parse-dockerfile

Closes #1827

.deny.toml

@@ -1,6 +1,9 @@
 # https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
 [advisories]
+unused-ignored-advisory = "deny"
 yanked = "deny"
+unmaintained = "none"
+unsound = "all"
 git-fetch-with-cli = true
 ignore = [
 ]
@@ -17,8 +20,10 @@ build.include-workspace = false # covered by tools/tidy.sh
 build.include-archives = true
 build.allow-build-scripts = [
     { name = "proc-macro2" }, # via serde_derive
+    { name = "quote" }, # via serde_derive
     { name = "semver" },
-    { name = "serde" },
+    { name = "serde_core" },
+    { name = "serde" }, # https://github.com/serde-rs/serde/issues/2972
 ]
 build.bypass = [
 ]
@@ -26,6 +31,7 @@ build.bypass = [
 # https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
 [licenses]
 unused-allowed-license = "deny"
+unused-license-exception = "deny"
 private.ignore = true
 allow = [
     "Apache-2.0",
@@ -35,6 +41,7 @@ allow = [
 
 # https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
 [sources]
+unused-allowed-source = "deny"
 unknown-registry = "deny"
 unknown-git = "deny"
 allow-git = [

.editorconfig

@@ -11,7 +11,7 @@ indent_style = space
 insert_final_newline = true
 trim_trailing_whitespace = true
 
-[*.{css,html,json,md,rb,sh,yml,yaml}]
+[*.{css,html,json,md,rb,ps1,sh,yml,yaml}]
 indent_size = 2
 
 [*.{js,yml,yaml}]

.github/.cspell/project-dictionary.txt

@@ -1,35 +1,47 @@
 almalinux
 archlinux
 binstall
+callgrind
+CDPATH
 coreutils
+covgate
 cyclonedx
 cygdrive
+deadlinks
 deepsource
-distro
 doas
 enablerepo
 epel
 espup
 fastestmirror
 grcov
+gungraun
+insta
 knope
+LASTEXITCODE
+libicu
 linkcheck
 mdbook
 microdnf
+minisig
 mirrorlist
 nextest
 pluginconf
-protoc
+ppcle
-pwsh
+prek
 quickinstall
-rclone
+rdme
 rootfs
 sccache
+SHASUMS
+sigstore
+startswith
 syft
+tombi
 udeps
+USERPROFILE
 wasmtime
 watchexec
-worktree
 xbuild
 xscale
-zizmor
+xwin

.github/.cspell/rust-dependencies.txt

@@ -1,5 +1,5 @@
-// This file is @generated by tidy.sh.
+# This file is @generated by tidy.sh.
-// It is not intended for manual editing.
+# It is not intended for manual editing.
 
 flate
 minisign

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: true

.github/ISSUE_TEMPLATE/new_tool.yml

@@ -0,0 +1,46 @@
+name: New tool suggestion
+description: Suggest support for a new tool
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for a new tool suggestion!
+
+        Normally, you don't need to open an issue to request support for a new tool.
+        Instead, please submit a pull request.
+        (See [DEVELOPMENT.md](https://github.com/taiki-e/install-action/blob/main/DEVELOPMENT.md) for how to add support for a new tool.)
+
+        That said, if you have any questions before getting started, or if you’re unable to contribute for any reason, feel free to open an issue.
+  - type: input
+    id: name
+    attributes:
+      label: Tool name
+    validations:
+      required: true
+  - type: dropdown
+    id: pre-built
+    attributes:
+      label: Are official pre-built binaries provided?
+      description: |
+        If "No", this issue will be blocked until official pre-built binaries are provided.<br>
+        If "Unknown", this issue will be blocked until it is determined that it is provided.<br>
+        (When the tool is a Rust crate, it may already be available via fallback even if "No" or "Unknown".)<br>
+      options:
+        - 'Yes'
+        - 'No'
+        - Unknown
+      default: 2
+    validations:
+      required: true
+  - type: input
+    id: url
+    attributes:
+      label: Website or repository link
+    validations:
+      required: true
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Any additional context that you believe may be relevant.

.github/dependabot.yml

@@ -3,7 +3,9 @@ updates:
   - package-ecosystem: cargo
     directory: /
     schedule:
-      interval: daily
+      interval: weekly
+    cooldown:
+      default-days: 14 # Note: Unless dependencies are pinned/locked, the effect is limited.
     commit-message:
       prefix: ''
     ignore:
@@ -13,7 +15,13 @@ updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: daily
+      interval: monthly
+    cooldown:
+      default-days: 14
     commit-message:
       prefix: ''
     labels: []
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/ci.yml

@@ -1,7 +1,6 @@
 name: CI
 
-permissions:
+permissions: {}
-  contents: read
 
 on:
   pull_request:
@@ -11,7 +10,7 @@ on:
       - dev
       - ci-*
   schedule:
-    - cron: '0 0 * * *'
+    - cron: '0 2 * * *'
   workflow_dispatch:
 
 env:
@@ -33,25 +32,22 @@ concurrency:
 
 jobs:
   miri:
-    uses: taiki-e/github-actions/.github/workflows/miri.yml@main
+    uses: taiki-e/github-actions/.github/workflows/miri.yml@931686d4e4cf88b13e790040727ccde2dba8ec62 # main
     with:
       # NB: sync with test job's --exclude option
       args: --exclude install-action-internal-codegen
   msrv:
-    uses: taiki-e/github-actions/.github/workflows/msrv.yml@main
+    uses: taiki-e/github-actions/.github/workflows/msrv.yml@931686d4e4cf88b13e790040727ccde2dba8ec62 # main
   test-manifest-schema:
-    uses: taiki-e/github-actions/.github/workflows/test.yml@main
+    uses: taiki-e/github-actions/.github/workflows/test.yml@931686d4e4cf88b13e790040727ccde2dba8ec62 # main
     with:
       # NB: sync with miri job's --exclude option
       test-args: --exclude install-action-internal-codegen
       no-std: false
   tidy:
-    uses: taiki-e/github-actions/.github/workflows/tidy.yml@main
+    uses: taiki-e/github-actions/.github/workflows/tidy.yml@931686d4e4cf88b13e790040727ccde2dba8ec62 # main
     permissions:
-      contents: read
+      security-events: write # for github/codeql-action/*
-      pull-requests: write # for gh pr edit --add-assignee
-      repository-projects: read # for gh pr edit --add-assignee
-    secrets: inherit
 
   test:
     strategy:
@@ -63,15 +59,17 @@ jobs:
           - os: ubuntu-22.04-arm
           - os: ubuntu-24.04
           - os: ubuntu-24.04-arm
+          - os: ubuntu-slim
           - os: ubuntu-22.04
             tool: major.minor.patch
           - os: ubuntu-22.04
             tool: major.minor
           - os: ubuntu-22.04
             tool: major
-          - os: macos-13
           - os: macos-14
           - os: macos-15
+          - os: macos-15-intel
+          - os: macos-26
           - os: windows-2022
           - os: windows-2022
             bash: msys64
@@ -82,6 +80,7 @@ jobs:
             bash: msys64
           - os: windows-2025
             bash: cygwin
+          - os: windows-11-arm
           - os: windows-2022
             tool: major.minor.patch
           - os: windows-2022
@@ -91,12 +90,16 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
       - run: rm -- Cargo.toml
       - name: Generate tool list
         id: tool-list
-        run: tools/ci/tool-list.sh "${{ matrix.tool }}" "${{ matrix.os }}" "${{ matrix.bash }}" >>"${GITHUB_OUTPUT}"
+        run: tools/ci/tool-list.sh "${TOOL}" "${OS}" "${BASH}" >>"${GITHUB_OUTPUT}"
+        env:
+          TOOL: ${{ matrix.tool }}
+          OS: ${{ matrix.os }}
+          BASH: ${{ matrix.bash }}
       - run: |
           printf '%s\n' 'C:\msys64\mingw32\bin' >>"${GITHUB_PATH}"
           printf '%s\n' 'C:\msys64\usr\bin' >>"${GITHUB_PATH}"
@@ -110,36 +113,94 @@ jobs:
       - uses: ./
         with:
           tool: ${{ steps.tool-list.outputs.tool }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       # Test all shells listed in https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
       - name: Test bash
-        run: just --version && shfmt --version && protoc --version
+        run: just --version && shfmt --version && protoc --version && rustc --version && cargo --version && rustup --version
         shell: bash
       - name: Test sh
-        run: just --version && shfmt --version && protoc --version
+        run: just --version && shfmt --version && protoc --version && rustc --version && cargo --version && rustup --version
         shell: sh
         if: startsWith(matrix.os, 'ubuntu') || startsWith(matrix.os, 'macos')
       - name: Test pwsh
-        run: just --version; shfmt --version; protoc --version
+        run: just --version; shfmt --version; protoc --version; rustc --version; cargo --version; rustup --version
         shell: pwsh
+        if: matrix.os != 'ubuntu-slim'
       - name: Test powershell
-        run: just --version; shfmt --version; protoc --version
+        run: just --version; shfmt --version; protoc --version; rustc --version; cargo --version; rustup --version
         shell: powershell
         if: startsWith(matrix.os, 'windows')
       - name: Test cmd
-        run: just --version & shfmt --version & protoc --version
+        run: just --version & shfmt --version & protoc --version & rustc --version & cargo --version & rustup --version
-        shell: cmd
+        shell: cmd # zizmor: ignore[misfeature] used for compatibility testing
         if: startsWith(matrix.os, 'windows')
       # We use the version output to check the version of cargo-binstall, but they
       # several times change the version output format in the past so we need to
       # check it with CI. (e.g., 0.14.0->0.16.0 update change it
       # from "cargo-binstall <version>" to "<version>")
       - run: |
-          if [[ "$(cargo binstall -V)" != "$(jq -r '.latest.version' manifests/cargo-binstall.json)" ]]; then
+          if [[ "$(cargo-binstall binstall -V)" != "$(jq -r '.latest.version' manifests/cargo-binstall.json)" ]]; then
             exit 1
           fi
-        if: matrix.bash != 'cygwin'
+        if: matrix.bash != 'cygwin' && matrix.os != 'windows-11-arm'
+
+  test-alias:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
+      - run: rm -- Cargo.toml
+      - run: env
+      - uses: ./
+        with:
+          # NB: Update alias list in tools/ci/release-post-commit.sh, case for aliases in main.sh,
+          # and match for alias for tools/codegen/src/tools-markdown.rs.
+          tool: |
+            nextest
+            taplo-cli
+            typos-cli
+            wasm-bindgen-cli
+            wasmtime-cli
+      - name: Test bash
+        run: cargo-nextest nextest --version && taplo --version
+        shell: bash
+      - name: Test sh
+        run: cargo-nextest nextest --version && taplo --version
+        shell: sh
+
+  test-fallback:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - fallback: none
+          - fallback: cargo-install
+          - fallback: cargo-binstall
+          - fallback: cargo-binstall
+            version: 0.3
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 60
+    steps:
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
+      - run: rm -- Cargo.toml
+      - run: env
+      - uses: ./
+        id: install
+        continue-on-error: ${{ matrix.fallback == 'none' }}
+        with:
+          tool: parse-changelog@${{ matrix.version || '0.4.6' }}
+          fallback: ${{ matrix.fallback }}
+      - run: exit 1
+        if: matrix.fallback == 'none' && steps.install.outcome != 'failure'
+      - name: Test bash
+        run: parse-changelog --version
+        shell: bash
+        if: matrix.fallback != 'none'
+      - name: Test sh
+        run: parse-changelog --version
+        shell: sh
+        if: matrix.fallback != 'none'
 
   test-container:
     strategy:
@@ -153,61 +214,96 @@ jobs:
           - ubuntu:20.04 # glibc 2.31
           - ubuntu:22.04 # glibc 2.35
           - ubuntu:24.04 # glibc 2.39
+          - ubuntu:26.04 # glibc 2.42
+          - ubuntu:rolling
           - debian:9-slim # glibc 2.24
           - debian:10-slim # glibc 2.28
           - debian:11-slim # glibc 2.31
           - debian:12-slim # glibc 2.36
+          - debian:13-slim # glibc 2.41
+          - debian:testing
           - fedora:latest # glibc 2.39 (as of fedora 40)
           - almalinux:8 # glibc 2.28
           - almalinux:8-minimal # glibc 2.28
           - almalinux:9 # glibc 2.34
           - almalinux:9-minimal # glibc 2.34
+          - almalinux:10 # glibc 2.39
+          - almalinux:10-minimal # glibc 2.39
           - centos:6 # glibc 2.12
           - centos:7 # glibc 2.17
           - opensuse/leap:latest # glibc 2.38 (as of leap 15.6)
           - opensuse/tumbleweed:latest # glibc 2.39 (as of 2024-07-19)
-          - archlinux:latest # glibc 2.39 (as of 2024-07-19)
+          # - archlinux:latest # glibc 2.39 (as of 2024-07-19)
-          - alpine:latest # musl 1.2.5 (as of alpine 3.20)
+          - alpine:3.2 # musl 1.1.11
+          - alpine:3.14 # musl 1.2.2
+          - alpine:3.15 # musl 1.2.2
+          - alpine:3.16 # musl 1.2.3
+          - alpine:3.17 # musl 1.2.3
+          - alpine:3.18 # musl 1.2.4
+          - alpine:3.19 # musl 1.2.4
+          - alpine:3.20 # musl 1.2.5
+          - alpine:3.21 # musl 1.2.5
+          - alpine:3.22 # musl 1.2.5
+          - alpine:3.23 # musl 1.2.5
           # - openwrt/rootfs:x86-64-openwrt-24.10 # musl 1.2.5
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     container: ${{ matrix.container }}
     steps:
       - name: Install requirements (old debian)
         run: |
           # In Debian, the old repositories is removed from the main mirrors some time after EoL.
+          codename=$(grep -E '^VERSION_CODENAME=' /etc/os-release | cut -d= -f2)
           sed -i /etc/apt/sources.list -e 's/deb.debian.org/archive.debian.org/g' \
             -e 's|security.debian.org|archive.debian.org/|g' \
-            -e '/stretch-updates/d'
+            -e "/${codename}-updates/d"
-        if: startsWith(matrix.container, 'debian:9')
+        if: startsWith(matrix.container, 'debian:9') || startsWith(matrix.container, 'debian:10')
       - name: Install requirements (centos)
         run: |
+          retry() {
+            for i in {1..10}; do
+              if "$@"; then
+                return 0
+              else
+                sleep "${i}"
+              fi
+            done
+            "$@"
+          }
           # In CentOS, the old repositories is removed from the main mirrors just after EoL.
           # https://github.com/rust-lang/rust/pull/126352
           sed -i /etc/yum.repos.d/*.repo -e 's!^mirrorlist!#mirrorlist!' \
             -e 's!^#baseurl=http://mirror.centos.org/!baseurl=https://vault.centos.org/!'
           sed -i 's/enabled=1/enabled=0/' /etc/yum/pluginconf.d/fastestmirror.conf
-          if [[ "${{ matrix.container }}" == "centos:6" ]]; then
+          if [[ "${CONTAINER}" == "centos:6" ]]; then
             # CentOS 6's curl (7.19.7) has no curl has no --proto/--tlsv1.2.
-            yum install -y gcc openssl-devel
+            retry yum install -y gcc openssl-devel
-            curl -fsSL --retry 10 https://curl.se/download/curl-7.34.0.tar.gz | tar xzf -
+            retry curl -fsSL --retry 10 https://curl.se/download/curl-7.34.0.tar.gz | tar xzf -
             cd -- curl-*
             ./configure --prefix=/usr/local --with-ssl
             make
             make install
             # for checkout-action https://github.com/taiki-e/checkout-action/blob/v1.3.0/.github/workflows/ci.yml#L135-L143
-            yum install -y openssh-clients perl perl-Error perl-TermReadKey rsync
+            retry yum install -y openssh-clients perl perl-Error perl-TermReadKey rsync
-            rpm -i \
+            retry rpm -i \
               https://vault.ius.io/el6/x86_64/packages/p/perl-Git18-1.8.5.5-4.ius.el6.noarch.rpm \
               https://vault.ius.io/el6/x86_64/packages/g/git18-1.8.5.5-4.ius.el6.x86_64.rpm
           fi
+        env:
+          CONTAINER: ${{ matrix.container }}
         if: startsWith(matrix.container, 'centos')
-      - uses: taiki-e/checkout-action@v1
+      # gcc for rustc
+      - run: apk --no-cache add gcc
+        shell: sh
+        if: startsWith(matrix.container, 'alpine')
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
       - run: rm -- Cargo.toml
       - name: Generate tool list
         id: tool-list
-        run: tools/ci/tool-list.sh >>"${GITHUB_OUTPUT}"
+        run: tools/ci/tool-list.sh "" "${CONTAINER}" >>"${GITHUB_OUTPUT}"
+        env:
+          CONTAINER: ${{ matrix.container }}
       # remove bash installed by checkout-action
       - run: apk --no-cache del bash
         shell: sh
@@ -215,8 +311,6 @@ jobs:
       - uses: ./
         with:
           tool: ${{ steps.tool-list.outputs.tool }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Test bash
         run: just --version && shfmt --version
         shell: bash

.github/workflows/manifest.yml

@@ -1,7 +1,6 @@
 name: Manifest
 
-permissions:
+permissions: {}
-  contents: read
 
 on:
   pull_request:
@@ -14,66 +13,23 @@ on:
     - cron: '0 0,3,6,9,12,15,18,21 * * *'
   workflow_dispatch:
 
-env:
-  CARGO_INCREMENTAL: 0
-  CARGO_NET_GIT_FETCH_WITH_CLI: true
-  CARGO_NET_RETRY: 10
-  CARGO_TERM_COLOR: always
-  RUST_BACKTRACE: 1
-  RUSTFLAGS: -D warnings
-  RUSTUP_MAX_RETRIES: 10
-
-defaults:
-  run:
-    shell: bash --noprofile --norc -CeEuxo pipefail {0}
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
 jobs:
   manifest:
-    runs-on: ubuntu-latest
+    uses: taiki-e/github-actions/.github/workflows/gen.yml@931686d4e4cf88b13e790040727ccde2dba8ec62 # main
-    timeout-minutes: 60
     permissions:
-      contents: read
+      contents: write # for creating branch for pr
       pull-requests: write # for gh pr review --approve
-    steps:
+    secrets:
-      - uses: taiki-e/checkout-action@v1
+      PR_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PR_TOKEN_APP_PRIVATE_KEY }}
-      - uses: taiki-e/github-actions/install-rust@stable
+    with:
-      - name: Generate Cargo.lock
+      script: tools/manifest.sh
-        run: cargo update
+      commit-script: tools/ci/manifest.sh
-      - uses: Swatinem/rust-cache@v2
+      title: Update manifest
-        with:
+      branch: update-manifest
-          cache-all-crates: 'true'
+      automerge: true
-      - run: tools/manifest.sh
+      install-cosign: true
-        env:
+      install-parse-changelog: true
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Handle diff
-        id: diff
-        run: tools/ci/manifest.sh
-        if: github.repository_owner == 'taiki-e' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'push' && github.ref == 'refs/heads/main')
-      - run: git add -N . && git -c color.ui=always diff --exit-code
-      - id: create-pull-request
-        uses: peter-evans/create-pull-request@v7
-        with:
-          title: Update manifest
-          body: |
-            Auto-generated by CI using [create-pull-request](https://github.com/peter-evans/create-pull-request).
-
-            This will be auto-merged when CI has passed because this is an auto-generated PR in a defined format and is usually considered no additional review is required.
-          branch: update-manifest
-          token: ${{ secrets.CREATE_PR_TOKEN }}
-        if: github.repository_owner == 'taiki-e' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'push' && github.ref == 'refs/heads/main') && steps.diff.outputs.success == 'false'
-      - name: Enable auto-merge for auto-generated PR
-        run: gh pr merge --rebase --auto "${PR_NUMBER:?}"
-        env:
-          GITHUB_TOKEN: ${{ secrets.CREATE_PR_TOKEN }}
-          PR_NUMBER: ${{ steps.create-pull-request.outputs.pull-request-number }}
-        if: github.repository_owner == 'taiki-e' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'push' && github.ref == 'refs/heads/main') && steps.diff.outputs.success == 'false' && steps.create-pull-request.outputs.pull-request-operation == 'created'
-      - name: Approve auto-generated PR for auto-merge
-        run: gh pr review --approve "${PR_NUMBER:?}"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ steps.create-pull-request.outputs.pull-request-number }}
-        if: github.repository_owner == 'taiki-e' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'push' && github.ref == 'refs/heads/main') && steps.diff.outputs.success == 'false' && (steps.create-pull-request.outputs.pull-request-operation == 'created' || steps.create-pull-request.outputs.pull-request-operation == 'updated')

.github/workflows/release.yml

@@ -1,29 +1,58 @@
 name: Release
 
-permissions:
+permissions: {}
-  contents: read
 
 on:
-  push:
+  workflow_dispatch:
-    tags:
+    inputs:
-      - v[0-9]+.[0-9]+.*
+      target:
+        description: Package to be released
+        required: true
+        type: choice
+        options:
+          - install-action
+          - install-action-manifest-schema
+      version:
+        description: Version to be increased
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
 
