_name": "${package}-v${version}.${rust_target}.tar.gz",
+  "version_range": ">= 0.17.4",
+  "platform": {
+    "x86_64_linux_musl": {},
+    "x86_64_macos": {
+      "asset_name": "${package}-v${version}.universal2-apple-darwin.tar.gz"
+    },
+    "x86_64_windows": {
+      "asset_name": "${package}-v${version}.windows-x64.zip"
+    },
+    "aarch64_linux_musl": {}
+  }
+}

tools/codegen/base/coreutils.json

@@ -5,7 +5,7 @@
   "asset_name": "${package}-${version}-${rust_target}.tar.gz",
   "bin": "${package}-${version}-${rust_target}/${package}${exe}",
   "version_range": ">= 0.1.0",
-  "broken": ["0.7.0"],
+  "broken": ["0.7.0", "0.8.0"],
   "platform": {
     "x86_64_linux_musl": {},
     "x86_64_macos": {},

tools/codegen/base/cosign.json

@@ -0,0 +1,34 @@
+{
+  "repository": "https://github.com/sigstore/cosign",
+  "tag_prefix": "v",
+  "version_range": ">= 3.0.0",
+  "signing": {
+    "kind": "custom"
+  },
+  "platform": {
+    "x86_64_linux_musl": {
+      "asset_name": "${package}-linux-amd64"
+    },
+    "x86_64_macos": {
+      "asset_name": "${package}-darwin-amd64"
+    },
+    "x86_64_windows": {
+      "asset_name": "${package}-windows-amd64.exe"
+    },
+    "aarch64_linux_musl": {
+      "asset_name": "${package}-linux-arm64"
+    },
+    "aarch64_macos": {
+      "asset_name": "${package}-darwin-arm64"
+    },
+    "powerpc64le_linux_musl": {
+      "asset_name": "${package}-linux-ppc64le"
+    },
+    "riscv64_linux_musl": {
+      "asset_name": "${package}-linux-riscv64"
+    },
+    "s390x_linux_musl": {
+      "asset_name": "${package}-linux-s390x"
+    }
+  }
+}

tools/codegen/base/knope.json

@@ -1,6 +1,6 @@
 {
   "repository": "https://github.com/knope-dev/knope",
-  "tag_prefix": "knope/v",
+  "tag_prefix": ["knope/v", "v"],
   "rust_crate": "${package}",
   "asset_name": "${package}-${rust_target}.tgz",
   "bin": "${package}-${rust_target}/${package}${exe}",

tools/codegen/base/wash.json

@@ -1,6 +1,6 @@
 {
   "repository": "https://github.com/wasmCloud/wasmCloud",
-  "tag_prefix": "wash-v",
+  "tag_prefix": ["wash-v", "wash-cli-v"],
   "rust_crate": "${package}",
   "asset_name": "${package}-${rust_target}${exe}",
   "signing": {

tools/codegen/src/main.rs

@@ -23,6 +23,8 @@ use install_action_internal_codegen::{
 use serde::de::DeserializeOwned;
 use spdx::expression::{ExprNode, ExpressionReq, Operator};
 
+const DEFAULT_COOLDOWN: u64 = 24;
+
 fn main() {
     let args: Vec<_> = env::args().skip(1).collect();
     if args.is_empty() || args.iter().any(|arg| arg.starts_with('-')) {
@@ -52,13 +54,14 @@ fn main() {
     base_info.validate();
     let repo = base_info
         .repository
-        .strip_prefix("https://github.com/")
+        .strip_prefix(GITHUB_START)
         .context("repository must start with https://github.com/")
         .unwrap();
 
     eprintln!("downloading metadata from {GITHUB_API_START}repos/{repo}");
     let repo_info: github::RepoMetadata = download_json(&format!("{GITHUB_API_START}repos/{repo}"));
 
