[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
jdx/packslip	action	minor	v1.10.1 → v1.11.0	v1.11.2 (+1)

---

Release Notes

jdx/packslip

v1.11.0: : Repository-bound signer checks for GitHub and GitLab projects, install fallback, and empty release lists

Compare Source

packslip 1.11.0 makes every verifier in the repository (the CLI, the npm package, and the committable verifier) require a github.com or gitlab.com project to be signed from its own repository. It also makes packslip install fall back to older releases, warn about withdrawn installs, and stop raising some unnecessary trust-change prompts. The format stays at release/v1: the specification changes clarify existing rules, write down how the reference implementations already behave, and settle one conflict between icon rules. No change requires a new format version.

Security

• Identity flags now narrow a forge project's signer policy instead of replacing it (#​256, @​jdx). packslip verify derives a signer policy from a GitHub or GitLab project's name. Before this release, --issuer, --identity, or --identity-prefix replaced that policy. As a result, passing only GitHub Actions' OIDC issuer to --issuer accepted a bundle claiming github.com/owner/tool that any GitHub repository had signed. Now the certificate must also tie the signer to the project's repository. A reusable workflow from another repository still passes when the project's own run called it. Projects on other hosts are unaffected: for them, the flags are still the whole policy.
• New verify --allow-other-repository accepts a document signed outside the project's repository on purpose, such as a repackager's. You must also pass --issuer and name the signer with --identity, --identity-prefix, or --source-repository. The option is refused with --pubkey.

  packslip verify packslip.sigstore.json \
    --issuer "$GITHUB_OIDC_ISSUER" \
    --identity-prefix "$REPACKAGER_WORKFLOW_PREFIX" \
    --allow-other-repository

  The jdx/packslip/releases action gains an allow-other-repository input (default false). It passes the flag automatically when project names a repository other than the one running the action, as with a registry's list.
• The committable verifier (verifier/packslip-verify.mjs) applies the same repository rule to a github.com or gitlab.com --project (#​258, @​jdx). It also checks the statement's own identity block against the certificate. New failure codes are project-signer and declared-identity, and it has the same --allow-other-repository opt-out (allowOtherRepository in the module). Projects that copied the file must copy the new version to get these checks.
• The packslip npm package now validates statements and declared signers (#​259, @​jdx). verifyRelease validates the statement against the release/v1 rules, which previously let through 14 of 15 conformance reject cases. It checks that predicate.identity names the actual signer and binds a github.com or gitlab.com project to its repository. It throws the new StatementError, DeclaredIdentityError, and ProjectSignerError, and adds the optional allowOtherRepository.
• packslip install now holds a keyless domain project to the repository that first signed it (#​278, @​jdx). Previously, a project named after its host, such as packslip.dev, was matched only by the signer's workflow URL. That let a repository recreated under the old name, or another repository calling the workflow as a reusable workflow, continue as the signer without a prompt. Install now remembers the certificate's repository ID and treats a different or missing ID as a changed signer that needs --accept-trust-change.

Added

• packslip install falls back to older releases when the latest release has no packslip for this tool or no artifact for this host or --variant (#​263, @​jdx). This covers cases such as a monorepo sibling's release whose tag also names this tool's version. Each skipped release produces a warning, for example warning: skipped 3.0.0, GitHub's latest release: its release carries no packslip for github.com/owner/tool. Requests for a version, prefix, or range skip only releases without the tool's packslip. An exact tag tries only that release. Install never falls back after a verification or trust failure, and it stops after 32 fetched bundles and asks for --version. Library users get new discovery APIs: Github::candidates, candidates_with_latest, Candidates, Skipped, and no_packslip.
• packslip install warns when your installed release has been withdrawn in the project's signed release list (#​276, @​jdx). The warning gives the publisher's reason and says whether this run installed a different release:

  warning: the mytool.example.com 1.0.0 you installed was withdrawn in its signed release list: CVE-2026-1234; this run installed 1.1.0 instead
  

• Release lists may be empty (#​266, @​jdx). packslip releases without --release writes a list with no releases, and verify and install accept it. A GitHub project can use one to retire every withdrawal, security mark, tag mapping, and latest that earlier lists carried. The releases action still refuses an empty bundle directory.
• GitHub and GitLab repository names match in any case (#​265, @​jdx), as those forges treat them. For example, install jqlang/JQ now finds jq's jq-1.7.1 tags, and an identity prefix spelled JDX/HK matches a certificate from jdx/hk. Monorepo subpaths, workflow paths and refs, and names on other hosts still compare exactly. Repository IDs still pin identity. A pins.d file with two entries for one project that differ only in case is refused.
• Documented variant spellings for soft-float and CPU-level builds, plus Go helpers (#​277, @​jdx). softfloat marks a soft-float 386, ARM, or MIPS build. A CPU level above the platform default uses the toolchain's name, such as v3 or v8.2-lse. The Go module adds VariantFromGo and VariantFromRustABI:

  packslip.VariantFromGo("amd64", "v3")        // "v3"
  packslip.VariantFromRustABI("gnueabi")       // "softfloat"

Fixed

• packslip verify and packslip pin without trust flags accept a release signed through another repository's reusable workflow, as install has since 1.7.0 (#​257, @​jdx). For example, mkghtag 0.1.14-10 is signed through suzuki-shunsuke/go-release-workflow. It installed but failed verify and pin; it now passes both.