-defaults:
+concurrency:
-  run:
+  group: ${{ github.workflow }}
-    shell: bash --noprofile --norc -CeEuxo pipefail {0}
+  cancel-in-progress: false
 
 jobs:
-  create-release:
+  release:
-    if: github.repository_owner == 'taiki-e'
+    if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action'
-    runs-on: ubuntu-latest
+    uses: taiki-e/github-actions/.github/workflows/action-release.yml@931686d4e4cf88b13e790040727ccde2dba8ec62 # main
-    timeout-minutes: 60
     permissions:
-      contents: write
+      contents: write # for taiki-e/create-gh-release-action
-    steps:
+    secrets:
-      - uses: taiki-e/checkout-action@v1
+      PUSH_TOKEN_APP_CLIENT_ID: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
-      - uses: taiki-e/create-gh-release-action@v1
+      PUSH_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
-        with:
+    with:
-          changelog: CHANGELOG.md
+      version: ${{ inputs.version }}
-          title: $version
+      post-commit-script: tools/ci/release-post-commit.sh
-          branch: 'main|v[0-9]+'
+
-          token: ${{ secrets.GITHUB_TOKEN }}
+  release-manifest-schema:
+    if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action-manifest-schema'
+    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@931686d4e4cf88b13e790040727ccde2dba8ec62 # main
+    permissions:
+      contents: write # for taiki-e/create-gh-release-action
+      id-token: write # for rust-lang/crates-io-auth-action
+      attestations: write # unused (used when options for uploading binaries are set)
+    secrets:
+      PUSH_TOKEN_APP_CLIENT_ID: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
+      PUSH_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
+    with:
+      version: ${{ inputs.version }}
+      tag-prefix: install-action-manifest-schema-
+      package: install-action-manifest-schema
+      changelog: tools/manifest-schema/CHANGELOG.md
+      title: $prefix $version
+      prefix: install-action-manifest-schema
+      commit-prefix: 'manifest-schema: '

.github/zizmor.yml

@@ -0,0 +1,6 @@
+# zizmor configuration
+# https://docs.zizmor.sh/configuration/
+
+rules:
+  anonymous-definition: { disable: true } # This is pedantic/auditor only audit and requires explicitly naming each job, but is usually redundant.
+  dependabot-cooldown: { config: { days: 14 } }

.gitignore

@@ -1,5 +1,6 @@
 target
 Cargo.lock
+mutants.out*
 tmp
 
 # For platform and editor specific settings, it is recommended to add to

.prettierignore

@@ -0,0 +1 @@
+manifests/*.json

.rustfmt.toml

@@ -14,6 +14,8 @@ overflow_delimited_expr = true
 imports_granularity = "Crate"
 # This is unstable (tracking issue: https://github.com/rust-lang/rustfmt/issues/5083).
 group_imports = "StdExternalCrate"
+# This is unstable (tracking issue: https://github.com/rust-lang/rustfmt/issues/5081).
+hex_literal_case = "Upper"
 
 # Apply rustfmt to more places.
 # This is unstable (tracking issue: https://github.com/rust-lang/rustfmt/issues/3348).

.shellcheckrc

@@ -5,6 +5,9 @@
 # https://github.com/koalaman/shellcheck/wiki/Optional
 # https://google.github.io/styleguide/shellguide.html
 
+# https://github.com/koalaman/shellcheck/wiki/Directive#external-sources
+external-sources=true
+
 # https://github.com/koalaman/shellcheck/wiki/SC2249
 # enable=add-default-case
 

Cargo.toml

@@ -30,12 +30,12 @@ unused_trait_names = "warn"
 # Suppress buggy or noisy clippy lints
 bool_assert_comparison = { level = "allow", priority = 1 }
 borrow_as_ptr = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/8286
-cast_lossless = { level = "allow", priority = 1 } # https://godbolt.org/z/Pv6vbGG6E
+cast_lossless = { level = "allow", priority = 1 } # suggested code has poor codegen with -C opt-level=0 https://godbolt.org/z/GzTxzbd9q
+collapsible_match = { level = "allow", priority = 1 }
 declare_interior_mutable_const = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/7665
 doc_markdown = { level = "allow", priority = 1 }
 float_cmp = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/7725
 incompatible_msrv = { level = "allow", priority = 1 } # buggy: doesn't consider cfg, https://github.com/rust-lang/rust-clippy/issues/12280, https://github.com/rust-lang/rust-clippy/issues/12257#issuecomment-2093667187
-lint_groups_priority = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/12920
 manual_assert = { level = "allow", priority = 1 }
 manual_range_contains = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/6455#issuecomment-1225966395
 missing_errors_doc = { level = "allow", priority = 1 }
@@ -51,4 +51,3 @@ struct_field_names = { level = "allow", priority = 1 }
 too_many_arguments = { level = "allow", priority = 1 }
 too_many_lines = { level = "allow", priority = 1 }
 type_complexity = { level = "allow", priority = 1 }
-unreadable_literal = { level = "allow", priority = 1 }

DEVELOPMENT.md

@@ -18,12 +18,10 @@ See JSON files in `tools/codegen/base` directory for examples of the manifest.
 > If you have `Github CLI` installed (the command `gh`), you can:
 >
 > ```sh
-> GITHUB_TOKEN=$(gh auth status --show-token 2>&1 | sed -n 's/^.*Token: //p') ./tools/manifest.sh <tool>
+> GITHUB_TOKEN=$(gh auth token) ./tools/manifest.sh <tool>
 > ```
 
-## Refresh TOOLS.md
+3\. Update `TOOLS.md` with the following command.
-
-To update `TOOLS.md`, run
 
 ```sh
 ./tools/update-markdown.sh
@@ -38,3 +36,29 @@ to the platform object.
 
 If CI fails only for containers using older versions of glibc or musl, you may need to add the tool
 name to one of the `*_incompat` arrays in `tools/ci/tool-list.sh`.
+
+## Release new version
+
+Releases are performed by running the [release workflow](https://github.com/taiki-e/install-action/actions/workflows/release.yml) via workflow dispatch. The owner and collaborators can start the release workflow, but the owner’s [approval](https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments#required-reviewers) is required before the actual release.
+
+### Minor version vs patch version
+
+Increase the patch version if only the following changes are included.
+
+- Update the `@latest` version of the tool.
+
+  Rationale: Normally, tool versions are controlled by the `@<version>` syntax, which is explicitly separated from the versioning of the install-action itself.
+
+  Exception: If the major or minor version of the `cargo-binstall` is updated, the minor version may be increased because the behavior of the fallback may change slightly.
+
+- Fix regressions or minor bugs.
+
+  Rationale: Semantic Versioning.
+
+- Improve documentation or diagnostics.
+
+  Rationale: Semantic Versioning.
+
+Usually increase the minor version otherwise.
+
+Adding support for a new tool may conflict with existing fallbacks, so it is necessary to increase the minor version.

README.md

@@ -20,10 +20,11 @@ GitHub Action for installing development tools (mainly from GitHub Releases).
 
 ### Inputs
 
-| Name     | Required | Description                             | Type    | Default |
+| Name | Required | Description | Type | Default |
-| -------- |:--------:| --------------------------------------- | ------- | ------- |
+| ---- | :------: | ----------- | ---- | ------- |
-| tool     | **✓**    | Tools to install (comma-separated list) | String  |         |
+| tool | **✓** | Tools to install (whitespace or comma separated list) | String | |
-| checksum |          | Whether to enable checksums             | Boolean | `true`  |
+| checksum | | Whether to enable checksums (strongly discouraged to disable) | Boolean | `true` |
+| fallback | | Whether to use fallback (none, cargo-binstall, or cargo-install) | String | `cargo-binstall` |
 
 ### Example workflow
 
@@ -58,6 +59,17 @@ You can also omit patch version.
     tool: cargo-hack@0.5
 ```
 
+For some tools, we support installing additional components at the same time by `+<additional>` syntax:
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    # Install rust stable with rustfmt component and wasm32-wasip1 target.
+    tool: rust+rustfmt+wasm32-wasip1
+    # When installing another rust version:
+    # tool: rust@nightly + rustfmt + wasm32-wasip1
+```
+
 To install multiple tools:
 
 ```yaml
@@ -73,6 +85,16 @@ Or:
 - uses: taiki-e/install-action@cargo-minimal-versions
 ```
 
+Tool names can also be separated with whitespaces (line, space, tab).
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    tool: |
+      cargo-hack
+      cargo-minimal-versions
+```
+
 ## Supported tools
 