+    let before = jiff::Timestamp::now() - Duration::from_hours(DEFAULT_COOLDOWN);
     eprintln!("downloading releases from {GITHUB_API_START}repos/{repo}/releases");
     let mut releases: github::Releases = vec![];
     // GitHub API returns up to 100 results at a time. If the number of releases
@@ -69,7 +72,7 @@ fn main() {
             "{GITHUB_API_START}repos/{repo}/releases?per_page={per_page}&page={page}"
         ));
         // If version_req is latest, it is usually sufficient to look at the latest 100 releases.
-        if r.len() < per_page || version_req.is_some_and(|req| req == "latest") {
+        if r.len() < per_page {
             releases.append(&mut r);
             break;
         }
@@ -146,12 +149,19 @@ fn main() {
         match serde_json::from_slice(&fs::read(manifest_path).unwrap()) {
             Ok(m) => {
                 manifests = m;
-                for (k, manifest) in &mut manifests.map {
+                manifests.map.retain(|v, m| match v.0.to_semver() {
-                    let ManifestRef::Real(manifest) = manifest else {
+                    Some(v) => releases.contains_key(&Reverse(v.clone())),
-                        continue;
+                    None => {
-                    };
+                        let ManifestRef::Ref { version } = m else { unreachable!() };
-                    let version = &*k.0.to_string();
+                        releases.contains_key(&Reverse(version.to_semver().unwrap()))
-                    if let Some(template) = &manifests.template {
+                    }
+                });
+                if let Some(template) = &manifests.template {
+                    for (k, manifest) in &mut manifests.map {
+                        let ManifestRef::Real(manifest) = manifest else {
+                            continue;
+                        };
+                        let version = &*k.0.to_string();
                         #[allow(clippy::literal_string_with_formatting_args)]
                         for (platform, d) in &mut manifest.download_info {
                             let template = &template.download_info[platform];
@@ -375,6 +385,58 @@ fn main() {
                             );
                             eprintln!("done");
                         }
+                        "cosign" => {
+                            let [checksum, bundle] =
+                                ["cosign_checksums.txt", "cosign_checksums.txt.sigstore.json"].map(
+                                    |f| {
+                                        let asset = release
+                                            .assets
+                                            .iter()
+                                            .find(|asset| asset.name.ends_with(f))
+                                            .unwrap();
+                                        let download_cache =
+                                            download_cache_dir.join(format!("{version}-{f}"));
+                                        let url = &asset.browser_download_url;
+                                        eprint!(
+                                            "downloading {url} for signature verification ... "
+                                        );
+                                        if download_cache.is_file() {
+                                            eprintln!("already downloaded");
+                                        } else {
+                                            download_to_buf(url, &mut buf);
+                                            eprintln!("download complete");
+                                            fs::write(&download_cache, &buf).unwrap();
+                                            buf.clear();
+                                        }
+                                        download_cache
+                                    },
+                                );
+                            eprint!("verifying checksum file for {package}@{version} ... ");
+                            cmd!(
+                                "cosign",
+                                "verify-blob",
+                                &checksum,
+                                "--bundle",
+                                bundle,
+                                "--certificate-identity",
+                                "keyless@projectsigstore.iam.gserviceaccount.com",
+                                "--certificate-oidc-issuer",
+                                "https://accounts.google.com"
+                            )
+                            .run()
+                            .unwrap();
+                            verified_checksum = Some(
+                                fs::read_to_string(checksum)
+                                    .unwrap()
+                                    .lines()
+                                    .filter_map(|l| l.split_once("  "))
+                                    .map(|(h, f)| {
+                                        (f.trim_ascii().to_owned(), h.trim_ascii().to_owned())
+                                    })
+                                    .collect(),
+                            );
+                            eprintln!("done");
+                        }
                         "syft" => {
                             // Refs: https://oss.anchore.com/docs/installation/verification/
                             let [checksum, certificate, signature] =
@@ -562,10 +624,7 @@ fn main() {
                             );
                         };
                         let url = url.clone() + ".sig";
-                        let sig_download_cache = &download_cache.with_extension(format!(
+                        let sig_download_cache = &download_cache.with_added_extension("sig");
-                            "{}.sig",
-                            download_cache.extension().unwrap_or_default().to_str().unwrap()
-                        ));
                         eprint!("downloading {url} for signature validation ... ");
                         let sig = if sig_download_cache.is_file() {
                             eprintln!("already downloaded");
@@ -765,17 +824,20 @@ fn main() {
     } else if !semver_versions.is_empty() {
         let mut prev_version = semver_versions.iter().next().unwrap();
         for version in &semver_versions {
+            if releases[&Reverse(version.clone())].1.published_at > before {
+                continue; // Exclude very recently released version from candidate for latest and omitted versions.
+            }
             if let Some(crates_io_info) = &crates_io_info {
                 if let Some(v) = crates_io_info.versions.iter().find(|v| v.num == *version) {
                     if v.yanked {
-                        continue; // Exclude yanked version from candidate for "latest".
+                        continue; // Exclude yanked version from candidate for latest and omitted versions.
                     }
                 } else {
-                    continue; // Exclude version not released on crates.io from candidate for "latest".
+                    continue; // Exclude version not released on crates.io from candidate for latest and omitted versions.
                 }
             }
             if base_info.broken.contains(version) {
-                continue; // Exclude version marked as broken from candidate for "latest".
+                continue; // Exclude version marked as broken from candidate for latest and omitted versions.
             }
             if !(version.major == 0 && version.minor == 0) {
                 manifests.map.insert(
@@ -961,6 +1023,7 @@ struct GitHubTokens {
     // https://github.com/*/*/releases/download/
     other: RwLock<Option<String>>,
 }
+const GITHUB_START: &str = "https://github.com/";
 const GITHUB_API_START: &str = "https://api.github.com/";
 const GITHUB_RAW_START: &str = "https://raw.githubusercontent.com/";
 impl GitHubTokens {
@@ -969,7 +1032,7 @@ impl GitHubTokens {
             self.raw.read().unwrap().clone()
         } else if url.starts_with(GITHUB_API_START) {
             self.api.read().unwrap().clone()
-        } else if url.starts_with("https://github.com/") {
+        } else if url.starts_with(GITHUB_START) {
             self.other.read().unwrap().clone()
         } else {
             None
@@ -980,7 +1043,7 @@ impl GitHubTokens {
             *self.raw.write().unwrap() = None;
         } else if url.starts_with(GITHUB_API_START) {
             *self.api.write().unwrap() = None;
-        } else if url.starts_with("https://github.com/") {
+        } else if url.starts_with(GITHUB_START) {
             *self.other.write().unwrap() = None;
         }
     }
@@ -1241,6 +1304,7 @@ mod github {
     pub(crate) struct Release {
         pub(crate) tag_name: String,
         pub(crate) prerelease: bool,
+        pub(crate) published_at: jiff::Timestamp,
         pub(crate) assets: Vec<ReleaseAsset>,
     }
 

tools/manifest.sh

@@ -11,11 +11,6 @@ cd -- "$(dirname -- "$0")"/..
 #    ./tools/manifest.sh [PACKAGE [VERSION_REQ]]
 #    ./tools/manifest.sh full
 
-if [[ -n "${GITHUB_ACTIONS:-}" ]] && ! type -P cosign; then
-  go install github.com/sigstore/cosign/v3/cmd/cosign@latest
-  sudo mv -- ~/go/bin/cosign /usr/local/bin
-fi
-
 if [[ $# -eq 1 ]] && [[ "$1" == "full" ]]; then
   for manifest in tools/codegen/base/*.json; do
     package="${manifest##*/}"