• install no longer asks for --accept-trust-change when a release retires a build, retires a format, or renames a command (#​262, @​jdx). Provenance links are now compared only for builds that both releases offer. A shared build that loses links still triggers a prompt.

• --version 1.2.3 now selects a release versioned 1.2.3+build.5 (#​264, @​jdx). Tag parsing also tries every allowed prefix in order, so tool-suite-1.2.0 names 1.2.0 for github.com/acme/tool-suite/tool. A tag that a signed list maps to another version no longer also offers the version derived from the tag.

• packslip create writes published_at in UTC when given another offset (#​267, @​jdx). packslip releases and the Go library also write their timestamps in UTC with Z. Consumers still accept any RFC 3339 offset.

• packslip create refuses an os_min or glibc_min that is not a version number, such as glibc-2.31 (#​268, @​jdx). The Go publisher's Build refuses it too. Already-published packslips with such values still verify.

• Icon resources at several hicolor sizes are all selected (#​270, @​jdx). Previously, a more specific entry hid the others. The hicolor size directory is now part of an icon's identity.

• Malformed statements are refused consistently (#​260, @​jdx). The CLI and Rust library now refuse three shapes that the Go module and npm package already refused:

  • an object written as an array of its field values
  • a bin entry with an empty command name, such as the path "tool/"
  • a sigstore-oidc identity with an empty key_id or a missing or empty issuer

  Statements that don't fit the model now report statement is not well-formed instead of "not valid JSON".

• packslip install calls the ps1_… value a "signer fingerprint" in its output and errors (#​271, @​jdx), matching packslip pin and --pin. Success output now prints Signer fingerprint: instead of Signer pin:. Install also no longer panics if stdout is closed after an install.

Specification

These changes to the release/v1 specification add no format version.

• Consumers must refuse a statement whose identity does not name the actual signer. issuer is required for sigstore-oidc. A sigstore-key key_id is the minisign key ID. A signed list and its releases are pinned separately. Every no-downgrade case can be approved by a person (#​261, #​260, @​jdx).
• GitLab is verify-only: version 1 defines no discovery for gitlab.com (#​269, @​jdx). identity.scheme, attested_by, and releases[].status are closed vocabularies. A trailing .exe is dropped from command names in every consumer. Where a conformance vector contradicts the text, the text governs.
• New rules cover requests matching build metadata, the tag-prefix search order, case-insensitive forge names and the project-name grammar, the min grammar, provenance comparison per build, and hicolor icon identity. These are described in the items above.

Documentation

• The specification, guides, CLI help, man pages, README, and the bundled agent skill were rewritten around publishing, installing, and verifying (#​280, #​281, #​282, #​283, #​284, @​jdx). packslip.dev gains a generated reference for the GitHub Action's inputs and outputs at /docs/actions/, and old spec section links still resolve (#​279, @​jdx).

Breaking Changes

This is a 1.x security release. Releases signed from the project's own repository verify as before. The following cases need action:

• verify with identity flags on a document signed from another repository now fails with ... must be signed from its repository .... To accept that signer, pass --issuer with --identity, --identity-prefix, or --source-repository, and add --allow-other-repository.
• verify with no flags on a release that another repository's run signed through the project's reusable workflow now fails, as install already did. Name the signer as above and add --allow-other-repository.
• The releases action in a project's own repository with bundles signed in another repository: set allow-other-repository: true.
• npm verifyRelease and the committable verifier now refuse invalid statements, statements whose declared signer does not match, and forge projects signed elsewhere. For a repackager's release, pass allowOtherRepository: true or --allow-other-repository along with a project.
• Empty release lists are refused by packslip 1.10.1 and earlier. If your users may still run those versions, keep at least one entry in the list until they upgrade.
• Downgrading packslip after a keyless domain install: once 1.11.0 records a repository ID for a domain project, 1.10.1 and earlier refuse that project. Upgrade the older binary or clear that project's remembered trust state.
• Scripts that match output text should check for Signer fingerprint:, statement is not well-formed, and the new must be signed from its repository message.

Full Changelog: jdx/packslip@v1.10.1...v1.11.0

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • Only on Thursday (* * * * 4)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

This PR does not match any of the 1 configured review trigger rule.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: eff07681-cf53-4fb0-87af-371aa5df041b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}