 See [TOOLS.md](TOOLS.md) for the list of tools that are installed from manifests managed in this action.
@@ -86,24 +108,51 @@ If you want to ensure that fallback is not used, use `fallback: none`.
   with:
     tool: cargo-hack
     # Possible values:
-    # - none: disable all fallback
+    # - none: disable all fallback options
-    # - cargo-binstall (default): cargo-binstall (includes quickinstall)
+    # - cargo-binstall (default): use cargo-binstall (includes "quickinstall" and "install from source")
+    # - cargo-install: use `cargo install`
     fallback: none
 ```
 
+On platforms where cargo-binstall does not provide prebuilt binaries, cargo-install fallback is used instead of cargo-binstall fallback.
+
 ### Add support for new tool
 
 See the [development guide](DEVELOPMENT.md) for how to add support for new tool.
 
 ## Security
 
-When installing the tool from GitHub Releases, this action will download the tool or its installer from GitHub Releases using HTTPS with tlsv1.2+. This is basically considered to be the same level of security as [the recommended installation of rustup](https://www.rust-lang.org/tools/install).
+The `@v<major>` and `@<tool_name>` tags are updated with each release. If you want to enhance workflow stability and security against supply chain attacks, consider using the `@v<major>.<minor>.<patch>` tag or their hash to pin the version and regularly updating with [dependency cooldown]. Since all releases are immutable, pinning the version in either way should have the same effect. Pinning `@<tool_name>` tags by hash is strongly discouraged, as it causes the workflow to reference a [commit that is not present on the repository](https://docs.zizmor.sh/audits/#impostor-commit) when a new version is released.
 
-Additionally, this action will also verify SHA256 checksums for downloaded files in all tools installed from GitHub Releases. This is enabled by default and can be disabled by setting the `checksum` input option to `false`.
+The default fallback (cargo-binstall) is often affected by GitHub's API rate limits, so we [pass the `${{ github.token }}` to cargo-binstall](https://github.com/taiki-e/install-action/issues/561). Disabling the cargo-binstall fallback prevent passing token so helps enhance security.
 
-Additionally, we also verify signature if the tool distributes signed archives. Signature verification is done at the stage of getting the checksum, so disabling the checksum will also disable signature verification.
+See the [Supported tools section](#supported-tools) for how to ensure that fallback is not used.
 
-See the linked documentation for information on security when installed using [snap](https://snapcraft.io/docs) or [cargo-binstall](https://github.com/cargo-bins/cargo-binstall#faq).
+<!-- omit in toc -->
+### Security on installation from GitHub Releases
+
+**Tools covered in this section:** Tools in the [supported tools list](TOOLS.md) where column "Where will it be installed from" is "GitHub Releases".
+
+This action will download the tool or its installer from GitHub Releases using HTTPS with tlsv1.2+. This is basically considered to be the same level of security as [the recommended installation of rustup](https://www.rust-lang.org/tools/install).
+
+Additionally, this action will also verify SHA256 checksums for downloaded files for all tools covered in this section. This is enabled by default and can be disabled by setting the `checksum` input option to `false` (strongly discouraged to disable).
+
+Additionally, we also verify [artifact attestations](https://docs.github.com/en/actions/concepts/security/artifact-attestations) or signature if the tool publishes artifact attestations or distributes signed archives. Verification is done at the stage of getting the checksum, so disabling the checksum will also disable verification.
+
+When installing with `taiki-e/install-action@<tool_name>`, `tool: <tool_name>`, or `tool: <tool_name>@<omitted_version>`, The tool version is reflects upstream releases with a delay of one to a few days (as with other common package managers that verify checksums or signatures). A delay of at least one day is known as [dependency cooldown] and is intended to mitigate the risk of supply chain attacks (the specific cooldown period may be changed in the future). You can bypass the cooldown by explicitly specifying a version. If you want a longer cooldown, consider using the property described below.
+
+When installing with `tool: <tool_name>` or `tool: <tool_name>@<omitted_version>`, the tool version is associated with the install-action version, so pinning install-action version with the `@v<major>.<minor>.<patch>` tag or their hash also pins the version of the tool being installed. This also means that if a [dependency cooldown] applies to the action itself, a cooldown of one to a few days longer will apply to the tools installed by that action.
+
+[dependency cooldown]: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
+
+<!-- omit in toc -->
+### Security on other installation methods
+
+See the linked documentation for information on security when installed using [rustup](https://rust-lang.github.io/rustup/security.html), [snap](https://snapcraft.io/docs), or [cargo-binstall](https://github.com/cargo-bins/cargo-binstall#faq).
+
+If the installation method is rustup and rustup is not yet installed, this action downloads [rustup-init for the current platform](https://rust-lang.github.io/rustup/installation/other.html#manual-installation) using HTTPS with tlsv1.2+, verifies SHA256 checksum, and then installs rustup using it.
+
+If the installation method is cargo-binstall and cargo-binstall is not yet installed or outdated, this action installs cargo-binstall [from GitHub Releases](#security-on-installation-from-github-releases).
 
 See the [Supported tools section](#supported-tools) for how to ensure that fallback is not used.
 
@@ -111,7 +160,7 @@ See the [Supported tools section](#supported-tools) for how to ensure that fallb
 
 This action has been tested for GitHub-hosted runners (Ubuntu, macOS, Windows) and containers (Ubuntu, Debian, Fedora, CentOS, Alma, openSUSE, Arch, Alpine).
 
-On Linux, if any required tools are missing, this action will attempt to install them from distro's package manager, so no pre-setup is usually required (except for CentOS or Debian 9 (or older) or very old distro described below, which was already EoL and needs to use vault/archive repos -- see "Install requirements" in [our CI config](https://github.com/taiki-e/install-action/blob/HEAD/.github/workflows/ci.yml) for example of setup).
+On Linux, if any required tools are missing, this action will attempt to install them from distro's package manager, so no pre-setup is usually required (except for CentOS or Debian 10 (or older) or very old distro described below, which was already EoL and needs to use vault/archive repos -- see "Install requirements" in [our CI config](https://github.com/taiki-e/install-action/blob/HEAD/.github/workflows/ci.yml) for example of setup).
 
 On other platforms, at least the following tools are required:
 
@@ -121,6 +170,8 @@ On other platforms, at least the following tools are required:
 
 Known environments affected by the above version requirements are CentOS 6 (EoL on 2020-11) using curl 7.19, and Ubuntu 12.04 (EoL on 2017-04) using curl 7.22 (see "Install requirements" in [our CI config](https://github.com/taiki-e/install-action/blob/HEAD/.github/workflows/ci.yml) for example of workaround).
 
+Note that what this action installs for its setup (such as above tools) is considered an implementation detail if they are installed by this action's side, and there is no guarantee that they will be available in subsequent steps, because this action is not an action for installing those tools.
+
 ## Related Projects
 
 - [cache-cargo-install-action]: GitHub Action for `cargo install` with cache.

TOOLS.md

@@ -9,24 +9,34 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 > If `$CARGO_HOME/bin` is not available, Rust-related binaries will be installed to `$HOME/.cargo/bin`.<br>
 > If `$HOME/.cargo/bin` is not available, Rust-related binaries will be installed to `$HOME/.install-action/bin`.<br>
 
+> [!WARNING]
+> Please note that the fact that a specific tool is listed here does **NOT** mean that the maintainer trusts the tool for safety or has reviewed its code.
+
 | Name | Where binaries will be installed | Where will it be installed from | Supported platform | License |
 | ---- | -------------------------------- | ------------------------------- | ------------------ | ------- |
+| [**auto-doc**](https://github.com/tj-actions/auto-doc) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/tj-actions/auto-doc/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/tj-actions/auto-doc/blob/main/LICENSE) |
 | [**biome**](https://biomejs.dev) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/biomejs/biome/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/biomejs/biome/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/biomejs/biome/blob/main/LICENSE-MIT) |
-| [**cargo-audit**](https://github.com/rustsec/rustsec/tree/HEAD/cargo-audit) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustsec/rustsec/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rustsec/rustsec/blob/HEAD/cargo-audit/LICENSE-APACHE) OR [MIT](https://github.com/rustsec/rustsec/blob/HEAD/cargo-audit/LICENSE-MIT) |
+| [**cargo-apple-runner**](https://github.com/madsmtm/cargo-apple-runner) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/madsmtm/cargo-apple-runner/releases) | macOS | [Zlib](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-ZLIB.txt) OR [Apache-2.0](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-APACHE.txt) OR [MIT](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-MIT.txt) |
-| [**cargo-auditable**](https://github.com/rust-secure-code/cargo-auditable) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-secure-code/cargo-auditable/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rust-secure-code/cargo-auditable/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/rust-secure-code/cargo-auditable/blob/HEAD/LICENSE-MIT) |
+| [**cargo-audit**](https://github.com/rustsec/rustsec/tree/HEAD/cargo-audit) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustsec/rustsec/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rustsec/rustsec/blob/main/cargo-audit/LICENSE-APACHE) OR [MIT](https://github.com/rustsec/rustsec/blob/main/cargo-audit/LICENSE-MIT) |
-| [**cargo-binstall**](https://github.com/cargo-bins/cargo-binstall) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cargo-bins/cargo-binstall/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/HEAD/crates/bin/LICENSE) |
+| [**cargo-auditable**](https://github.com/rust-secure-code/cargo-auditable) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-secure-code/cargo-auditable/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rust-secure-code/cargo-auditable/blob/master/LICENSE-APACHE) OR [MIT](https://github.com/rust-secure-code/cargo-auditable/blob/master/LICENSE-MIT) |
+| [**cargo-binstall**](https://github.com/cargo-bins/cargo-binstall) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cargo-bins/cargo-binstall/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/main/crates/bin/LICENSE) |
 | [**cargo-careful**](https://github.com/RalfJung/cargo-careful) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/RalfJung/cargo-careful/releases) | Linux, macOS, Windows | [MIT](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-APACHE) |
 | [**cargo-cyclonedx**](https://github.com/CycloneDX/cyclonedx-rust-cargo) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/CycloneDX/cyclonedx-rust-cargo/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/CycloneDX/cyclonedx-rust-cargo/blob/main/LICENSE) |
+| [**cargo-deadlinks**](https://github.com/deadlinks/cargo-deadlinks) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/deadlinks/cargo-deadlinks/releases) | Linux, macOS, Windows | [MIT](https://github.com/deadlinks/cargo-deadlinks/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/deadlinks/cargo-deadlinks/blob/master/LICENSE-APACHE) |
+| [**cargo-deb**](https://github.com/kornelski/cargo-deb) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/kornelski/cargo-deb/releases) | Linux | [MIT](https://github.com/kornelski/cargo-deb/blob/main/LICENSE) |
 | [**cargo-deny**](https://github.com/EmbarkStudios/cargo-deny) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/EmbarkStudios/cargo-deny/releases) | Linux, macOS, Windows | [MIT](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-APACHE) |
 | [**cargo-dinghy**](https://github.com/sonos/dinghy) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sonos/dinghy/releases) | Linux, macOS | [MIT](https://github.com/sonos/dinghy/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/sonos/dinghy/blob/main/LICENSE-APACHE) |
 | [**cargo-export**](https://github.com/bazhenov/cargo-export) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bazhenov/cargo-export/releases) | Linux, macOS, Windows | [MIT](https://github.com/bazhenov/cargo-export/blob/master/LICENSE) |
 | [**cargo-hack**](https://github.com/taiki-e/cargo-hack) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-hack/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-hack/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-hack/blob/main/LICENSE-MIT) |
+| [**cargo-insta**](https://insta.rs/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/mitsuhiko/insta/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/mitsuhiko/insta/blob/master/LICENSE) |
 | [**cargo-lambda**](https://github.com/cargo-lambda/cargo-lambda) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cargo-lambda/cargo-lambda/releases) | Linux, macOS, Windows | [MIT](https://github.com/cargo-lambda/cargo-lambda/blob/main/LICENSE) |
 | [**cargo-llvm-cov**](https://github.com/taiki-e/cargo-llvm-cov) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-llvm-cov/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-llvm-cov/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-llvm-cov/blob/main/LICENSE-MIT) |
 | [**cargo-machete**](https://github.com/bnjbvr/cargo-machete) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bnjbvr/cargo-machete/releases) | Linux, macOS, Windows | [MIT](https://github.com/bnjbvr/cargo-machete/blob/main/LICENSE.md) |
 | [**cargo-make**](https://github.com/sagiegurari/cargo-make) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sagiegurari/cargo-make/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/sagiegurari/cargo-make/blob/master/LICENSE) |
 | [**cargo-minimal-versions**](https://github.com/taiki-e/cargo-minimal-versions) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-minimal-versions/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-minimal-versions/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-minimal-versions/blob/main/LICENSE-MIT) |
-| [**cargo-nextest**](https://github.com/nextest-rs/nextest) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/nextest-rs/nextest/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/nextest-rs/nextest/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/nextest-rs/nextest/blob/main/LICENSE-MIT) |
+| [**cargo-mutants**](https://github.com/sourcefrog/cargo-mutants) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sourcefrog/cargo-mutants/releases) | Linux, macOS, Windows | [MIT](https://github.com/sourcefrog/cargo-mutants/blob/main/LICENSE) |
+| [**cargo-neat**](https://github.com/killzoner/cargo-neat) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/killzoner/cargo-neat/releases) | Linux, macOS, Windows | [MIT](https://github.com/killzoner/cargo-neat/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/killzoner/cargo-neat/blob/master/LICENSE-APACHE) |
+| [**cargo-nextest**](https://github.com/nextest-rs/nextest) (alias: `nextest`) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/nextest-rs/nextest/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/nextest-rs/nextest/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/nextest-rs/nextest/blob/main/LICENSE-MIT) |
 | [**cargo-no-dev-deps**](https://github.com/taiki-e/cargo-no-dev-deps) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-no-dev-deps/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-no-dev-deps/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-no-dev-deps/blob/main/LICENSE-MIT) |
 | [**cargo-rdme**](https://github.com/orium/cargo-rdme) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/orium/cargo-rdme/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/orium/cargo-rdme/blob/main/LICENSE.md) |
 | [**cargo-semver-checks**](https://github.com/obi1kenobi/cargo-semver-checks) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/obi1kenobi/cargo-semver-checks/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/obi1kenobi/cargo-semver-checks/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/obi1kenobi/cargo-semver-checks/blob/main/LICENSE-MIT) |
@@ -34,46 +44,66 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**cargo-sort**](https://github.com/DevinR528/cargo-sort) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/DevinR528/cargo-sort/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/DevinR528/cargo-sort/blob/v1.0.9/Cargo.toml#L5) |
 | [**cargo-spellcheck**](https://github.com/drahnr/cargo-spellcheck) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/drahnr/cargo-spellcheck/releases) | Linux, Windows | [LGPLv2.1](https://github.com/drahnr/cargo-spellcheck/blob/master/LICENSE-LGPL) |
 | [**cargo-tarpaulin**](https://github.com/xd009642/tarpaulin) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/xd009642/tarpaulin/releases) | Linux, macOS, Windows | [MIT](https://github.com/xd009642/tarpaulin/blob/develop/LICENSE-MIT) OR [Apache-2.0](https://github.com/xd009642/tarpaulin/blob/develop/LICENSE-APACHE) |
-| [**cargo-udeps**](https://github.com/est31/cargo-udeps) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/est31/cargo-udeps/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/est31/cargo-udeps/blob/HEAD/LICENSE) |
+| [**cargo-udeps**](https://github.com/est31/cargo-udeps) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/est31/cargo-udeps/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/est31/cargo-udeps/blob/master/LICENSE) |
 | [**cargo-valgrind**](https://github.com/jfrimmel/cargo-valgrind) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/jfrimmel/cargo-valgrind/releases) | Linux, macOS, Windows | [MIT](https://github.com/jfrimmel/cargo-valgrind/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/jfrimmel/cargo-valgrind/blob/master/LICENSE-APACHE) |
+| [**cargo-xwin**](https://github.com/rust-cross/cargo-xwin) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-cross/cargo-xwin/releases) | Linux, macOS, Windows | [MIT](https://github.com/rust-cross/cargo-xwin/blob/main/LICENSE) |
 | [**cargo-zigbuild**](https://github.com/rust-cross/cargo-zigbuild) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-cross/cargo-zigbuild/releases) | Linux, macOS, Windows | [MIT](https://github.com/rust-cross/cargo-zigbuild/blob/main/LICENSE) |
+| [**coreutils**](https://github.com/uutils/coreutils) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/uutils/coreutils/releases) | Linux, macOS, Windows | [MIT](https://github.com/uutils/coreutils/blob/main/LICENSE) |
+| [**cosign**](https://github.com/sigstore/cosign) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/sigstore/cosign/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/sigstore/cosign/blob/main/LICENSE) |
+| [**covgate**](https://github.com/jesse-black/covgate) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/jesse-black/covgate/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/jesse-black/covgate/blob/main/LICENSE) |
 | [**cross**](https://github.com/cross-rs/cross) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cross-rs/cross/releases) | Linux, macOS, Windows | [MIT](https://github.com/cross-rs/cross/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/cross-rs/cross/blob/main/LICENSE-APACHE) |
+| [**cyclonedx**](https://github.com/CycloneDX/cyclonedx-cli) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/CycloneDX/cyclonedx-cli/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/CycloneDX/cyclonedx-cli/blob/main/LICENSE) |
 | [**deepsource**](https://github.com/DeepSourceCorp/cli) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/DeepSourceCorp/cli/releases) | Linux, macOS, Windows | [BSD-2-Clause](https://github.com/DeepSourceCorp/cli/blob/master/LICENSE) |
 | [**dprint**](https://github.com/dprint/dprint) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/dprint/dprint/releases) | Linux, macOS, Windows | [MIT](https://github.com/dprint/dprint/blob/main/LICENSE) |
 | [**earthly**](https://github.com/earthly/earthly) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/earthly/earthly/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/earthly/earthly/blob/main/LICENSE) |
 | [**editorconfig-checker**](https://github.com/editorconfig-checker/editorconfig-checker) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/editorconfig-checker/editorconfig-checker/releases) | Linux, macOS, Windows | [MIT](https://github.com/editorconfig-checker/editorconfig-checker/blob/main/LICENSE) |
 | [**espup**](https://github.com/esp-rs/espup) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/esp-rs/espup/releases) | Linux, macOS, Windows | [MIT](https://github.com/esp-rs/espup/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/esp-rs/espup/blob/main/LICENSE-APACHE) |
 | [**git-cliff**](https://github.com/orhun/git-cliff) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/orhun/git-cliff/releases) | Linux, macOS, Windows | [MIT](https://github.com/orhun/git-cliff/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/orhun/git-cliff/blob/main/LICENSE-APACHE) |
-| [**grcov**](https://github.com/mozilla/grcov) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/mozilla/grcov/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/mozilla/grcov/blob/HEAD/LICENSE-MPL-2.0) |
+| [**grcov**](https://github.com/mozilla/grcov) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/mozilla/grcov/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/mozilla/grcov/blob/master/LICENSE-MPL-2.0) |
+| [**gungraun-runner**](https://gungraun.github.io/gungraun/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/gungraun/gungraun/releases) | Linux | [Apache-2.0](https://github.com/gungraun/gungraun/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/gungraun/gungraun/blob/main/LICENSE-MIT) |
 | [**hyperfine**](https://github.com/sharkdp/hyperfine) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sharkdp/hyperfine/releases) | Linux, macOS, Windows | [MIT](https://github.com/sharkdp/hyperfine/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/sharkdp/hyperfine/blob/master/LICENSE-APACHE) |
+| [**iai-callgrind-runner**](https://gungraun.github.io/gungraun/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/iai-callgrind/iai-callgrind/releases) | Linux | [Apache-2.0](https://github.com/iai-callgrind/iai-callgrind/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/iai-callgrind/iai-callgrind/blob/main/LICENSE-MIT) |
 | [**jaq**](https://github.com/01mf02/jaq) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/01mf02/jaq/releases) | Linux, macOS, Windows | [MIT](https://github.com/01mf02/jaq/blob/main/LICENSE-MIT) |
 | [**just**](https://github.com/casey/just) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/casey/just/releases) | Linux, macOS, Windows | [CC0-1.0](https://github.com/casey/just/blob/master/LICENSE) |
 | [**knope**](https://github.com/knope-dev/knope) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/knope-dev/knope/releases) | Linux, macOS, Windows | [MIT](https://github.com/knope-dev/knope/blob/main/LICENSE) |
+| [**martin**](https://maplibre.org/martin/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/maplibre/martin/releases) | Linux, macOS | [MIT](https://github.com/maplibre/martin/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/maplibre/martin/blob/main/LICENSE-APACHE) |
 | [**mdbook**](https://github.com/rust-lang/mdBook) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-lang/mdBook/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/rust-lang/mdBook/blob/master/LICENSE) |
+| [**mdbook-alerts**](https://github.com/lambdalisue/rs-mdbook-alerts) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/lambdalisue/rs-mdbook-alerts/releases) | Linux, macOS, Windows | [MIT](https://github.com/lambdalisue/rs-mdbook-alerts/blob/main/LICENSE) |
+| [**mdbook-d2**](https://github.com/danieleades/mdbook-d2) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/danieleades/mdbook-d2/releases) | Linux, macOS, Windows | [MIT](https://github.com/danieleades/mdbook-d2/blob/main/LICENSE) |
 | [**mdbook-linkcheck**](https://github.com/Michael-F-Bryan/mdbook-linkcheck) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/Michael-F-Bryan/mdbook-linkcheck/releases) | Linux, macOS, Windows | [MIT](https://github.com/Michael-F-Bryan/mdbook-linkcheck/blob/master/LICENSE) |
+| [**mdbook-mermaid**](https://github.com/badboy/mdbook-mermaid) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/badboy/mdbook-mermaid/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/badboy/mdbook-mermaid/blob/main/LICENSE) |
+| [**mdbook-mermaid-ssr**](https://github.com/CommanderStorm/mdbook-mermaid-ssr) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/CommanderStorm/mdbook-mermaid-ssr/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/CommanderStorm/mdbook-mermaid-ssr/blob/main/LICENSE) |
+| [**mise**](https://github.com/jdx/mise) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/jdx/mise/releases) | Linux, macOS, Windows | [MIT](https://github.com/jdx/mise/blob/main/LICENSE) |
 | [**osv-scanner**](https://github.com/google/osv-scanner) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/google/osv-scanner/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/google/osv-scanner/blob/main/LICENSE) |
 | [**parse-changelog**](https://github.com/taiki-e/parse-changelog) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/parse-changelog/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/parse-changelog/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/parse-changelog/blob/main/LICENSE-MIT) |
 | [**parse-dockerfile**](https://github.com/taiki-e/parse-dockerfile) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/parse-dockerfile/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/parse-dockerfile/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/parse-dockerfile/blob/main/LICENSE-MIT) |
-| [**protoc**](https://github.com/protocolbuffers/protobuf) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/protocolbuffers/protobuf/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/protocolbuffers/protobuf/blob/HEAD/LICENSE) |
+| [**prek**](https://github.com/j178/prek) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/j178/prek/releases) | Linux, macOS, Windows | [MIT](https://github.com/j178/prek/blob/master/LICENSE) |
+| [**protoc**](https://github.com/protocolbuffers/protobuf) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/protocolbuffers/protobuf/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/protocolbuffers/protobuf/blob/main/LICENSE) |
 | [**rclone**](https://github.com/rclone/rclone) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/rclone/rclone/releases) | Linux, macOS, Windows | [MIT](https://github.com/rclone/rclone/blob/master/COPYING) |
 | [**release-plz**](https://release-plz.dev/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/release-plz/release-plz/releases) | Linux, macOS, Windows | [MIT](https://github.com/release-plz/release-plz/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/release-plz/release-plz/blob/main/LICENSE-APACHE) |
+| [**rust**](https://rust-lang.org) | `$CARGO_HOME/bin` | rustup | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/rust-lang/rust/blob/main/COPYRIGHT) |
 | [**sccache**](https://github.com/mozilla/sccache) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/mozilla/sccache/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/mozilla/sccache/blob/main/LICENSE) |
 | [**shellcheck**](https://www.shellcheck.net) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/koalaman/shellcheck/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/koalaman/shellcheck/blob/master/LICENSE) |
 | [**shfmt**](https://github.com/mvdan/sh) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/mvdan/sh/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/mvdan/sh/blob/master/LICENSE) |
 | [**syft**](https://github.com/anchore/syft) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/anchore/syft/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/anchore/syft/blob/main/LICENSE) |
-| [**taplo**](https://github.com/tamasfe/taplo) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/tamasfe/taplo/releases) | Linux, macOS, Windows | [MIT](https://github.com/tamasfe/taplo/blob/master/LICENSE) |
+| [**taplo**](https://github.com/tamasfe/taplo) (alias: `taplo-cli`) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/tamasfe/taplo/releases) | Linux, macOS, Windows | [MIT](https://github.com/tamasfe/taplo/blob/master/LICENSE) |
+| [**tombi**](https://tombi-toml.github.io/tombi/) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/tombi-toml/tombi/releases) | Linux, macOS, Windows | [MIT](https://github.com/tombi-toml/tombi/blob/main/LICENSE) |
 | [**trivy**](https://github.com/aquasecurity/trivy) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/aquasecurity/trivy/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) |
 | [**trunk**](https://github.com/trunk-rs/trunk) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/trunk-rs/trunk/releases) | Linux, macOS, Windows | [MIT](https://github.com/trunk-rs/trunk/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/trunk-rs/trunk/blob/main/LICENSE-APACHE) |
 | [**typos**](https://github.com/crate-ci/typos) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/crate-ci/typos/releases) | Linux, macOS, Windows | [MIT](https://github.com/crate-ci/typos/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/crate-ci/typos/blob/master/LICENSE-APACHE) |
+| [**ubi**](https://github.com/houseabsolute/ubi) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/houseabsolute/ubi/releases) | Linux, macOS, Windows | [MIT](https://github.com/houseabsolute/ubi/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/houseabsolute/ubi/blob/master/LICENSE-APACHE) |
+| [**uv**](https://github.com/astral-sh/uv) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/astral-sh/uv/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT) |
+| [**vacuum**](https://github.com/daveshanley/vacuum) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/daveshanley/vacuum/releases) | Linux, macOS, Windows | [MIT](https://github.com/daveshanley/vacuum/blob/main/LICENSE) |
 | [**valgrind**](https://valgrind.org/) | `/snap/bin` | [snap](https://snapcraft.io/install/valgrind/ubuntu) | Linux | [GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD) |
 | [**wait-for-them**](https://github.com/shenek/wait-for-them) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/shenek/wait-for-them/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/shenek/wait-for-them/blob/v0.4.0/Cargo.toml#L7) |
 | [**wash**](https://github.com/wasmCloud/wasmCloud) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/wasmCloud/wasmCloud/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/wasmCloud/wasmCloud/blob/main/LICENSE) |
-| [**wasm-bindgen**](https://github.com/rustwasm/wasm-bindgen) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustwasm/wasm-bindgen/releases) | Linux, macOS, Windows | [MIT](https://github.com/rustwasm/wasm-bindgen/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/rustwasm/wasm-bindgen/blob/main/LICENSE-APACHE) |
+| [**wasm-bindgen**](https://github.com/wasm-bindgen/wasm-bindgen) (alias: `wasm-bindgen-cli`) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/wasm-bindgen/wasm-bindgen/releases) | Linux, macOS, Windows | [MIT](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-APACHE) |
-| [**wasm-pack**](https://github.com/rustwasm/wasm-pack) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustwasm/wasm-pack/releases) | Linux, macOS, Windows | [MIT](https://github.com/rustwasm/wasm-pack/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/rustwasm/wasm-pack/blob/master/LICENSE-APACHE) |
+| [**wasm-pack**](https://github.com/wasm-bindgen/wasm-pack) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/wasm-bindgen/wasm-pack/releases) | Linux, macOS, Windows | [MIT](https://github.com/wasm-bindgen/wasm-pack/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/wasm-bindgen/wasm-pack/blob/master/LICENSE-APACHE) |
-| [**wasmtime**](https://github.com/bytecodealliance/wasmtime) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bytecodealliance/wasmtime/releases) | Linux, macOS, Windows | [Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasmtime/blob/main/LICENSE) |
+| [**wasm-tools**](https://github.com/bytecodealliance/wasm-tools) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bytecodealliance/wasm-tools/releases) | Linux, macOS, Windows | [Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasm-tools/blob/main/LICENSE-APACHE) OR [Apache-2.0](https://github.com/bytecodealliance/wasm-tools/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/bytecodealliance/wasm-tools/blob/main/LICENSE-MIT) |
+| [**wasmtime**](https://github.com/bytecodealliance/wasmtime) (alias: `wasmtime-cli`) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bytecodealliance/wasmtime/releases) | Linux, macOS, Windows | [Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasmtime/blob/main/LICENSE) |
 | [**xbuild**](https://github.com/rust-mobile/xbuild) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-mobile/xbuild/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/rust-mobile/xbuild/blob/v0.2.0/xbuild/Cargo.toml#L7) |
 | [**xh**](https://github.com/ducaale/xh) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/ducaale/xh/releases) | Linux, macOS, Windows | [MIT](https://github.com/ducaale/xh/blob/master/LICENSE) |
 | [**zizmor**](https://github.com/zizmorcore/zizmor) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/zizmorcore/zizmor/releases) | Linux, macOS, Windows | [MIT](https://github.com/zizmorcore/zizmor/blob/main/LICENSE) |
-| [**zola**](https://github.com/getzola/zola) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/getzola/zola/releases) | Linux, macOS, Windows | [MIT](https://github.com/getzola/zola/blob/master/LICENSE) |
+| [**zola**](https://github.com/getzola/zola) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/getzola/zola/releases) | Linux, macOS, Windows | [MIT](https://github.com/getzola/zola/blob/master/LICENSE) |
 
 [cargo-binstall]: https://github.com/cargo-bins/cargo-binstall

action.yml

@@ -3,15 +3,15 @@ description: GitHub Action for installing development tools
 
 inputs:
   tool:
-    description: Tools to install (comma-separated list)
+    description: Tools to install (whitespace or comma separated list)
-    required: true
+    required: false
-    # default: #publish:tool
+    default: parse-dockerfile
   checksum:
-    description: Whether to enable checksums
+    description: Whether to enable checksums (strongly discouraged to disable)
     required: false
     default: 'true'
   fallback:
-    description: Whether to use fallback (none or cargo-binstall)
+    description: Whether to use fallback (none, cargo-binstall, or cargo-install)
     required: false
     default: 'cargo-binstall'
 
@@ -22,7 +22,15 @@ runs:
   using: composite
   steps:
     - run: |
-        set -eu
+        bail() {
+          printf '::error::install-action: %s\n' "$*"
+          exit 1
+        }
+        # If /bin/sh is dash, environment variable containing % is not imported, but is fine
+        # because it also means that it will not be exposed to subprocess.
+        if /usr/bin/env | grep -Eq '^BASH_FUNC_'; then
+          bail 'bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons'
+        fi
         if ! command -v bash >/dev/null; then
           if grep -Eq '^ID=alpine' /etc/os-release; then
             printf '::group::Install packages required for install-action (bash)\n'
@@ -36,16 +44,54 @@ runs:
             fi
             printf '::endgroup::\n'
           else
-            printf '::error::install-action requires bash\n'
+            bail 'this action requires bash'
-            exit 1
           fi
         fi
-      shell: sh
+        bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
-      if: runner.os	== 'Linux'
+      shell: /usr/bin/env -u ENV -u BASH_ENV -u CDPATH -u SHELLOPTS -u BASHOPTS /bin/sh -eu {0} # zizmor: ignore[misfeature] false positive
-    - run: bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
-      shell: bash
       env:
+        # NB: Sync with Windows case.
         INPUT_TOOL: ${{ inputs.tool }}
         INPUT_CHECKSUM: ${{ inputs.checksum }}
         INPUT_FALLBACK: ${{ inputs.fallback }}
-        DEFAULT_GITHUB_TOKEN: ${{ github.token }}
+        DEFAULT_GITHUB_TOKEN: ${{ inputs.fallback == 'cargo-binstall' && github.token || '' }}
+        ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
+        RUNNER_OS: ${{ runner.os }}
+        RUNNER_ARCH: ${{ runner.arch }}
+      if: runner.os != 'Windows'
+    # Use pwsh and retry on bash startup failure to work around windows-11-arm runner bug:
+    # https://github.com/actions/partner-runner-images/issues/169
+    - run: |
+        Set-StrictMode -Version Latest
+        $remove_env = @('ENV','BASH_ENV','CDPATH','SHELLOPTS','BASHOPTS','BASH_FUNC_*')
+        foreach ($name in $remove_env) {
+          if (Test-Path "Env:$name") { Remove-Item "Env:\$name" }
+        }
+        for ($i=1; $i -le 10; $i++) {
+          $prev_err_action = $ErrorActionPreference
+          $ErrorActionPreference = "Continue"
+          & bash --noprofile --norc "$env:GITHUB_ACTION_PATH\main.sh"
+          $code = $LASTEXITCODE
+          $ErrorActionPreference = "$prev_err_action"
+          if (Test-Path "$env:USERPROFILE\.install-action\init") {
+            # If bash started successfully, main.sh creates init file.
+            Remove-Item "$env:USERPROFILE\.install-action\init" -Force
+            exit $code
+          }
+          if ($i -lt 10) {
+            Write-Output "::warning::install-action: installation failed due to bash startup failure (<https://github.com/actions/partner-runner-images/issues/169>); retrying..."
+          }
+        }
+        Write-Output "::error::install-action: installation failed due to bash startup failure (<https://github.com/actions/partner-runner-images/issues/169>); this maybe resolved by re-running job"
+        exit 1
+      shell: pwsh
+      env:
+        # NB: Sync with non-Windows case.
+        INPUT_TOOL: ${{ inputs.tool }}
+        INPUT_CHECKSUM: ${{ inputs.checksum }}
+        INPUT_FALLBACK: ${{ inputs.fallback }}
+        DEFAULT_GITHUB_TOKEN: ${{ inputs.fallback == 'cargo-binstall' && github.token || '' }}
+        ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
+        RUNNER_OS: ${{ runner.os }}
+        RUNNER_ARCH: ${{ runner.arch }}
+      if: runner.os == 'Windows'

main.sh

@@ -9,6 +9,14 @@ rx() {
     "$@"
   )
 }
+g() {
+  IFS=' '
+  local cmd="$*"
+  IFS=$'\n\t'
+  printf '::group::%s\n' "${cmd#retry }"
+  "$@"
+  printf '::endgroup::\n'
+}
 retry() {
   for i in {1..10}; do
     if "$@"; then
@@ -20,15 +28,28 @@ retry() {
   "$@"
 }
 bail() {
-  printf '::error::%s\n' "$*"
+  printf '::error::install-action: %s\n' "$*"
   exit 1
 }
 warn() {
-  printf '::warning::%s\n' "$*"
+  printf '::warning::install-action: %s\n' "$*"
 }
 info() {
   printf >&2 'info: %s\n' "$*"
 }
+normalize_comma_or_space_separated() {
+  # Normalize whitespace characters into space because it's hard to handle single input contains lines with POSIX sed alone.
+  local list="${1//[$'\r\n\t']/ }"
+  if [[ "${list}" == *","* ]]; then
+    # If a comma is contained, consider it is a comma-separated list.
+    # Drop leading and trailing whitespaces in each element.
+    sed -E 's/ *\+ */+/g; s/ *, */,/g; s/^.//; s/,,$/,/' <<<",${list},"
+  else
+    # Otherwise, consider it is a whitespace-separated list.
+    # Convert whitespace characters into comma.
+    sed -E 's/ *\+ */+/g; s/ +/,/g; s/^.//' <<<" ${list} "
+  fi
+}
 _sudo() {
   if type -P sudo >/dev/null; then
     sudo "$@"
@@ -43,7 +64,7 @@ download_and_checksum() {
     checksum=''
   fi
   info "downloading ${url}"
-  retry curl --proto '=https' --tlsv1.2 -fsSL --retry 10 "${url}" -o tmp
+  retry curl --proto '=https' --tlsv1.2 -fsSL --retry 10 -o tmp "${url}"
   if [[ -n "${checksum}" ]]; then
     info "verifying sha256 checksum for $(basename -- "${url}")"
     if type -P sha256sum >/dev/null; then
@@ -148,6 +169,17 @@ download_and_extract() {
         esac
       fi
       ;;
+    *.deb)
+      if ! type -P dpkg-deb >/dev/null; then
+        case "${base_distro}" in
+          debian | fedora | suse | arch | alpine)
+            printf '::group::Install packages required for installation (dpkg)\n'
+            sys_install dpkg
+            printf '::endgroup::\n'
+            ;;
+        esac
+      fi
+      ;;
   esac
 
   mkdir -p -- "${tmp_dir}"
@@ -166,7 +198,7 @@ download_and_extract() {
     else
       case "${url}" in
         *.zip)
-          unzip -q tmp "${bin_in_archive#\./}"
+          unzip -q tmp
           for tmp in "${bin_in_archive[@]}"; do
             case "${tool}" in
               editorconfig-checker) mv -- "${tmp}" "${bin_dir}/${tool}${exe}" ;;
@@ -181,6 +213,12 @@ download_and_extract() {
             mv -- "${tmp}" "${bin_dir}/"
           done
           ;;
+        *.deb)
+          dpkg-deb -x tmp .
+          for tmp in "${bin_in_archive[@]}"; do
+            mv -- "${tmp}" "${bin_dir}/"
+          done
+          ;;
         *)
           for tmp in "${installed_bin[@]}"; do
             mv -- tmp "${tmp}"
@@ -206,7 +244,7 @@ read_manifest() {
   local version="$2"
   local manifest
   rust_crate=$(jq -r '.rust_crate' "${manifest_dir}/${tool}.json")
-  manifest=$(jq -r ".[\"${version}\"]" "${manifest_dir}/${tool}.json")
+  manifest=$(jq -r --arg version "${version}" '.[$version]' "${manifest_dir}/${tool}.json")
   if [[ "${manifest}" == "null" ]]; then
     download_info="null"
     return 0
@@ -215,25 +253,27 @@ read_manifest() {
   if [[ "${exact_version}" == "null" ]]; then
     exact_version="${version}"
   else
-    manifest=$(jq -r ".[\"${exact_version}\"]" "${manifest_dir}/${tool}.json")
+    manifest=$(jq -r --arg version "${exact_version}" '.[$version]' "${manifest_dir}/${tool}.json")
     if [[ "${rust_crate}" != "null" ]]; then
       # TODO: don't hardcode tool name and use 'immediate_yank_reflection' field in base manifest.
       case "${tool}" in
-        cargo-nextest | nextest)
+        cargo-nextest)
-          crate_info=$(retry curl --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${rust_crate}")
+          crate_info=$(retry curl --user-agent "${ACTION_USER_AGENT}" --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${rust_crate}" || true)
-          while true; do
+          if [[ -n "${crate_info}" ]]; then
-            yanked=$(jq -r ".versions[] | select(.num == \"${exact_version}\") | .yanked" <<<"${crate_info}")
+            while true; do
-            if [[ "${yanked}" != "true" ]]; then
+              yanked=$(jq -r --arg version "${exact_version}" '.versions[] | select(.num == $version) | .yanked' <<<"${crate_info}")
-              break
+              if [[ "${yanked}" != "true" ]]; then
-            fi
+                break
-            previous_stable_version=$(jq -r '.previous_stable_version' <<<"${manifest}")
+              fi
-            if [[ "${previous_stable_version}" == "null" ]]; then
+              previous_stable_version=$(jq -r '.previous_stable_version' <<<"${manifest}")
-              break
+              if [[ "${previous_stable_version}" == "null" ]]; then
-            fi
+                break
-            info "${tool}@${exact_version} is yanked; downgrade to ${previous_stable_version}"
+              fi
-            exact_version="${previous_stable_version}"
+              info "${tool}@${exact_version} is yanked; downgrade to ${previous_stable_version}"
-            manifest=$(jq -r ".[\"${exact_version}\"]" "${manifest_dir}/${tool}.json")
+              exact_version="${previous_stable_version}"
-          done
+              manifest=$(jq -r --arg version "${exact_version}" '.[$version]' "${manifest_dir}/${tool}.json")
+            done
+          fi
           ;;
       esac
     fi
@@ -245,18 +285,18 @@ read_manifest() {
       # usually preferred over linux-gnu binaries because they can avoid glibc version issues.
       # (rustc enables statically linking for linux-musl by default, except for mips.)
       host_platform="${host_arch}_linux_musl"
-      download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+      download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
       if [[ "${download_info}" == "null" ]]; then
         # Even if host_env is musl, we won't issue an error here because it seems that in
         # some cases linux-gnu binaries will work on linux-musl hosts.
         # https://wiki.alpinelinux.org/wiki/Running_glibc_programs
         # TODO: However, a warning may make sense.
         host_platform="${host_arch}_linux_gnu"
-        download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+        download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
       elif [[ "${host_env}" == "gnu" ]]; then
         # TODO: don't hardcode tool name and use 'prefer_linux_gnu' field in base manifest.
         case "${tool}" in
-          cargo-nextest | nextest)
+          cargo-nextest)
             # TODO: don't hardcode required glibc version
             required_glibc_version=2.27
             higher_glibc_version=$(LC_ALL=C sort -Vu <<<"${required_glibc_version}"$'\n'"${host_glibc_version}" | tail -1)
@@ -264,7 +304,7 @@ read_manifest() {
               # musl build of nextest is slow, so use glibc build if host_env is gnu.
               # https://github.com/taiki-e/install-action/issues/13
               host_platform="${host_arch}_linux_gnu"
-              download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+              download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
             fi
             ;;
         esac
@@ -274,10 +314,10 @@ read_manifest() {
       # Binaries compiled for x86_64 macOS will usually also work on AArch64 macOS.
       # Binaries compiled for x86_64 Windows will usually also work on AArch64 Windows 11+.
       host_platform="${host_arch}_${host_os}"
-      download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+      download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
       if [[ "${download_info}" == "null" ]] && [[ "${host_arch}" != "x86_64" ]]; then
         host_platform="x86_64_${host_os}"
-        download_info=$(jq -r ".${host_platform}" <<<"${manifest}")
+        download_info=$(jq -r --arg p "${host_platform}" '.[$p]' <<<"${manifest}")
       fi
       ;;
     *) bail "unsupported OS type '${host_os}' for ${tool}" ;;
@@ -289,13 +329,13 @@ read_download_info() {
   if [[ "${download_info}" == "null" ]]; then
     bail "${tool}@${version} for '${host_os}' is not supported"
   fi
-  checksum=$(jq -r '.checksum' <<<"${download_info}")
+  checksum=$(jq -r '.hash' <<<"${download_info}")
   url=$(jq -r '.url' <<<"${download_info}")
   local tmp
   bin_in_archive=()
   if [[ "${url}" == "null" ]]; then
     local template
-    template=$(jq -c ".template.${host_platform}" "${manifest_dir}/${tool}.json")
+    template=$(jq -c --arg p "${host_platform}" '.template[$p]' "${manifest_dir}/${tool}.json")
     template="${template//\$\{version\}/${exact_version}}"
     url=$(jq -r '.url' <<<"${template}")
     tmp=$(jq -r '.bin' <<<"${template}")
@@ -342,7 +382,7 @@ install_cargo_binstall() {
       info "cargo-binstall already installed at ${cargo_bin}/cargo-binstall${exe}"
       install_binstall=''
     else
-      info "cargo-binstall already installed at ${cargo_bin}/cargo-binstall${exe}, but is not compatible version with install-action, upgrading"
+      info "cargo-binstall already installed at ${cargo_bin}/cargo-binstall${exe}, but is not compatible version with this action, upgrading"
       rm -- "${cargo_bin}/cargo-binstall${exe}"
     fi
   fi
@@ -416,65 +456,89 @@ init_install_action_bin_dir() {
 }
 canonicalize_windows_path() {
   case "${host_os}" in
-    windows) sed -E 's/^\/cygdrive\//\//; s/^\/c\//C:\\/; s/\//\\/g' <<<"$1" ;;
+    windows)
+      local t="$1"
+      if [[ "${t}" == '/cygdrive/'* ]]; then
+        t="${t#/cygdrive}"
+      fi
+      if [[ "${t}" == '/c/'* ]]; then
+        t="${t/\/c\//C:\\}"
+      fi
+      printf '%s\n' "${t//\//\\}"
+      ;;
     *) printf '%s\n' "$1" ;;
   esac
 }
 
-# cargo-binstall may call `cargo install` on their fallback: https://github.com/taiki-e/install-action/pull/54#issuecomment-1383140833
-# cross calls rustup on `cross --version` if the current directly is cargo workspace.
-export CARGO_NET_RETRY=10
-export RUSTUP_MAX_RETRIES=10
-
 if [[ $# -gt 0 ]]; then
   bail "invalid argument '$1'"
 fi
 
-export DEBIAN_FRONTEND=noninteractive
-manifest_dir="$(dirname -- "$0")/manifests"
-
 # Inputs
 tool="${INPUT_TOOL:-}"
 tools=()
 if [[ -n "${tool}" ]]; then
-  while read -rd,; do
+  while IFS= read -rd,; do
-    t="${REPLY# *}"
+    tools+=("${REPLY}")
-    tools+=("${t%* }")
+  done < <(normalize_comma_or_space_separated "${tool}")
-  done <<<"${tool},"
 fi
 if [[ ${#tools[@]} -eq 0 ]]; then
   warn "no tool specified; this could be caused by a dependabot bug where @<tool_name> tags on this action are replaced by @<version> tags"
-  # Exit with 0 for backward compatibility, we want to reject it in the next major release.
+  # Exit with 0 for backward compatibility.
+  # TODO: We want to reject it in the next major release.
   exit 0
 fi
 
 enable_checksum="${INPUT_CHECKSUM:-}"
 case "${enable_checksum}" in
   true) ;;
-  false) enable_checksum='' ;;
+  false)
+    enable_checksum=''
+    warn "checksums have been disabled by 'checksum' input option; this is strongly discouraged for security reasons"
+    ;;
   *) bail "'checksum' input option must be 'true' or 'false': '${enable_checksum}'" ;;
 esac
 
 fallback="${INPUT_FALLBACK:-}"
 case "${fallback}" in
-  none | cargo-binstall) ;;
+  none | cargo-binstall | cargo-install) ;;
-  *) bail "'fallback' input option must be 'none' or 'cargo-binstall': '${fallback}'" ;;
+  *) bail "'fallback' input option must be 'none', 'cargo-binstall', or 'cargo-install': '${fallback}'" ;;
 esac
 
-# Refs: https://github.com/rust-lang/rustup/blob/HEAD/rustup-init.sh
+# Unlike gh command, cargo-binstall reads GITHUB_TOKEN first via cli parser, and then reads GH_TOKEN.
+# https://github.com/cargo-bins/cargo-binstall/blob/v1.17.9/crates/bin/src/args.rs#L704
+token="${GITHUB_TOKEN:-"${GH_TOKEN:-"${DEFAULT_GITHUB_TOKEN:-}"}"}"
+# This prevents tokens from being exposed to subprocesses via environment variables.
+# Since the tokens remain in memory, setting `fallback: none` (which prevents the tokens from being
+# set in the first place) remains the best practice from a security standpoint, as readme says.
+# Note that this does not prevent token leaks via reading `/proc/*/environ` on Linux or
+# via `ps -Eww` on macOS. It only reduces the risk of leaks.
+unset GITHUB_TOKEN GH_TOKEN DEFAULT_GITHUB_TOKEN
+
+# Refs:
+# - https://github.com/rust-lang/rustup/blob/HEAD/rustup-init.sh
+# - https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#runner-context
+# NB: Sync with tools/ci/tool-list.sh.
 base_distro=''
 exe=''
-case "$(uname -s)" in
+case "${RUNNER_OS}" in
   Linux)
     host_os=linux
     ldd_version=$(ldd --version 2>&1 || true)
-    if grep -Fq musl <<<"${ldd_version}"; then
+    if [[ "${ldd_version}" == *'musl'* ]]; then
       host_env=musl
     else
       host_env=gnu
-      host_glibc_version=$(grep -E "GLIBC|GNU libc" <<<"${ldd_version}" | sed -E "s/.* //g")
+      host_glibc_version=$(grep -E "GLIBC|GNU libc" <<<"${ldd_version}")
+      host_glibc_version="${host_glibc_version##* }"
     fi
-    if [[ -e /etc/os-release ]]; then
+    if [[ -e /etc/redhat-release ]]; then
+      # /etc/os-release is available on RHEL/CentOS 7+
+      base_distro=fedora
+    elif [[ -e /etc/debian_version ]]; then
+      # /etc/os-release is available on Debian 7+
+      base_distro=debian
+    elif [[ -e /etc/os-release ]]; then
       if grep -Eq '^ID_LIKE=' /etc/os-release; then
         base_distro=$(grep -E '^ID_LIKE=' /etc/os-release | cut -d= -f2)
         case "${base_distro}" in
@@ -488,12 +552,6 @@ case "$(uname -s)" in
         base_distro=$(grep -E '^ID=' /etc/os-release | cut -d= -f2)
       fi
       base_distro="${base_distro//\"/}"
-    elif [[ -e /etc/redhat-release ]]; then
-      # /etc/os-release is available on RHEL/CentOS 7+
-      base_distro=fedora
-    elif [[ -e /etc/debian_version ]]; then
-      # /etc/os-release is available on Debian 7+
-      base_distro=debian
     fi
     case "${base_distro}" in
       fedora)
@@ -513,34 +571,58 @@ case "$(uname -s)" in
         ;;
     esac
     ;;
-  Darwin) host_os=macos ;;
+  macOS) host_os=macos ;;
-  MINGW* | MSYS* | CYGWIN* | Windows_NT)
+  Windows)
     host_os=windows
     exe=.exe
     ;;
-  *) bail "unrecognized OS type '$(uname -s)'" ;;
+  *) bail "unrecognized runner.os '${RUNNER_OS}'" ;;
 esac
-case "$(uname -m)" in
+case "${RUNNER_ARCH}" in
-  aarch64 | arm64) host_arch=aarch64 ;;
+  X64) host_arch=x86_64 ;;
-  xscale | arm | armv*l)
+  # Ignore 32-bit Arm for now, as we need to consider the version and whether hard-float is supported.
-    # Ignore Arm for now, as we need to consider the version and whether hard-float is supported.
+  # https://github.com/rust-lang/rustup/pull/593
-    # https://github.com/rust-lang/rustup/pull/593
+  # https://github.com/cross-rs/cross/pull/1018
-    # https://github.com/cross-rs/cross/pull/1018
+  # And support for 32-bit Arm will be removed in near future.
-    # Does it seem only armv7l+ is supported?
+  # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/#removal-of-operating-system-support-with-node24
-    # https://github.com/actions/runner/blob/v2.321.0/src/Misc/externals.sh#L178
+  # Does it seem only armv7l+ is supported?
-    # https://github.com/actions/runner/issues/688
+  # https://github.com/actions/runner/blob/v2.321.0/src/Misc/externals.sh#L178
-    bail "32-bit Arm runner is not supported yet by this action; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>"
+  # https://github.com/actions/runner/issues/688
+  ARM) bail "32-bit Arm runner is currently not supported; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
+  X86) bail "32-bit x86 runner is currently not supported; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
+  ARM64) host_arch=aarch64 ;;
+  PPC64LE) host_arch=powerpc64le ;;
+  RISCV64) host_arch=riscv64 ;;
+  S390X) host_arch=s390x ;;
+  *)
+    info "unrecognized runner.arch '${RUNNER_ARCH}'; fallback to uname -m"
+    case "$(uname -m)" in
+      aarch64 | arm64) host_arch=aarch64 ;;
+      xscale | arm | armv*l) bail "32-bit Arm runner is currently not supported; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
+      ppc64le) host_arch=powerpc64le ;;
+      riscv64) host_arch=riscv64 ;;
+      s390x) host_arch=s390x ;;
+      # Very few tools provide prebuilt binaries for these.
+      # TODO: fallback to `cargo install`? (binstall fallback is not good idea here as cargo-binstall doesn't provide prebuilt binaries for these.)
+      loongarch64 | mips | mips64 | ppc | ppc64 | sun4v) bail "$(uname -m) runner is not supported yet; please submit an issue at <https://github.com/taiki-e/install-action>" ;;
+      # GitHub Actions Runner supports x86_64/AArch64/Arm Linux and x86_64/AArch64 Windows/macOS.
+      # https://github.com/actions/runner/blob/v2.332.0/.github/workflows/build.yml#L24
+      # https://docs.github.com/en/actions/reference/runners/self-hosted-runners#supported-processor-architectures
+      # And IBM provides runners for powerpc64le/s390x Linux.
+      # https://github.com/IBM/actionspz
+      # So we can assume x86_64 unless it has a known non-x86_64 uname -m result.
+      *) host_arch=x86_64 ;;
+    esac
     ;;
-  # GitHub Actions Runner supports Linux (x86_64, AArch64, Arm), Windows (x86_64, AArch64),
-  # and macOS (x86_64, AArch64).
-  # https://github.com/actions/runner/blob/v2.321.0/.github/workflows/build.yml#L21
-  # https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#supported-architectures-and-operating-systems-for-self-hosted-runners
-  # So we can assume x86_64 unless it is AArch64 or Arm.
-  *) host_arch=x86_64 ;;
 esac
 info "host platform: ${host_arch}_${host_os}"
 
-home="${HOME}"
+home="${HOME:-}"
+if [[ -z "${home}" ]]; then
+  # https://github.com/IBM/actionspz/issues/30
+  home=$(realpath ~)
+  export HOME="${home}"
+fi
 if [[ "${host_os}" == "windows" ]]; then
   if [[ "${home}" == "/home/"* ]]; then
     if [[ -d "${home/\/home\///c/Users/}" ]]; then
@@ -557,24 +639,36 @@ fi
 install_action_dir="${home}/.install-action"
 tmp_dir="${install_action_dir}/tmp"
 cargo_bin="${CARGO_HOME:-"${home}/.cargo"}/bin"
+cargo_path=$(type -P cargo || true)
 # If $CARGO_HOME does not exist, or cargo installed outside of $CARGO_HOME/bin
 # is used ($CARGO_HOME/bin is most likely not included in the PATH), fallback to
 # $install_action_dir/bin.
 if [[ "${host_os}" == "windows" ]]; then
-  if type -P cargo >/dev/null; then
+  mkdir -p -- "${install_action_dir}"
-    info "cargo is located at $(type -P cargo)"
+  # See action.yml.
-    cargo_bin=$(dirname -- "$(type -P cargo)")
+  printf '' >|"${install_action_dir}"/init
+  if [[ -n "${cargo_path}" ]]; then
+    info "cargo is located at ${cargo_path}"
+    cargo_bin="${cargo_path%/*}"
   else
     cargo_bin="${install_action_dir}/bin"
   fi
-elif [[ ! -e "${cargo_bin}" ]] || [[ "$(type -P cargo || true)" != "${cargo_bin}/cargo"* ]]; then
+elif [[ ! -e "${cargo_bin}" ]] || [[ "${cargo_path}" != "${cargo_bin}/cargo"* ]]; then
-  if type -P cargo >/dev/null; then
+  if [[ -n "${cargo_path}" ]]; then
-    info "cargo is located at $(type -P cargo)"
+    info "cargo is located at ${cargo_path}"
   fi
   # Moving files to /usr/local/bin requires sudo in some environments, so do not use it: https://github.com/taiki-e/install-action/issues/543
   cargo_bin="${install_action_dir}/bin"
 fi
 
+# cargo-binstall may call `cargo install` on their fallback: https://github.com/taiki-e/install-action/pull/54#issuecomment-1383140833
+# cross calls rustup on `cross --version` if the current directly is cargo workspace.
+export CARGO_NET_RETRY=10
+export RUSTUP_MAX_RETRIES=10
+
+export DEBIAN_FRONTEND=noninteractive
+manifest_dir="${GITHUB_ACTION_PATH}/manifests"
+
 case "${host_os}" in
   linux)
     if ! type -P jq >/dev/null || ! type -P curl >/dev/null || ! type -P tar >/dev/null; then
@@ -609,27 +703,27 @@ case "${host_os}" in
           fi
           printf '::endgroup::\n'
           ;;
-        *) warn "install-action requires at least jq and curl on non-Debian/Fedora/SUSE/Arch/Alpine-based Linux" ;;
+        *) warn "this action requires at least jq and curl on non-Debian/Fedora/SUSE/Arch/Alpine-based Linux" ;;
       esac
     fi
     ;;
   macos)
     if ! type -P jq >/dev/null || ! type -P curl >/dev/null; then
-      warn "install-action requires at least jq and curl on macOS"
+      warn "this action requires at least jq and curl on macOS"
     fi
     ;;
   windows)
     if ! type -P curl >/dev/null; then
-      warn "install-action requires at least curl on Windows"
+      warn "this action requires at least curl on Windows"
     fi
     if [[ -f "${install_action_dir}/jq/bin/jq.exe" ]]; then
       jq() { "${install_action_dir}/jq/bin/jq.exe" -b "$@"; }
     elif type -P jq >/dev/null; then
       # https://github.com/jqlang/jq/issues/1854
-      _tmp=$(jq -r .a <<<'{}')
+      _tmp=$(jq -r .a <<<'{}' | wc -c)
-      if [[ "${_tmp}" != "null" ]]; then
+      if [[ "${_tmp}" != 5 ]]; then
-        _tmp=$(jq -b -r .a 2>/dev/null <<<'{}' || true)
+        _tmp=$({ jq -b -r .a 2>/dev/null <<<'{}' || true; } | wc -c)
-        if [[ "${_tmp}" == "null" ]]; then
+        if [[ "${_tmp}" == 5 ]]; then
           jq() { command jq -b "$@"; }
         else
           jq() { command jq "$@" | tr -d '\r'; }
@@ -638,8 +732,8 @@ case "${host_os}" in
     else
       printf '::group::Install packages required for installation (jq)\n'
       mkdir -p -- "${install_action_dir}/jq/bin"
-      url='https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-windows-amd64.exe'
+      url='https://github.com/jqlang/jq/releases/download/jq-1.8.1/jq-windows-amd64.exe'
-      checksum='7451fbbf37feffb9bf262bd97c54f0da558c63f0748e64152dd87b0a07b6d6ab'
+      checksum='23cb60a1354eed6bcc8d9b9735e8c7b388cd1fdcb75726b93bc299ef22dd9334'
       (
         cd -- "${install_action_dir}/jq/bin"
         download_and_checksum "${url}" "${checksum}"
@@ -654,20 +748,150 @@ esac
 
 unsupported_tools=()
 for tool in "${tools[@]}"; do
-  if [[ "${tool}" == *"@"* ]]; then
+  additional=''
+  if [[ "${tool}" == *'+'* ]]; then
+    additional="${tool#*+}"
+    tool="${tool%%+*}"
+  fi
+  if [[ "${tool}" == *'@'* ]]; then
     version="${tool#*@}"
     tool="${tool%@*}"
-    if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+    if [[ "${tool}" != 'rust' ]]; then
-      if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+      if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
-        bail "install-action does not support semver operators: '${version}'"
+        if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+          bail "semver operators are not supported in 'tool' input option: '${version}'"
+        fi
+        bail "install-action v2 does not support semver build-metadata: '${version}'; if you need these supports again, please submit an issue at <https://github.com/taiki-e/install-action>"
       fi
-      bail "install-action v2 does not support semver build-metadata: '${version}'; if you need these supports again, please submit an issue at <https://github.com/taiki-e/install-action>"
     fi
   else
     version=latest
   fi
+  if [[ -n "${additional}" ]]; then
+    case "${tool}" in
+      rust) ;;
+      *) bail "<tool_name>+<additional> syntax is not supported for ${tool}" ;;
+    esac
+  fi
   installed_bin=()
+  # NB: Update tools/ci/release-post-commit.sh when adding non-manifest-based tools.
   case "${tool}" in
+    rust)
+      if [[ "${version}" == 'latest' ]]; then
+        version=stable
+      fi
+      info "installing ${tool}@${version}"
+      export RUSTUP_MAX_RETRIES="${RUSTUP_MAX_RETRIES:-10}"
+      rustup_args=(--profile minimal)
+      if [[ -n "${additional}" ]]; then
+        component=''
+        target=''
+        while IFS= read -rd+; do
+          case "${REPLY}" in
+            # Last checked: nightly-2026-05-03
+            # rustup component list
+            # rustup target list
+            cargo | cargo-* | clippy | clippy-* | llvm-* | miri | miri-* | rust-* | rustc-* | rustfmt | rustfmt-*) component+=",${REPLY}" ;;
+            *) target+=",${REPLY}" ;;
+          esac
+        done <<<"${additional}+"
+        if [[ -n "${component}" ]]; then
+          if [[ "${component}," == *',miri,'* ]] && [[ "${component}," != *',rust-src,'* ]]; then
+            component+=',rust-src'
+          fi
+          rustup_args+=(--component "${component#,}")
+        fi
+        if [[ -n "${target}" ]]; then
+          rustup_args+=(--target "${target#,}")
+        fi
+      fi
+      if type -P rustup >/dev/null; then
+        # --no-self-update is necessary because the windows environment cannot self-update rustup.exe.
+        g retry rustup toolchain add "${version}" --no-self-update "${rustup_args[@]}"
+        g rustup default "${version}"
+      else
+        # https://github.com/rust-lang/rustup/tags
+        # Run tools/rustup-hash.sh to get sha256 hash.
+        rustup_version=1.29.0
+        # https://rust-lang.github.io/rustup/installation/other.html#manual-installation
+        rust_target=''
+        checksum=''
+        case "${host_os}" in
+          linux)
+            rust_target="${host_arch}-unknown-${host_os}-${host_env}"
+            case "${host_arch}" in
+              x86_64)
+                case "${host_env}" in
+                  gnu) checksum=4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10 ;;
+                  musl) checksum=9cd3fda5fd293890e36ab271af6a786ee22084b5f6c2b83fd8323cec6f0992c1 ;;
+                esac
+                ;;
+              aarch64)
+                case "${host_env}" in
+                  gnu) checksum=9732d6c5e2a098d3521fca8145d826ae0aaa067ef2385ead08e6feac88fa5792 ;;
+                  musl) checksum=88761caacddb92cd79b0b1f939f3990ba1997d701a38b3e8dd6746a562f2a759 ;;
+                esac
+                ;;
+              powerpc64le)
+                case "${host_env}" in
+                  gnu) checksum=4bfff85bd3967d988e14567aa9cc6ab0ea386f0ffeff0f9f14d23f0103bf1f97 ;;
+                  musl) checksum=e15d033af90b7a55d170aac2d82cc28ddd96dbfcdda7c6d4eb8cb064a99c4646 ;;
+                esac
+                ;;
+              riscv64)
+                rust_target="${host_arch}gc-unknown-${host_os}-${host_env}"
+                # riscv64gc-unknown-linux-musl is tier 2 without host tools
+                case "${host_env}" in
+                  gnu) checksum=7e43f2b2e6307d61da17a4dff61e6bceef408b8189822df64e1094590d2a70f9 ;;
+                esac
+                ;;
+              s390x)
+                # s390x-unknown-linux-musl is tier 3
+                case "${host_env}" in
+                  gnu) checksum=66c2c132428b6b77803facb02cbdf33b89d20c00bd20da142be8cb651f2e7cd8 ;;
+                esac
+                ;;
+            esac
+            ;;
+          macos)
+            rust_target="${host_arch}-apple-darwin"
+            case "${host_arch}" in
+              x86_64) checksum=33cf85df9142bc6d29cbc62fa5ca1d4c29622cddb55213a4c1a43c457fb9b2d7 ;;
+              aarch64) checksum=aeb4105778ca1bd3c6b0e75768f581c656633cd51368fa61289b6a71696ac7e1 ;;
+            esac
+            ;;
+          windows)
+            rust_target="${host_arch}-pc-windows-msvc"
+            case "${host_arch}" in
+              x86_64) checksum=86478e53f769379d7f0ebfa7c9aa97cb76ca92233f79aa2cc0dbee2efaac73c7 ;;
+              aarch64) checksum=3af309e6c3062aa11df0e932954f69d13b734d8a431e593812f3ecd9ff9e6ef6 ;;
+            esac
+            ;;
+        esac
+        if [[ -z "${rust_target}" ]] || [[ -z "${checksum}" ]]; then
+          bail "unsupported host platform ${host_arch}_${host_os} for ${tool}"
+        fi
+        url="https://static.rust-lang.org/rustup/archive/${rustup_version}/${rust_target}/rustup-init${exe}"
+        mkdir -p -- "${tmp_dir}"
+        (
+          cd -- "${tmp_dir}"
+          download_and_checksum "${url}" "${checksum}"
+          mv -- tmp rustup-init
+          case "${host_os}" in
+            linux | macos) chmod +x ./rustup-init ;;
+          esac
+          g retry ./rustup-init -y --default-toolchain "${version}" --no-modify-path "${rustup_args[@]}"
+        )
+        rm -rf -- "${tmp_dir}"
+        cargo_bin_dir="${CARGO_HOME:-"${home}/.cargo"}/bin"
+        export PATH="${PATH}:${cargo_bin_dir}"
+        cargo_bin_dir=$(canonicalize_windows_path "${cargo_bin_dir}")
+        info "adding '${cargo_bin_dir}' to PATH"
+        printf '%s\n' "${cargo_bin_dir}" >>"${GITHUB_PATH}"
+        cargo_path=$(type -P cargo || true)
+      fi
+      installed_bin=("rustc${exe}" "cargo${exe}")
+      ;;
     protoc)
       info "installing ${tool}@${version}"
       read_manifest "protoc" "${version}"
@@ -709,11 +933,11 @@ for tool in "${tools[@]}"; do
       info "installing ${tool}@${version}"
       case "${version}" in
         latest) ;;
-        *) warn "specifying the version of ${tool} is not supported yet by this action" ;;
+        *) warn "specifying the version of ${tool} is not supported" ;;
       esac
       case "${host_os}" in
         linux) ;;
-        macos | windows) bail "${tool} for non-Linux is not supported yet by this action" ;;
+        macos | windows) bail "${tool} for non-Linux is not supported" ;;
         *) bail "unsupported host OS '${host_os}' for ${tool}" ;;
       esac
       # libc6-dbg is needed to run Valgrind
@@ -726,16 +950,20 @@ for tool in "${tools[@]}"; do
     cargo-binstall)
       case "${version}" in
         latest) ;;
-        *) warn "specifying the version of ${tool} is not supported by this action" ;;
+        *) warn "specifying the version of ${tool} is not supported" ;;
       esac
       install_cargo_binstall
       printf '\n'
       continue
       ;;
     *)
-      # Handle aliases
+      # Handle aliases.
+      # NB: Update alias list in tools/ci/release-post-commit.sh, tool input option in test-alias in .github/workflows/ci.yml,
+      # and match for alias for tools/codegen/src/tools-markdown.rs.
+      # TODO(codegen): auto-detect cases where crate name and tool name are different.
       case "${tool}" in
-        cargo-nextest | nextest) tool=cargo-nextest ;;
+        nextest) tool=cargo-nextest ;;
+        taplo-cli | typos-cli | wasm-bindgen-cli | wasmtime-cli) tool="${tool%-cli}" ;;
       esac
 
       # Use cargo-binstall fallback if tool is not available.
@@ -750,10 +978,10 @@ for tool in "${tools[@]}"; do
       # Use cargo-binstall fallback if tool is available but the specified version not available.
       read_manifest "${tool}" "${version}"
       if [[ "${download_info}" == "null" ]]; then
-        if [[ "${rust_crate}" == "null" ]]; then
+        if [[ "${rust_crate}" == "null" ]] || [[ "${fallback}" == "none" ]]; then
-          bail "${tool}@${version} for '${host_arch}_${host_os}' is not supported"
+          bail "${tool} is supported but version ${version} for '${host_arch}_${host_os}' is not supported (updating install-action might resolve this)"
         fi
-        warn "${tool}@${version} for '${host_arch}_${host_os}' is not supported; fallback to cargo-binstall"
+        warn "${tool} is supported but version ${version} for '${host_arch}_${host_os}' is not supported (updating install-action might resolve this); fallback to ${fallback}"
         case "${version}" in
           latest) unsupported_tools+=("${rust_crate}") ;;
           *) unsupported_tools+=("${rust_crate}@${version}") ;;
@@ -774,6 +1002,13 @@ for tool in "${tools[@]}"; do
               ;;
           esac
           ;;
+        cyclonedx)
+          case "${host_os}" in
+            linux)
+              apt_install libicu-dev
+              ;;
+          esac
+          ;;
       esac
 
       download_from_download_info "${tool}" "${version}"
@@ -802,15 +1037,18 @@ for tool in "${tools[@]}"; do
       # biome up to 1.2.2 exits with 1 on both --version and --help flags.
       # cargo-machete up to 0.6.0 does not support --version flag.
       # wait-for-them up to 0.4.0 does not support --version flag.
-      biome | cargo-machete | wait-for-them) rx "${tool_bin_stem}" --version || true ;;
+      # gungraun-runner up to 0.17.1 (exclusive) does not support --version flag.
+      biome | cargo-machete | wait-for-them | gungraun-runner) rx "${tool_bin_stem}" --version || true ;;
       # these packages support neither --version nor --help flag.
-      cargo-auditable | cargo-careful | wasm-bindgen-test-runner) ;;
+      cargo-auditable | cargo-careful | wasm-bindgen-test-runner | cargo-apple-runner) ;;
       # wasm2es6js does not support --version flag and --help flag doesn't contains version info.
       wasm2es6js) ;;
-      # cargo-zigbuild has no --version flag on `cargo zigbuild` subcommand.
+      # iai-callgrind-runner --version works only with iai-callgrind in nearby Cargo.toml.
-      cargo-zigbuild) rx "${tool_bin_stem}" --version ;;
+      iai-callgrind-runner) ;;
-      # deepsource has version command instead of --version flag.
+      # cargo-zigbuild/cargo-insta has no --version flag on `cargo $tool_bin_stem` subcommand.
-      deepsource) rx "${tool_bin_stem}" version ;;
+      cargo-zigbuild | cargo-insta) rx "${tool_bin_stem}" --version ;;
+      # these packages have version command instead of --version flag.
+      cosign | deepsource | vacuum) rx "${tool_bin_stem}" version ;;
       cargo-*)
         case "${tool_bin_stem}" in
           # cargo-valgrind 2.1.0's --version flag just calls cargo's --version flag
@@ -835,22 +1073,93 @@ done
 if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
   IFS=','
   case "${fallback}" in
-    none) bail "install-action does not support ${unsupported_tools[*]} (fallback is disabled by 'fallback: none' input option)" ;;
+    none) bail "install-action does not support ${unsupported_tools[*]} (updating install-action might resolve this); aborting because fallback is disabled by 'fallback: none' input option" ;;
+    cargo-binstall)
+      case "${host_arch}" in
+        x86_64 | aarch64 | riscv64) ;;
+        *)
+          info "cargo-binstall does not provide prebuilt binaries for this platform (${host_arch}); use 'cargo-install' fallback instead"
+          fallback=cargo-install
+          ;;
+      esac
+      ;;
   esac
-  info "install-action does not support ${unsupported_tools[*]}; fallback to cargo-binstall"
+  info "install-action does not support ${unsupported_tools[*]} (updating install-action might resolve this); fallback to ${fallback}"
   IFS=$'\n\t'
-  install_cargo_binstall
+  case "${fallback}" in
-  if [[ -z "${GITHUB_TOKEN:-}" ]] && [[ -n "${DEFAULT_GITHUB_TOKEN:-}" ]]; then
+    cargo-binstall)
-    export GITHUB_TOKEN="${DEFAULT_GITHUB_TOKEN}"
+      install_cargo_binstall
-  fi
+      # By default, cargo-binstall enforce downloads over secure transports only.
-  # By default, cargo-binstall enforce downloads over secure transports only.
+      # As a result, http will be disabled, and it will also set
-  # As a result, http will be disabled, and it will also set
+      # min tls version to be 1.2
-  # min tls version to be 1.2
+      binstall_args=(
-  cargo-binstall binstall --force --no-confirm --locked "${unsupported_tools[@]}"
+        --force
-  if ! type -P cargo >/dev/null; then
+        --no-confirm
-    _bin_dir=$(canonicalize_windows_path "${home}/.cargo/bin")
+        --locked
-    # TODO: avoid this when already added
+        # Since the build script can access the token when `cargo install` is called
-    info "adding '${_bin_dir}' to PATH"
+        # within `cargo-binstall`, disables building from source in cargo-binstall
-    printf '%s\n' "${_bin_dir}" >>"${GITHUB_PATH}"
+        # and fallback to `cargo install` which doesn't need the token.
-  fi
+        # TODO: once https://github.com/cargo-bins/cargo-binstall/pull/2533 merged,
+        # we can remove this and use batch install again.
+        --disable-strategies compile
+      )
+      unsupported_tools2=()
+      for tool in "${unsupported_tools[@]}"; do
+        if [[ -n "${token}" ]]; then
+          if ! GITHUB_TOKEN="${token}" cargo-binstall binstall "${binstall_args[@]}" "${tool}"; then
+            warn "cargo-binstall fallback does not support prebuilt binaries for ${tool} on this platform (${host_arch}); use 'cargo-install' fallback instead"
+            unsupported_tools2+=("${tool}")
+          fi
+        else
+          if ! cargo-binstall binstall "${binstall_args[@]}" "${tool}"; then
+            warn "cargo-binstall fallback does not support prebuilt binaries for ${tool} on this platform (${host_arch}); use 'cargo-install' fallback instead"
+            unsupported_tools2+=("${tool}")
+          fi
+        fi
+      done
+      if [[ ${#unsupported_tools2[@]} -gt 0 ]]; then
+        for tool in "${unsupported_tools2[@]}"; do
+          # This logic is from cache-cargo-install-action.
+          cargo_args=(--locked)
+          if [[ "${tool}" == *"@"* ]]; then
+            version="${tool#*@}"
+            tool="${tool%@*}"
+            if [[ ! "${version}" =~ ^([1-9][0-9]*\.[0-9]+\.[0-9]+|0\.[1-9][0-9]*\.[0-9]+|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+              if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+                bail "install-action does not support non-semver version: '${version}'"
+              fi
+              crate_info=$(retry curl --user-agent "${ACTION_USER_AGENT}" --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${tool}")
+              if [[ ! "${version}" =~ ^[0-9]+(\.[0-9]+)?$ ]]; then
+                bail "install-action does not support non-semver version: '${version}'"
+              fi
+              # shellcheck disable=SC2207
+              versions=($(jq -r --arg start "${version}." '.versions[] | select(.num | startswith($start)) | select(.yanked == false) | .num' <<<"${crate_info}"))
+              full_version=''
+              for v in ${versions[@]+"${versions[@]}"}; do
+                if [[ "${v}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(\+[0-9A-Za-z\.-]+)?$ ]]; then
+                  full_version="${v}"
+                  break
+                fi
+              done
+              if [[ -z "${full_version}" ]]; then
+                bail "no stable version found for ${tool} that match with '${version}.*'; if you want to install a pre-release version, please specify the full version"
+              fi
+              version="${full_version}"
+            fi
+            cargo_args+=(--version "${version}")
+          fi
+          cargo install "${cargo_args[@]}" "${tool}"
+        done
+      fi
+      if [[ -z "${cargo_path}" ]]; then
+        _bin_dir=$(canonicalize_windows_path "${home}/.cargo/bin")
+        info "adding '${_bin_dir}' to PATH"
+        printf '%s\n' "${_bin_dir}" >>"${GITHUB_PATH}"
+      fi
+      ;;
+    cargo-install)
+      cargo install --locked "${unsupported_tools[@]}"
+      ;;
+    *) bail "unhandled fallback ${fallback}" ;;
+  esac
 fi

manifests/auto-doc.json

@@ -0,0 +1,342 @@
+{
+  "rust_crate": null,
+  "template": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/tj-actions/auto-doc/releases/download/v${version}/auto-doc_${version}_Linux_x86_64.tar.gz",
+      "bin": "auto-doc"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/tj-actions/auto-doc/releases/download/v${version}/auto-doc_${version}_Darwin_x86_64.tar.gz",
+      "bin": "auto-doc"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/tj-actions/auto-doc/releases/download/v${version}/auto-doc_${version}_Windows_x86_64.zip",
+      "bin": "auto-doc.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/tj-actions/auto-doc/releases/download/v${version}/auto-doc_${version}_Linux_arm64.tar.gz",
+      "bin": "auto-doc"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/tj-actions/auto-doc/releases/download/v${version}/auto-doc_${version}_Darwin_arm64.tar.gz",
+      "bin": "auto-doc"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/tj-actions/auto-doc/releases/download/v${version}/auto-doc_${version}_Windows_arm64.zip",
+      "bin": "auto-doc.exe"
+    }
+  },
+  "latest": {
+    "version": "3.6.0"
+  },
+  "3": {
+    "version": "3.6.0"
+  },
+  "3.6": {
+    "version": "3.6.0"
+  },
+  "3.6.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD6969CA0AF360",
+      "hash": "7d48b15f8ccc24a90c358632cc4095299667c7d8348b9a9a22759d8fa6ff63f6"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD6969C9F5D586",
+      "hash": "b6d49dc9d38981df9abd96b38911fcb9f71ba9c7f2b745c3e005c6b1b1c42c4c"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD6969C99DDF69",
+      "hash": "0c4afb8ef7fc1b3519d39dc8f1e586e67352dcebe6bf612f72f157f4ff77d6ac"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD6969CA5DBF27",
+      "hash": "004b2427e626b785598d546cc227abd538211d30505000c503001b74393e65d4"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DD6969C9EA22DA",
+      "hash": "a65a28c1faaddb9d3d5237c73cf5111bef197754906d1c530c83dcac3443169f"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DD6969C9905A17",
+      "hash": "ed12610509bf36c42a1c34d0e0cece1f5120a5381b23751c4d1fa8a44b908d83"
+    }
+  },
+  "3.5": {
+    "version": "3.5.0"
+  },
+  "3.5.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DC65D142257ECD",
+      "hash": "0c49170d137ab1b1f6a0f7bce8ab6c8f1c7be5f5232c4c447e2d4681944c98e4"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DC65D1435E4C83",
+      "hash": "65e99107be982f4a084ac9b7fc9db495f1c307d0334c190164635cca4577224f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DC65D14230481F",
+      "hash": "43798a7fbb25a125c2339ea60d3de5e68c54a9f21776ede80bc5a01a4357bf73"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DC65D1435BDE40",
+      "hash": "d7aa932e5da21e44b4980b53ae507d1f3d55fed686d7d2d3a18d47014dbd27ce"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DC65D1422BB95B",
+      "hash": "98a6fa12ddd70b76259c04db3b81e7c5b845fe9e24a75632521b376a80d802df"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DC65D14241C0AE",
+      "hash": "1a22dabee9ec7b865163b41cff4dd227490881382fd351d0719aff7d42c324a3"
+    }
+  },
+  "3.4": {
+    "version": "3.4.1"
+  },
+  "3.4.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DC0CE3CEC5DED0",
+      "hash": "6558c5cdeb79a4a3ed90f6f4f2409ec4cf8900278e686abfb0ffa3bdf2e2815b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DC0CE3CEEC7544",
+      "hash": "6b7e86e555159c6058ab2e4df521370d7a7b41522eb5736245bb503d230d076b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DC0CE3CE72298C",
+      "hash": "0dfc7ecbc2cd263d5329a1e618ba8fc06439f2f9f826269ba45cc70c2fcce078"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DC0CE3CEFBCD57",
+      "hash": "17140370329a7f59d86d49d1a82e4c089a40cfb79d2340034041226c97131966"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DC0CE3D7100B1F",
+      "hash": "6f61a5a5162ff3614fd444e8909b0f81b28bdb5b1d6f2fc247ceaaff827f4d81"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DC0CE3CF3E7EB6",
+      "hash": "43285d732f987bdbfb0264c6aff208f391969784d58da4871e8eab1e8a4aaf97"
+    }
+  },
+  "3.4.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBE8B5B371D05E",
+      "hash": "9bdd3c0852814a3761b5bf06b078f3f85e9a982fc938fe174efd12280b669028"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBE8B5B271AD7D",
+      "hash": "bf9ba0171c3e1490a08268b342d4c09c9350faf53674a736e42d9cd240f7f2ec"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBE8B5B27296DE",
+      "hash": "b55bec9ccd7b65b0833610cc8e16e18fd7024a73d87c21a7490727da432bc449"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBE8B5B254F704",
+      "hash": "434459a478c7d0483b684bd2ee6a2febb5f5ee93a0eca9d352162d866d4bb6fe"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBE8B5B34F7AE7",
+      "hash": "e387010d53a490fd6f9dd52a1284967447d4c9521734367dc77a2c262198b59d"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBE8B5B46494CD",
+      "hash": "34f7f0bc2ebcda0da150e90578b441b590f1f6795dc9adfdabfa005f3539aaa3"
+    }
+  },
+  "3.3": {
+    "version": "3.3.0"
+  },
+  "3.3.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBE654B8C22BB8",
+      "hash": "aee132848c1ff48576c9d4b6afd9cb09d960e3506f0a9d749813702bd64b7beb"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBE654CADCEE10",
+      "hash": "0eebc51f42f357ad30bdccb7de0b5a5ebad04e58818c89d25e4b4cc6ae2a01ad"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBE654BBCF5736",
+      "hash": "b940ab87696f25de1de2d896e17cf78c40bb2415a0f169a49272c05649f8624f"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBE654CA9A8A8B",
+      "hash": "97291d19167023840656860589ce6dc3888c6f27fe588688c2da08487d615acb"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBE654B7D994FE",
+      "hash": "0e6f10f25895ae055351fb4c5afc1b11ca34ad26ce9a1b9c2d5897578c93aa8a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBE654BE084771",
+      "hash": "a199341f984375bb02ef3f7c89ec24d1bd7d35017c7185b1b96b3cc06403ab20"
+    }
+  },
+  "3.2": {
+    "version": "3.2.1"
+  },
+  "3.2.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBE5F2F94C6800",
+      "hash": "fe44709bbd9886b8d9f441ad7f6bf3d105a8a24e3ea3dd603eb2d6c4957c7273"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBE5F2E998C4FD",
+      "hash": "652c6c26327f43113edbdd1701411d8c44f238c931a1fdd334b2ad4ebae3ce69"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBE5F2E9727C50",
+      "hash": "d55e685da3dc2c1b53352a111b6283a533aa063c45e6466dfd0e0698b26bebf5"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBE5F2EA2351E3",
+      "hash": "fb82a8e9ff9ced50491056eb8fbbe66cc7b5f0721649c266d84c09b11821a500"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBE5F2E9DA6605",
+      "hash": "0c83d263eeab4037c65d715af12e64f1563499afad7934616bdea40b5bd21574"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBE5F2EA87E3F7",
+      "hash": "6e604776a1d72c5722062c808f06492e90f975d88b426fcd76d077be0c6a58c7"
+    }
+  },
+  "3.2.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBE596A0D6471B",
+      "hash": "7c5cdb8e11b1bdb74761fbf2a19034ba69e0369d802d4bd5f0da4842c4d21818"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBE596A15A729E",
+      "hash": "a1318e97da9d7b678479f2903979b00805e2f798cd67cef9e0940bad8d75de2e"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBE596A0E771D2",
+      "hash": "af13aa77295865a15ede68b6fbce57d2e0bdced9cb6fc70496d9cc61f411b913"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBE596A02B1084",
+      "hash": "ca460fe62381e622c2f58030715068589b383ec999d81adab3ac1c324d3e6b20"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBE596A6C9454C",
+      "hash": "acc1cbae30971d07a4dcec7b42bfa645ddf2568639a481443c6a44e4bcdabd79"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBE596A77B9FCE",
+      "hash": "cd713cb6471389cda1ac73c1def9966bc7b77fac56b6c024032f416924fb4d33"
+    }
+  },
+  "3.1": {
+    "version": "3.1.1"
+  },
+  "3.1.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBE2FBB991EC80",
+      "hash": "70f956effa6bf14c17a1a6743d0be113f0e48109c62e2ec1c73bb07ef4f04d94"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBE2FBB8E7788A",
+      "hash": "b82ee75f351e15584be180900d7cbaa0a889b14b8de170ab4591bc85ea84e8fd"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBE2FBB7D3BCE8",
+      "hash": "7ed5ddc15603726cf02772e770d68a15bccd38acb0719afcd37ab5c7be96a245"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBE2FBB853A75D",
+      "hash": "75af80cbe3dce49489add93bdb8b9c68c7a4339d16bb4c93d3c911ac24622538"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBE2FBB7CE1DF9",
+      "hash": "ee777e74975811b926b1c6580cd28aa81749f1fac2cbbf325a16ce754fe02a8c"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBE2FBB7F832D2",
+      "hash": "66f087a13557118ecb2f0f14e90015d3fe184cd052968655cfd986a236b3023e"
+    }
+  },
+  "3.1.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBBC8C702FC588",
+      "hash": "f59d87a44332e196de7cbde48066e8dd08c1f78a311cacadaf87a7af8b218c69"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBBC8C719ECF49",
+      "hash": "d792253adcac5cc73d07a377ac57aef0847d11cc6516e21ea2ee90b99c1632a3"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBBC8C72A77440",
+      "hash": "24a5876e920135cb438ce9c754cd121f7ec0cf419d72861ca9ea1be2f61830b6"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBBC8C71C90B1B",
+      "hash": "a4415633faf1a0dcca96e2c56b5b590dda585df91c72d90268102ef1c338182e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBBC8C70C0DADB",
+      "hash": "f0529aad4cca0c584d68d11f76c943476c08ea2f5656bff3fba13c3a304f7a31"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBBC8C70A81788",
+      "hash": "15f05eb364103f9ab62d8bdafe0d18884718c37bd9c457dbed7f2dd89a7b8d86"
+    }
+  },
+  "3.0": {
+    "version": "3.0.1"
+  },
+  "3.0.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBB54FC922B951",
+      "hash": "8d2aea8302d709643aa463deec09b8f980283b97ae5e1fce6d5f5daf10213a3b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBB54FCA342DDC",
+      "hash": "59dba1bcaa80a91b8e0efad5f3e824baa72055110719230cc7cd53349b7b3aaa"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBB54FC9982862",
+      "hash": "cc1ebbd2c21b34f0249aef8e46dabcab1f01c51a341056add10c940ced1811d8"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBB54FCB174C8A",
+      "hash": "f5dc146f7ad89b7946bbec72e9a25d6f260be21031ae1a71288fafec906ae70c"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBB54FC8BD16F7",
+      "hash": "4714ad284a94cb911325cf45724b135e49b83e91484a3296d023f8fd33add16a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBB54FCA04530E",
+      "hash": "8642a01e7fb1343193d5578744d3bea15232a1b9d48a149e16e9572488565e54"
+    }
+  },
+  "3.0.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBA448EB128B2D",
+      "hash": "0411abbcc4ccadfd991e6d5e1ff9b358034dc7f174f87b57597f6aa3fd9a64e4"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBA448EA97085D",
+      "hash": "521b0483cce97928aaf64fb7636e9ea92f56140bd9e258643357bd123c00e0ca"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBA448EC0990C9",
+      "hash": "dafb22369b616cb9d0fb28dece56a1c525c507060a74b46741681374f60cfc45"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBA448EA93FE89",
+      "hash": "a71aed4198e41e3c1e38cc9c5c9c4b733c0181a113ac511a9b342f34ec4d3df8"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBA448EB28B956",
+      "hash": "a6392e2ec6946ee56cb912b751d97ef89b79de2253d3cc1ff9608fdc8662343a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBA448EC76572C",
+      "hash": "e03f041feeea504104edb2b742761de044b55b965223044c1abb9ce2ed37bd6a"
+    }
+  }
+}

manifests/cargo-apple-runner.json

@@ -0,0 +1,26 @@
+{
+  "rust_crate": "cargo-apple-runner",
+  "template": {
+    "x86_64_macos": {
+      "url": "https://github.com/madsmtm/cargo-apple-runner/releases/download/v${version}/cargo-apple-runner-x86_64-apple-darwin.tar.gz",
+      "bin": "cargo-apple-runner"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/madsmtm/cargo-apple-runner/releases/download/v${version}/cargo-apple-runner-aarch64-apple-darwin.tar.gz",
+      "bin": "cargo-apple-runner"
+    }
+  },
+  "latest": {
+    "version": "0.0.1"
+  },
+  "0.0.1": {
+    "x86_64_macos": {
+      "etag": "0x8DE9E56906B2739",
+      "hash": "66e53e60e1502d6c6e57aed9c423ecbe9f155fbcee56824a20eb72c49136a554"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E56816E1F2D",
+      "hash": "58b94a77328568eff1c8d1216f51933c0753d20365b2284cf3a1dca843a6d0c1"
+    }
+  }
+}

manifests/cargo-audit.json

@@ -16,11 +16,57 @@
     "aarch64_linux_gnu": {
       "url": "https://github.com/rustsec/rustsec/releases/download/cargo-audit/v${version}/cargo-audit-aarch64-unknown-linux-gnu-v${version}.tgz",
       "bin": "cargo-audit-aarch64-unknown-linux-gnu-v${version}/cargo-audit"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/rustsec/rustsec/releases/download/cargo-audit/v${version}/cargo-audit-aarch64-apple-darwin-v${version}.tgz",
+      "bin": "cargo-audit-aarch64-apple-darwin-v${version}/cargo-audit"
     }
   },
-  "license_markdown": "[Apache-2.0](https://github.com/rustsec/rustsec/blob/HEAD/cargo-audit/LICENSE-APACHE) OR [MIT](https://github.com/rustsec/rustsec/blob/HEAD/cargo-audit/LICENSE-MIT)",
   "latest": {
-    "version": "0.21.2"
+    "version": "0.22.1"
+  },
+  "0.22": {
+    "version": "0.22.1"
+  },
+  "0.22.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE64325DF487BC",
+      "hash": "c32506f338bdcdaef5a17fb9f33abb6ecf9561324cfd34237fd335f9283a1eab"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE643275BD00A9",
+      "hash": "582d104a2a4bdb127c6bf6d056d89eede40686d11f52e4bc1765132ec99d2fca"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE6432BF97AAED",
+      "hash": "1523eedc57675eff07b230c06dcd545f3cb04e0ebf92f4009218c79000279a74"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE64326434D959",
+      "hash": "4c8df835ee484441bd2c8c6bcac28c4ce4b4058ba9e7477cb9e0012fe7769f66"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE643283AA3EF2",
+      "hash": "04e76e1da25f597bea4814c44faf8aac215838b9f3646e3b6a873d87acd31b73"
+    }
+  },
+  "0.22.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE1E42AFC17765",
+      "hash": "0ea7a15f67d5007af5bd18f89be38a90ebd004f149dc36ebfab0aedba24cbb4f"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE1E42C23BA523",
+      "hash": "be2c3f86cdaf39ad88a58a151a946b2360c38cc2ec056dd6aa4cf0dbbcf9e809"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE1E431B4A43B3",
+      "hash": "c4e309c9b6da7dd63a0c191b39ce4c2d48eb7c5cd538dbfdc180c26f02baa777"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE1E42B2AAA237",
+      "hash": "64ddb7e99b171a881ea2c9f4ec5efa7b988f9131949d957bcd18d17a981b5302"
+    }
   },
   "0.21": {
     "version": "0.21.2"
@@ -28,55 +74,55 @@
   "0.21.2": {
     "x86_64_linux_musl": {
       "etag": "0x8DD57EB7FBC973F",
-      "checksum": "422912aa851458bc9bf37a458b75890cb5a4e2a7e5216dcee7df91507fc594d9"
+      "hash": "422912aa851458bc9bf37a458b75890cb5a4e2a7e5216dcee7df91507fc594d9"
     },
     "x86_64_macos": {
       "etag": "0x8DD57EB6E096D56",
-      "checksum": "35bb991a09591ace872c86210931875dca013a53400eddb75ff2883e00b8eb67"
+      "hash": "35bb991a09591ace872c86210931875dca013a53400eddb75ff2883e00b8eb67"
     },
     "x86_64_windows": {
       "etag": "0x8DD57EBD7A4AB19",
-      "checksum": "9499b234149962c03f2e4d089ecc756c598d8fee6531f76c719a47feaff7468e"
+      "hash": "9499b234149962c03f2e4d089ecc756c598d8fee6531f76c719a47feaff7468e"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8DD57EB8E4432AF",
-      "checksum": "f29959b2792bb0864db5db1d2facf16c2f8bc3be323ca57cee9609147cd6f64d"
+      "hash": "f29959b2792bb0864db5db1d2facf16c2f8bc3be323ca57cee9609147cd6f64d"
     }
   },
   "0.21.1": {
     "x86_64_linux_musl": {
       "etag": "0x8DD383807A86B60",
-      "checksum": "e1d057a43028cb2359adcb75029e345b5791fbd2a1a01a3b8f16521035662cf3"
+      "hash": "e1d057a43028cb2359adcb75029e345b5791fbd2a1a01a3b8f16521035662cf3"
     },
     "x86_64_macos": {
       "etag": "0x8DD3837D203A3C3",
-      "checksum": "ca21223691975d97a2442623a4d90e933d349199a728fdabaf98124ff65ee53f"
+      "hash": "ca21223691975d97a2442623a4d90e933d349199a728fdabaf98124ff65ee53f"
     },
     "x86_64_windows": {
       "etag": "0x8DD383870DE65E0",
-      "checksum": "cb90ebf6c76bdf7014fb0114b3bc897917ce0ea5ecaf16f7dc7009612941dace"
+      "hash": "cb90ebf6c76bdf7014fb0114b3bc897917ce0ea5ecaf16f7dc7009612941dace"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8DD383809DEED88",
-      "checksum": "bd9a9ceb4887f28c8ace1a35da39818cbdcf98b1088bcd47544bff3a07e856bf"
+      "hash": "bd9a9ceb4887f28c8ace1a35da39818cbdcf98b1088bcd47544bff3a07e856bf"
     }
   },
   "0.21.0": {
     "x86_64_linux_musl": {
       "etag": "0x8DCF84BECAB600C",
-      "checksum": "1afe6f3dba2e3d81dfb8db34be37ae9647480b132cd719357276ae643ebf962a"
+      "hash": "1afe6f3dba2e3d81dfb8db34be37ae9647480b132cd719357276ae643ebf962a"
     },
     "x86_64_macos": {
       "etag": "0x8DCF84BD142518E",
-      "checksum": "87e0a4aece55917ebe02b73e7c69fe83c4d995b8fc435820f24bd92a9c2c1fb8"
+      "hash": "87e0a4aece55917ebe02b73e7c69fe83c4d995b8fc435820f24bd92a9c2c1fb8"
     },
     "x86_64_windows": {
       "etag": "0x8DCF84C58F8B68A",
-      "checksum": "eee7d67cdb72188df354215b9a8f034caf5d928662743350f06db2c3ae677b90"
+      "hash": "eee7d67cdb72188df354215b9a8f034caf5d928662743350f06db2c3ae677b90"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8DCF84BEA0119A8",
-      "checksum": "cbe5617406a1af2270f4ffc1b933759bd9bb0d890c0b2efafdf31ecf5b0adfa3"
+      "hash": "cbe5617406a1af2270f4ffc1b933759bd9bb0d890c0b2efafdf31ecf5b0adfa3"
     }
   },
   "0.20": {
@@ -85,19 +131,19 @@
   "0.20.0": {
     "x86_64_linux_musl": {
       "etag": "0x8DC2E91E9960B2A",
-      "checksum": "c8bb83967f74734a5a4b23b0136c26db3fcc81570eb389cffda4d67ea6d8ad9a"
+      "hash": "c8bb83967f74734a5a4b23b0136c26db3fcc81570eb389cffda4d67ea6d8ad9a"
     },
     "x86_64_macos": {
       "etag": "0x8DC2E91F7376884",
-      "checksum": "3f4022fd3010e0e9ffa8b8a75b80ab365c9ab1c3f3d2dd6af6385bb803778f9f"
+      "hash": "3f4022fd3010e0e9ffa8b8a75b80ab365c9ab1c3f3d2dd6af6385bb803778f9f"
     },
     "x86_64_windows": {
       "etag": "0x8DC2E924FCC97C6",
-      "checksum": "ec8d3b6e722b01bf51efc1b56dbaf542f4d4101e70f3f45ae4dda52e6f71d2b0"
+      "hash": "ec8d3b6e722b01bf51efc1b56dbaf542f4d4101e70f3f45ae4dda52e6f71d2b0"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8DC2E91E8770F94",
-      "checksum": "fb2fbd1f5d36aa131451115183d24605e3ca7f656c6994ec03dfc3b7c581cf4a"
+      "hash": "fb2fbd1f5d36aa131451115183d24605e3ca7f656c6994ec03dfc3b7c581cf4a"
     }
   },
   "0.19": {
@@ -106,19 +152,19 @@
   "0.19.0": {
     "x86_64_linux_musl": {
       "etag": "0x8DC24F5D027FC0F",
-      "checksum": "5f27032694119fd990ac92ec093b78c192631c36200d67f5eeb4cb1d42316bae"
+      "hash": "5f27032694119fd990ac92ec093b78c192631c36200d67f5eeb4cb1d42316bae"
     },
     "x86_64_macos": {
       "etag": "0x8DC24F5C0EF40C1",
-      "checksum": "371c2f464bb6152307318dede563c8fb8ecdc456224b21bdf018af58be739068"
+      "hash": "371c2f464bb6152307318dede563c8fb8ecdc456224b21bdf018af58be739068"
     },
     "x86_64_windows": {
       "etag": "0x8DC24F62F6FF95E",
-      "checksum": "ab2cd04392480becd704a48bc70485310e4f029431f87303fa9aeb485fd463bd"
+      "hash": "ab2cd04392480becd704a48bc70485310e4f029431f87303fa9aeb485fd463bd"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8DC24F5CB42CD4D",
-      "checksum": "a5b27ba8fdde75814d96a501c564f10cd4a553c0e8a19f4f1746283a7fda5296"
+      "hash": "a5b27ba8fdde75814d96a501c564f10cd4a553c0e8a19f4f1746283a7fda5296"
     }
   },
   "0.18": {
@@ -127,19 +173,19 @@
   "0.18.3": {
     "x86_64_linux_musl": {
       "etag": "0x8DBD4A05733B7C4",
-      "checksum": "2cc37ceefda1d8fc4be45363639e696f31d5bae12c47ce05146a06c432f37290"
+      "hash": "2cc37ceefda1d8fc4be45363639e696f31d5bae12c47ce05146a06c432f37290"
     },
     "x86_64_macos": {
       "etag": "0x8DBD4A05D6DD0AD",
-      "checksum": "2dbf9a0861a83bef081f5a864b0d1d3464164146a9d230a0f4beb64be5e93eb4"
+      "hash": "2dbf9a0861a83bef081f5a864b0d1d3464164146a9d230a0f4beb64be5e93eb4"
     },
     "x86_64_windows": {
       "etag": "0x8DBD4A0AA768DBC",
-      "checksum": "6d7111be9b30683ae6fb558ba8a5e3b0ed3153f645e2e1549122af69625c478e"
+      "hash": "6d7111be9b30683ae6fb558ba8a5e3b0ed3153f645e2e1549122af69625c478e"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8DBD4A052372232",
-      "checksum": "9655a1b5d8b4bde20eeceb2ee0701149eb954b008a3711a207014fadb9623753"
+      "hash": "9655a1b5d8b4bde20eeceb2ee0701149eb954b008a3711a207014fadb9623753"
     }
   },
   "0.17": {
@@ -148,109 +194,109 @@
   "0.17.6": {
     "x86_64_linux_musl": {
       "etag": "0x8DB5187527EB84E",
-      "checksum": "62272b41f946c77193e47a96ef8a891df0ec9af6cbefa1e373b42f42a9f99b7e"
+      "hash": "62272b41f946c77193e47a96ef8a891df0ec9af6cbefa1e373b42f42a9f99b7e"
     },
     "x86_64_macos": {
       "etag": "0x8DB5187908359D1",
-      "checksum": "a0ec73e774d187a704f3410337f8a878cc49bd2872eccb152ccaf6500fb177cf"
+      "hash": "a0ec73e774d187a704f3410337f8a878cc49bd2872eccb152ccaf6500fb177cf"
     },
     "x86_64_windows": {
       "etag": "0x8DB51962A8DD0CF",
-      "checksum": "a9c7427725b137a6eec66cc36b673024af34870f4193ec33b293db32826a28bc"
+      "hash": "a9c7427725b137a6eec66cc36b673024af34870f4193ec33b293db32826a28bc"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8DB51875B93B162",
-      "checksum": "84821b0a3ec175a13fd499d22214a02e0df84944d5a44414fda92cdb21ef26a1"
+      "hash": "84821b0a3ec175a13fd499d22214a02e0df84944d5a44414fda92cdb21ef26a1"
     }
   },
   "0.17.5": {
     "x86_64_linux_musl": {
       "etag": "0x8DB2D554F62A383",
-      "checksum": "6124641659a333285d9002e4f3e46a58782ad6e0bd54aa001747bb3cbe8d4af9"
+      "hash": "6124641659a333285d9002e4f3e46a58782ad6e0bd54aa001747bb3cbe8d4af9"
     },
     "x86_64_macos": {
       "etag": "0x8DB2D5554039295",
-      "checksum": "61daf860ca51e5f4da236cc0d5fef94b0ef89bcefa950a7f8ede4101e150250b"
+      "hash": "61daf860ca51e5f4da236cc0d5fef94b0ef89bcefa950a7f8ede4101e150250b"
     },
     "x86_64_windows": {
       "etag": "0x8DB2D558B04C35E",
-      "checksum": "a1a8905406a50d63293410fe424c67232337fefadff9d7507a09bb803f1cbc6d"
+      "hash": "a1a8905406a50d63293410fe424c67232337fefadff9d7507a09bb803f1cbc6d"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8DB2D5547BC8642",
-      "checksum": "8ee364de52f333da580c678b3804a579ef2d7beecef3647e2c19c823baa10390"
+      "hash": "8ee364de52f333da580c678b3804a579ef2d7beecef3647e2c19c823baa10390"
     }
   },
   "0.17.4": {
     "x86_64_linux_musl": {
       "etag": "0x8DAC1D09F469DA0",
-      "checksum": "7787092990768eb44e12ea489fbf94c46efdf1e74209d6eed3da39a770c0ab61"
+      "hash": "7787092990768eb44e12ea489fbf94c46efdf1e74209d6eed3da39a770c0ab61"
     },
     "x86_64_macos": {
       "etag": "0x8DAC1D0E9C00253",
-      "checksum": "e0b0a432f45e6951a0eb45124697eaed5e01ce0a3452d1f2b1bb0e8baad266cb"
+      "hash": "e0b0a432f45e6951a0eb45124697eaed5e01ce0a3452d1f2b1bb0e8baad266cb"
     },
     "x86_64_windows": {
       "etag": "0x8DAC1D049E726C8",
-      "checksum": "7faa864c7474e9df44ea04d5757b1b6c600df09d28e48825a160d1d7271de2f7"
+      "hash": "7faa864c7474e9df44ea04d5757b1b6c600df09d28e48825a160d1d7271de2f7"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8DAC1D01EA52D25",
-      "checksum": "418e8212e79d7a9d3241a6bc8b7cca9016d59d7e3a680cf0d1a36d34e853f98b"
+      "hash": "418e8212e79d7a9d3241a6bc8b7cca9016d59d7e3a680cf0d1a36d34e853f98b"
     }
   },
   "0.17.3": {
     "x86_64_linux_musl": {
       "etag": "0x8DABC3C9F7F80AE",
-      "checksum": "a46d436e83eb4e220dcf6a1fc91dbeae6cd549b5809c070b958e4871e0c49f39"
+      "hash": "a46d436e83eb4e220dcf6a1fc91dbeae6cd549b5809c070b958e4871e0c49f39"
     },
     "x86_64_macos": {
       "etag": "0x8DABC3CA818A429",
-      "checksum": "20daa15f351d7f44ff256e9b7deb588b2cc37254b3410cf3b02be60db1eb2eb4"
+      "hash": "20daa15f351d7f44ff256e9b7deb588b2cc37254b3410cf3b02be60db1eb2eb4"
     },
     "x86_64_windows": {
       "etag": "0x8DABC3D51D036C4",
-      "checksum": "51ca34dd3c0f3ba69b369e3b97ac6b8efd19ae27b65e78708c437596c597dbb5"
+      "hash": "51ca34dd3c0f3ba69b369e3b97ac6b8efd19ae27b65e78708c437596c597dbb5"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8DABC3C9585F1AE",
-      "checksum": "f8495db7044f804fc9d0adddae000cc25bbe145fc4e69922c91326ba20850c2f"
+      "hash": "f8495db7044f804fc9d0adddae000cc25bbe145fc4e69922c91326ba20850c2f"
     }
   },
   "0.17.2": {
     "x86_64_linux_musl": {
       "etag": "0x8DAA7EFC1EE56B9",
-      "checksum": "c22e29bd95092e0681716c55cd2c5993aa8f85e1d602bec57a018c1690e07bf9"
+      "hash": "c22e29bd95092e0681716c55cd2c5993aa8f85e1d602bec57a018c1690e07bf9"
     },
     "x86_64_macos": {
       "etag": "0x8DAA7F0BFA33266",
-      "checksum": "ccc0e0b742020a2aa524d0902557af6ef0ca55e2f36a054fd7f2ecb3b154c42c"
+      "hash": "ccc0e0b742020a2aa524d0902557af6ef0ca55e2f36a054fd7f2ecb3b154c42c"
     },
     "x86_64_windows": {
       "etag": "0x8DAA7F02AA22FB4",
-      "checksum": "71130a0cabe200944b325bd38e64dde80f8756c333f619b1a88a5860e045e055"
+      "hash": "71130a0cabe200944b325bd38e64dde80f8756c333f619b1a88a5860e045e055"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8DAA7F0014C43A8",
-      "checksum": "b0ade081038ea20fa0943aa6b9b1ce586c4be1eaf69b8897d2495792eac7648c"
+      "hash": "b0ade081038ea20fa0943aa6b9b1ce586c4be1eaf69b8897d2495792eac7648c"
     }
   },
   "0.17.0": {
     "x86_64_linux_musl": {
       "etag": "0x8DA3CC8C31E8286",
-      "checksum": "552bec2dc3de9913c2783624dce3022ea305bfd4b79994a3c0879ac509c765f0"
+      "hash": "552bec2dc3de9913c2783624dce3022ea305bfd4b79994a3c0879ac509c765f0"
     },
     "x86_64_macos": {
       "etag": "0x8DA3CC952C2314A",
-      "checksum": "a54ca8139a8c3e4680a4a3009971fc47aca7a2fe5684399888d03934bfba51d3"
+      "hash": "a54ca8139a8c3e4680a4a3009971fc47aca7a2fe5684399888d03934bfba51d3"
     },
     "x86_64_windows": {
       "etag": "0x8DA3CC9C3C9A467",
-      "checksum": "4ae4919ab5e2f7e212272e84d3d54b231e534aa8c7fc7d4dfc08c2c9cad4f679"
+      "hash": "4ae4919ab5e2f7e212272e84d3d54b231e534aa8c7fc7d4dfc08c2c9cad4f679"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8DA3CC9172EEBE5",
-      "checksum": "525a3ab948836ae04a9af680a754c4a05222fd6beb145e08f8a8e0b80089422b"
+      "hash": "525a3ab948836ae04a9af680a754c4a05222fd6beb145e08f8a8e0b80089422b"
     }
   },
   "0.16": {
@@ -259,19 +305,19 @@
   "0.16.0": {
     "x86_64_linux_musl": {
       "etag": "0x8D9BA1AF966A141",
-      "checksum": "c8abe5afdba8fc206dcd1d18a6b3ba68378e07172ecbfe66576672d247eeb794"
+      "hash": "c8abe5afdba8fc206dcd1d18a6b3ba68378e07172ecbfe66576672d247eeb794"
     },
     "x86_64_macos": {
       "etag": "0x8D9BA1B03A9E6B7",
-      "checksum": "247eebba6e55efc629dab78cb9322505201288b23905a858e9791e576ade483f"
+      "hash": "247eebba6e55efc629dab78cb9322505201288b23905a858e9791e576ade483f"
     },
     "x86_64_windows": {
       "etag": "0x8D9BA1AFF137F82",
-      "checksum": "f6c1c4a3e6d25b9d42e5c19055cfb26351ae732a65aa23dfedbbff32028aa3cd"
+      "hash": "f6c1c4a3e6d25b9d42e5c19055cfb26351ae732a65aa23dfedbbff32028aa3cd"
     },
     "aarch64_linux_gnu": {
       "etag": "0x8D9BA1AFD92486D",
-      "checksum": "64c62fb185036e3838426b9271f36f283e77a2fc60d1c08583113977f29d4f0f"
+      "hash": "64c62fb185036e3838426b9271f36f283e77a2fc60d1c08583113977f29d4f0f"
     }
   }
 }

manifests/cargo-auditable.json

@@ -13,14 +13,120 @@
       "url": "https://github.com/rust-secure-code/cargo-auditable/releases/download/v${version}/cargo-auditable-x86_64-pc-windows-msvc.zip",
       "bin": "cargo-auditable.exe"
     },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/rust-secure-code/cargo-auditable/releases/download/v${version}/cargo-auditable-aarch64-unknown-linux-gnu.tar.xz",
+      "bin": "cargo-auditable-aarch64-unknown-linux-gnu/cargo-auditable"
+    },
     "aarch64_macos": {
       "url": "https://github.com/rust-secure-code/cargo-auditable/releases/download/v${version}/cargo-auditable-aarch64-apple-darwin.tar.xz",
       "bin": "cargo-auditable-aarch64-apple-darwin/cargo-auditable"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/rust-secure-code/cargo-auditable/releases/download/v${version}/cargo-auditable-aarch64-pc-windows-msvc.zip",
+      "bin": "cargo-auditable.exe"
     }
   },
-  "license_markdown": "[Apache-2.0](https://github.com/rust-secure-code/cargo-auditable/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/rust-secure-code/cargo-auditable/blob/HEAD/LICENSE-MIT)",
   "latest": {
-    "version": "0.6.6"
+    "version": "0.7.4"
+  },
+  "0.7": {
+    "version": "0.7.4"
+  },
+  "0.7.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE7A2374CF1CFA",
+      "hash": "4a4f0c124543c065f03d89aee26550305143c6e4af3e46270dbabefeb79895d2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE7A23746A3D21",
+      "hash": "2a1e73d769b2ab6c027178d11c6ba6bf3ad7c1e756910b349b513583da9d52bc"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE7A23747DAF46",
+      "hash": "e2da8d873978982381269c27be8b76cfd4084fbf99c43bd83231ac9c714488bb"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE7A237416D5D6",
+      "hash": "fcf9121e5a0115cb1563852dd532d8c6aec3e84229908c576462c98eb4006521"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE7A23741AA219",
+      "hash": "fade0f3befebce7b54a46edfa31bea27789ea2136c51e662c2922b10f9d6f701"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE7A2374234AE3",
+      "hash": "f7e64d1b6762c15cc4bc91afdd5366797239c503b983593c252b088ab4b2f2bf"
+    }
+  },
+  "0.7.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE7972E285D550",
+      "hash": "c002aed9b9cee768575777ee51974af427f47bfd85ead731014fb637e7fd9e5b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE7972E23E6E64",
+      "hash": "0325aa84965f224ecddf9af473c9ed1c7f374f82edb4172511a69229f19ed17e"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE7972E26AA3C4",
+      "hash": "78c9f05a39d2104b8177820e459e831edc64d595e8b5e7506718dc19678574e5"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE7972E1F0F3D0",
+      "hash": "0a3cea758e8e76da048ed588a084b1c466306ec914eeab98deea3eeae2c49e3f"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE7972E1F66BE9",
+      "hash": "a78e886dbb15646dbeb435f1270ecf0b36688d87ce7e2e0cce823b655adda755"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE7972E2026C53",
+      "hash": "7a61dfc607bd7fdf601662ecbfd12efdd8fa1eeeb9c7d645d0a064dee951133b"
+    }
+  },
+  "0.7.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE1F786D9469E9",
+      "hash": "f194cc63276f458dc72ac157dfd6e668ab3eebf1e25769fcd55fcf318e6bcf18"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE1F786D4239B2",
+      "hash": "5c2d84ca478116d900b68b33be6d6ec16ba0d096e45d2e7e5e08293a7b6f3a86"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE1F786D79ACFC",
+      "hash": "cbee5b0e2465793c260468afaeee3c77234e7aafaae123e2ce8d148c933c9840"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE1F786CFFFCF3",
+      "hash": "4979df37f1512e44fc4e309503fd44d6dd5869a559c5e501f089942b3179d6f8"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE1F786CF202FF",
+      "hash": "9b0a5aea8bb3aec6c2bf303ea5068a7c6c3521e875f571b41cda491baa150960"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE1F786CFD1A09",
+      "hash": "1c0cf4c27877cc8c9439478f5e79f4d0bf83b3395edaeac489cc0f4dad23ddc9"
+    }
+  },
+  "0.7.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE0F0432B09789",
+      "hash": "fcb8d9bdff017feb1c6a58cd7cb3f349f145a36b6016e7e6060526257f830658"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE0F04324E739F",
+      "hash": "b60375765500418dd921bc522ac7cf2611a89f53efeafbc51be0580aa0d9623d"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE0F04329A903B",
+      "hash": "c5f36611faa6110291ab45b0ad5a8c13249243918c573c8b54b363f980568f16"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE0F04324FAAC8",
+      "hash": "edbae5d6d5002d9e4b966f37648b54bae0cf263cd5e001be68d31cda10b69f1e"
+    }
   },
   "0.6": {
     "version": "0.6.6"
@@ -28,55 +134,55 @@
   "0.6.6": {
     "x86_64_linux_musl": {
       "etag": "0x8DD0C3D4484F0AE",
-      "checksum": "ccbec5ea7b120b27da34e267065110cc208a19d5e7bc15b41ef545a25e0e52c2"
+      "hash": "ccbec5ea7b120b27da34e267065110cc208a19d5e7bc15b41ef545a25e0e52c2"
     },
     "x86_64_macos": {
       "etag": "0x8DD0C3D45AF01FA",
-      "checksum": "6da9ff7263e2cc96c20400e34e2131ebce3610451e52cdfa1ae86b49211b03da"
+      "hash": "6da9ff7263e2cc96c20400e34e2131ebce3610451e52cdfa1ae86b49211b03da"
     },
     "x86_64_windows": {
       "etag": "0x8DD0C3D454FE855",
-      "checksum": "cc9fedabae5097a755fab5c435cd616a0458894e01b8c5de6eceb189e784299b"
+      "hash": "cc9fedabae5097a755fab5c435cd616a0458894e01b8c5de6eceb189e784299b"
     },
     "aarch64_macos": {
       "etag": "0x8DD0C3D4664DB40",
-      "checksum": "fe7351c3fe4070da48901aee6d2661c2df1c6068dfef4b0b44a353d537e9cc66"
+      "hash": "fe7351c3fe4070da48901aee6d2661c2df1c6068dfef4b0b44a353d537e9cc66"
     }
   },
   "0.6.5": {
     "x86_64_linux_musl": {
       "etag": "0x8DD026635663221",
-      "checksum": "1c8f1079d49ec7d29c134ed5e833c56552391db2eb8968a5a8e3cffebb160454"
+      "hash": "1c8f1079d49ec7d29c134ed5e833c56552391db2eb8968a5a8e3cffebb160454"
     },
     "x86_64_macos": {
       "etag": "0x8DD0266371D1878",
-      "checksum": "6b7f9ae0eb0a70ab01fe37f776e901f86f22a270491944db1f169b6cc2a6162c"
+      "hash": "6b7f9ae0eb0a70ab01fe37f776e901f86f22a270491944db1f169b6cc2a6162c"
     },
     "x86_64_windows": {
       "etag": "0x8DD026636A97BCE",
-      "checksum": "4aa3d953cb90c177a46e5c70cbb4050e2e06d756cfd14a0d6fd28daf7d38967b"
+      "hash": "4aa3d953cb90c177a46e5c70cbb4050e2e06d756cfd14a0d6fd28daf7d38967b"
     },
     "aarch64_macos": {
       "etag": "0x8DD02663824ADB8",
-      "checksum": "635fe55a50e6dbb65caa1e45b5703c75a1a00a5dadddf40862c7e91012b06f94"
+      "hash": "635fe55a50e6dbb65caa1e45b5703c75a1a00a5dadddf40862c7e91012b06f94"
     }
   },
   "0.6.4": {
     "x86_64_linux_musl": {
       "etag": "0x8DC7C39FA3B2719",
-      "checksum": "e75d161e101be7f501e71e9dddd3f0c823e6776a45f884340ad42ec268321ea3"
+      "hash": "e75d161e101be7f501e71e9dddd3f0c823e6776a45f884340ad42ec268321ea3"
     },
     "x86_64_macos": {
       "etag": "0x8DC7C39FB75C7E7",
-      "checksum": "02572f75d434ea03da5eac8b82230e4b3b9e2974549e22092bccb1ef92ac28ef"
+      "hash": "02572f75d434ea03da5eac8b82230e4b3b9e2974549e22092bccb1ef92ac28ef"
     },
     "x86_64_windows": {
       "etag": "0x8DC7C39FB1638FE",
-      "checksum": "ea452ae7d3dbc2dd1f747861245be8fd6740da12b351f65c59a212df370b144c"
+      "hash": "ea452ae7d3dbc2dd1f747861245be8fd6740da12b351f65c59a212df370b144c"
     },
     "aarch64_macos": {
       "etag": "0x8DC7C39FC410D14",
-      "checksum": "02e0faa19a9e9ceee43f83b2b557c536624a0c868307b9b2b3a5f617ef3b7cfb"
+      "hash": "02e0faa19a9e9ceee43f83b2b557c536624a0c868307b9b2b3a5f617ef3b7cfb"
     }
   }
 }

manifests/cargo-binstall.json

@@ -18,36 +18,42 @@
     },
     "aarch64_windows": {
       "url": "https://github.com/cargo-bins/cargo-binstall/releases/download/v${version}/cargo-binstall-aarch64-pc-windows-msvc.zip"
+    },
+    "riscv64_linux_musl": {
+      "url": "https://github.com/cargo-bins/cargo-binstall/releases/download/v${version}/cargo-binstall-riscv64gc-unknown-linux-musl.tgz"
     }
   },
-  "license_markdown": "[GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/HEAD/crates/bin/LICENSE)",
   "latest": {
-    "version": "1.13.0"
+    "version": "1.18.1"
   },
-  "1.13.0": {
+  "1.18.1": {
     "x86_64_linux_musl": {
-      "etag": "0x8DDA8291E356B17",
+      "etag": "0x8DE9959D5E8FE78",
-      "checksum": "12ba6a4022bdf121701fbd6c01d8021d7f867993877b26582f0d7281bae7a1f9"
+      "hash": "cf2a4b54494ea8555d6349685e9a301efc1051d9fba6308c76914b2486f8700f"
     },
     "x86_64_macos": {
-      "etag": "0x8DDA828B2A2FA39",
+      "etag": "0x8DE9959DBCBBA2C",
-      "checksum": "9e5b08b6f4145580bf1f5c98c3b877493066b5e228c675150eb62fc9e0a83259"
+      "hash": "e06370bec7143668653bb7c09d0b8b689fc703dd4fa58ec5847c4b571d8a490d"
     },
     "x86_64_windows": {
-      "etag": "0x8DDA829DE2DFEEC",
+      "etag": "0x8DE9959D9E5BCF3",
-      "checksum": "76eddc873105062022b1fd1b8ca090879325664d71635e94d59ce09fff3889b9"
+      "hash": "89706aa5215c164d8d091597a470fee72308ac87e8553af395ea77db844a888c"
     },
     "aarch64_linux_musl": {
-      "etag": "0x8DDA82874CC35EB",
+      "etag": "0x8DE9959E60E685D",
-      "checksum": "2be845b457aabfc66d68be77d69c0fd849edd446a4d23b2e3fd174ca502bd343"
+      "hash": "c55962a0115f9716b709216de7f8bdd59d6ba8738779e60b051b4593f677717a"
     },
     "aarch64_macos": {
-      "etag": "0x8DDA82917C58C4C",
+      "etag": "0x8DE9959ED2C11A4",
-      "checksum": "02d6ca67746aecb27fd4bb063b9be3e6f6bc67dcd6c3105941bff64e064f991a"
+      "hash": "955abf167994c90f3547e233edace4c0f794465dd4aa408249b38999aa5ca3cf"
     },
     "aarch64_windows": {
-      "etag": "0x8DDA8299B758A49",
+      "etag": "0x8DE9959EAAC5732",
-      "checksum": "a57c01ae03825c44f946e8b773ebd018a0f3f1a4861a611c6cd61be180bd3cd6"
+      "hash": "c6873e81457d9e44973a8e9a849795f2c83765fce0af8ad68b597b5b40dec418"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE9959DFE57CE6",
+      "hash": "3eb039f14fa71dd27b614bf692f0bffd4ba087204829805d54b014646aed7c14"
     }
   }
 }

manifests/cargo-careful.json

@@ -1,130 +1,180 @@
 {
   "rust_crate": "cargo-careful",
   "template": null,
-  "license_markdown": "[MIT](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-APACHE)",
   "latest": {
-    "version": "0.4.7"
+    "version": "0.4.10"
   },
   "0.4": {
-    "version": "0.4.7"
+    "version": "0.4.10"
+  },
+  "0.4.10": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.10/cargo-careful-x86_64-unknown-linux-musl",
+      "etag": "0x8DE8FC4E147531F",
+      "hash": "bd0937ba41dec5ba45ca7cb9c502060fbcf625d12f5cf8d0b0c47328b4d82ac4"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.10/cargo-careful-x86_64-apple-darwin",
+      "etag": "0x8DE8FC4E136EADB",
+      "hash": "5f39ae33320bc0fb101e1be2020a69c2e6368bc26ee6ef7207e89ae39b2cf351"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.10/cargo-careful-windows.exe",
+      "etag": "0x8DE8FC4E141665F",
+      "hash": "89e2e95a6347595d73326b9ed014a58fb397f5a3cf9887ee8b9d92c181e20828"
+    }
+  },
+  "0.4.9": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.9/cargo-careful-x86_64-unknown-linux-musl",
+      "etag": "0x8DE3125D4C34BAD",
+      "hash": "a329e0711910fb7f0f7e803ad243f5a1edac85e885eba0d15e986aac30508fe4"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.9/cargo-careful-x86_64-apple-darwin",
+      "etag": "0x8DE3125D4BC758E",
+      "hash": "9ccfb3a0d502eec025841b11cf06b5a3359b72979e3317dab699aa5806725f1a"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.9/cargo-careful-windows.exe",
+      "etag": "0x8DE3125D4BF3189",
+      "hash": "d329ad9f85da406c52f846d568a1406b71058bccdc85c79fad8d5cf828456518"
+    }
+  },
+  "0.4.8": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.8/cargo-careful-x86_64-unknown-linux-musl",
+      "etag": "0x8DDB61A17F9E28C",
+      "hash": "005394c8fe43f8f759dd7c7acbb3aee4e824651d29e8c4779f03e30ac9f7f2d8"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.8/cargo-careful-x86_64-apple-darwin",
+      "etag": "0x8DDB61A17F88483",
+      "hash": "a77f01f08f01655d37094ed702874012f74cf3e55a265fcaba0b634dd335fa7e"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.8/cargo-careful-windows.exe",
+      "etag": "0x8DDB61A17F6FF9F",
+      "hash": "89cf667991f6ed681a0ed29128d27f6c7efc74dd26867c33cf2d5956ceb32498"
+    }
   },
   "0.4.7": {
     "x86_64_linux_musl": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.7/cargo-careful-x86_64-unknown-linux-musl",
       "etag": "0x8DDA9EA18FE3BD8",
-      "checksum": "9a53546e2e038cc723439ad7ba1cce3774fc3fa229ee59d1b45929b8666d6cde"
+      "hash": "9a53546e2e038cc723439ad7ba1cce3774fc3fa229ee59d1b45929b8666d6cde"
     },
     "x86_64_macos": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.7/cargo-careful-x86_64-apple-darwin",
       "etag": "0x8DDA9EA18FD04D6",
-      "checksum": "1d48f5f24ab5a0069b2f6772e1060d6ab8bbd652b09262576cfce5838490f2e3"
+      "hash": "1d48f5f24ab5a0069b2f6772e1060d6ab8bbd652b09262576cfce5838490f2e3"
     },
     "x86_64_windows": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.7/cargo-careful-windows.exe",
       "etag": "0x8DDA9EA190AB0F5",
-      "checksum": "854d2e191338145a948d87813a2ec9a8095ecca1eddc8911b1f4fe98345fa6b2"
+      "hash": "854d2e191338145a948d87813a2ec9a8095ecca1eddc8911b1f4fe98345fa6b2"
     }
   },
   "0.4.6": {
     "x86_64_linux_musl": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.6/cargo-careful-x86_64-unknown-linux-musl",
       "etag": "0x8DD9D21CC303869",
-      "checksum": "7486474f22bc719ba7ea57bb6b36e3a362ffa163d80878bfd8106a675339382f"
+      "hash": "7486474f22bc719ba7ea57bb6b36e3a362ffa163d80878bfd8106a675339382f"
     },
     "x86_64_macos": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.6/cargo-careful-x86_64-apple-darwin",
       "etag": "0x8DD9D21CC206BAE",
-      "checksum": "4dd7928eb69dd0839e8782da294db9c2e0c4f05277727d1c342870e8409898de"
+      "hash": "4dd7928eb69dd0839e8782da294db9c2e0c4f05277727d1c342870e8409898de"
     },
     "x86_64_windows": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.6/cargo-careful-windows.exe",
       "etag": "0x8DD9D21CC26F3FC",
-      "checksum": "a187648862d4a4e63fe33c2675bd5281c506b96839711803be467b3fd5e23447"
+      "hash": "a187648862d4a4e63fe33c2675bd5281c506b96839711803be467b3fd5e23447"
     }
   },
   "0.4.5": {
     "x86_64_linux_musl": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.5/cargo-careful-x86_64-unknown-linux-musl",
       "etag": "0x8DD8F0CCB92AD10",
-      "checksum": "1541426e95e779530c5770f98dd9adff5d376b555f8a97f1bf95728ecf281230"
+      "hash": "1541426e95e779530c5770f98dd9adff5d376b555f8a97f1bf95728ecf281230"
     },
     "x86_64_macos": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.5/cargo-careful-x86_64-apple-darwin",
       "etag": "0x8DD8F0CCB86D38F",
-      "checksum": "03abfdb85d35857c2ef14793b548f976318169bde7a856e830a3b84e84626200"
+      "hash": "03abfdb85d35857c2ef14793b548f976318169bde7a856e830a3b84e84626200"
     },
     "x86_64_windows": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.5/cargo-careful-windows.exe",
       "etag": "0x8DD8F0CCB9899CF",
-      "checksum": "d68b34d8fa1d6d97ab47a895d8beaf1f18634fce26beb2fa1f21af7cc20fbebf"
+      "hash": "d68b34d8fa1d6d97ab47a895d8beaf1f18634fce26beb2fa1f21af7cc20fbebf"
     }
   },
   "0.4.3": {
     "x86_64_linux_musl": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.3/cargo-careful.x86_64-unknown-linux-musl",
       "etag": "0x8DCB92F10570A48",
-      "checksum": "8a39c7c88744b7dec49fdedd08588e75343aabd466c9ec811832b65680c64e6d"
+      "hash": "8a39c7c88744b7dec49fdedd08588e75343aabd466c9ec811832b65680c64e6d"
     },
     "x86_64_macos": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.3/cargo-careful.x86_64-apple-darwin",
       "etag": "0x8DCB92F104F71BD",
-      "checksum": "c4d1b19bc243bd1d8ed5d99413d9a625b852e394e614b7871d71deb9557940e9"
+      "hash": "c4d1b19bc243bd1d8ed5d99413d9a625b852e394e614b7871d71deb9557940e9"
     },
     "x86_64_windows": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.3/cargo-careful.exe",
       "etag": "0x8DCB92F104F4AD5",
-      "checksum": "1a3bb682553c48cef478609a377e8f845929efad8c4c903ae4ad66348ac5b0c3"
+      "hash": "1a3bb682553c48cef478609a377e8f845929efad8c4c903ae4ad66348ac5b0c3"
     }
   },
   "0.4.2": {
     "x86_64_linux_musl": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.2/cargo-careful.x86_64-unknown-linux-musl",
       "etag": "0x8DC77FF17EF35B7",
-      "checksum": "ee14c5796acab604714e358de11bf5204055410ae8fd4891df7f5d62461402c3"
+      "hash": "ee14c5796acab604714e358de11bf5204055410ae8fd4891df7f5d62461402c3"
     },
     "x86_64_macos": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.2/cargo-careful.x86_64-apple-darwin",
       "etag": "0x8DC77FF17F769E4",
-      "checksum": "480efaf0a577161332b27ea13c8703ead1b6355b5c6541f5bd61d440440b4bde"
+      "hash": "480efaf0a577161332b27ea13c8703ead1b6355b5c6541f5bd61d440440b4bde"
     },
     "x86_64_windows": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.2/cargo-careful.exe",
       "etag": "0x8DC77FF17F3EB5D",
-      "checksum": "ac374b7799a37e3ef21c6bfe409583c3acbc57242fbb32e8534269b5e97b8ee9"
+      "hash": "ac374b7799a37e3ef21c6bfe409583c3acbc57242fbb32e8534269b5e97b8ee9"
     }
   },
   "0.4.1": {
     "x86_64_linux_musl": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.1/cargo-careful.x86_64-unknown-linux-musl",
       "etag": "0x8DC0FA12501A132",
-      "checksum": "ea403df41ca913e536f97b8a039343173abae399436570a16d271908af989808"
+      "hash": "ea403df41ca913e536f97b8a039343173abae399436570a16d271908af989808"
     },
     "x86_64_macos": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.1/cargo-careful.x86_64-apple-darwin",
       "etag": "0x8DC0FA124F8F869",
-      "checksum": "ccbee4b5a0f5bf235c038b89d6046c08b2bff405ffa7289f4194f5402ea96c15"
+      "hash": "ccbee4b5a0f5bf235c038b89d6046c08b2bff405ffa7289f4194f5402ea96c15"
     },
     "x86_64_windows": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.1/cargo-careful.exe",
       "etag": "0x8DC0FA124FEBE49",
-      "checksum": "655ac5c504b2f54f11807edc6d9a19cea668bfb119ea086c5848504f7d09071c"
+      "hash": "655ac5c504b2f54f11807edc6d9a19cea668bfb119ea086c5848504f7d09071c"
     }
   },
   "0.4.0": {
     "x86_64_linux_musl": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.0/cargo-careful.x86_64-unknown-linux-musl",
       "etag": "0x8DBBB2F3DD23635",
-      "checksum": "54cd7e1972e9faf085e3d0798c02054d064bc72de051a2636ece6f5b0ce0176d"
+      "hash": "54cd7e1972e9faf085e3d0798c02054d064bc72de051a2636ece6f5b0ce0176d"
     },
     "x86_64_macos": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.0/cargo-careful.x86_64-apple-darwin",
       "etag": "0x8DBBB2F3D8053BA",
-      "checksum": "70d92ad8adf84192caa2066ba981780df926c8aa6cbd398fe489f87af336fe61"
+      "hash": "70d92ad8adf84192caa2066ba981780df926c8aa6cbd398fe489f87af336fe61"
     },
     "x86_64_windows": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.0/cargo-careful.exe",
       "etag": "0x8DBBB2F40025764",
-      "checksum": "01ebcae79d9ba0cbb56e5c6bb5757d9cd074a3635704d15b0ef62a000c5d03a8"
+      "hash": "01ebcae79d9ba0cbb56e5c6bb5757d9cd074a3635704d15b0ef62a000c5d03a8"
     }
   },
   "0.3": {
@@ -134,34 +184,34 @@
     "x86_64_linux_musl": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.3.4/cargo-careful.x86_64-unknown-linux-musl",
       "etag": "0x8DB4E18D54BDD62",
-      "checksum": "a9cfc7775546bd646a9e9252527c5caa56c429d854c6d8664ab4d63ed87827bd"
+      "hash": "a9cfc7775546bd646a9e9252527c5caa56c429d854c6d8664ab4d63ed87827bd"
     },
     "x86_64_macos": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.3.4/cargo-careful.x86_64-apple-darwin",
       "etag": "0x8DB4E18D554FADC",
-      "checksum": "b29d263648fc287250a413ebf53ddb37310564ac44bfd71c5a35ca8eaddac22f"
+      "hash": "b29d263648fc287250a413ebf53ddb37310564ac44bfd71c5a35ca8eaddac22f"
     },
     "x86_64_windows": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.3.4/cargo-careful.exe",
       "etag": "0x8DB4E18D5625959",
-      "checksum": "50cebcb95cda4fa3b4d5010ed6252be92de2748d3f5c00aff3bc6fe5f39c0906"
+      "hash": "50cebcb95cda4fa3b4d5010ed6252be92de2748d3f5c00aff3bc6fe5f39c0906"
     }
   },
   "0.3.3": {
     "x86_64_linux_musl": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.3.3/cargo-careful.x86_64-unknown-linux-musl",
       "etag": "0x8DB44A8B737767B",
-      "checksum": "bb2b06f4df62110c8ae89a006b548a10a4da36d0f8f3ff67f7417fb51ed96b0a"
+      "hash": "bb2b06f4df62110c8ae89a006b548a10a4da36d0f8f3ff67f7417fb51ed96b0a"
     },
     "x86_64_macos": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.3.3/cargo-careful.x86_64-apple-darwin",
       "etag": "0x8DB44A8B749B17A",
-      "checksum": "c396bae85ad4b414976ea6943bdb6fb666e56735ad51255ab615399e40641fec"
+      "hash": "c396bae85ad4b414976ea6943bdb6fb666e56735ad51255ab615399e40641fec"
     },
     "x86_64_windows": {
       "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.3.3/cargo-careful.exe",
       "etag": "0x8DB44A8B7333585",
-      "checksum": "87b35993b38fc60c069c45d58e79bae6c8f5253ce2459dff6a6b0b629c7aeb4c"
+      "hash": "87b35993b38fc60c069c45d58e79bae6c8f5253ce2459dff6a6b0b629c7aeb4c"
     }
   }
 }

manifests/cargo-cyclonedx.json

@@ -1,36 +1,99 @@
 {
   "rust_crate": "cargo-cyclonedx",
   "template": null,
-  "license_markdown": "[Apache-2.0](https://github.com/CycloneDX/cyclonedx-rust-cargo/blob/main/LICENSE)",
   "latest": {
-    "version": "0.5.7"
+    "version": "0.5.9"
   },
   "0.5": {
-    "version": "0.5.7"
+    "version": "0.5.9"
+  },
+  "0.5.9": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.9/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
+      "etag": "0x8DE859AEF496476",
+      "hash": "9bd3e599314f50810c9d98b8b68a617ff9d3cc20873968d90b29d121f6b226ff",
+      "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.9/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
+      "etag": "0x8DE859AEEE5E2A7",
+      "hash": "59d2a583fa632f8759456c1b531340331255b277386d23c598a3dbbc916fde63",
+      "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.9/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DE859AEF0C7909",
+      "hash": "8750e00775661dcb75bc482c1a298839fd94e8a0c033b49905ba0f246ffed202",
+      "bin": "cargo-cyclonedx.exe"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.9/cargo-cyclonedx-aarch64-unknown-linux-gnu.tar.xz",
+      "etag": "0x8DE859AEEAE6F5C",
+      "hash": "7bf131ca5389b07a4f10c182bcf8a5ad339d64408b6f0d8f6834a0bd6120a06a",
+      "bin": "cargo-cyclonedx-aarch64-unknown-linux-gnu/cargo-cyclonedx"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.9/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
+      "etag": "0x8DE859AEEB78CD2",
+      "hash": "4c53dfa21e70b65bf7f8d2592aadde3bcb02c1a40b6ec63b877e5ca65a29e180",
+      "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
+    }
+  },
+  "0.5.8": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.8/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
+      "etag": "0x8DE805A50426FFF",
+      "hash": "7cda4d471e70cad04daef2d55f3d031a7a246098dad263ca7fbda4e752f3bcc7",
+      "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.8/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
+      "etag": "0x8DE805A4FE43F58",
+      "hash": "fd44040b33bafbb7b5073b8302f83100e02e12327de1e1ac245b32853ca320e7",
+      "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.8/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DE805A5010C283",
+      "hash": "81577d0bdc7dbe99bed56ec79437afef476842999541a85096efa1f28f7fd965",
+      "bin": "cargo-cyclonedx.exe"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.8/cargo-cyclonedx-aarch64-unknown-linux-gnu.tar.xz",
+      "etag": "0x8DE805A4FB0BF22",
+      "hash": "e5b3e6abb9614cd603ea142b35f511976ea14a260f20ecdce9468a1e8e9da3c6",
+      "bin": "cargo-cyclonedx-aarch64-unknown-linux-gnu/cargo-cyclonedx"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.8/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
+      "etag": "0x8DE805A4FB1F65D",
+      "hash": "0b0b28095b775886a530c2be191a51a053e853d3a0212536b958ebf2828b119b",
+      "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
+    }
   },
   "0.5.7": {
     "x86_64_linux_musl": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.7/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
       "etag": "0x8DD10E0A0B0BBB1",
-      "checksum": "8ffbc91fa29b82f0b0438939a0421a164a0297b5387208f6170c793bdd22a4c9",
+      "hash": "8ffbc91fa29b82f0b0438939a0421a164a0297b5387208f6170c793bdd22a4c9",
       "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
     },
     "x86_64_macos": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.7/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
       "etag": "0x8DD10E0A03AD770",
-      "checksum": "f96401f427ec096162493f85ecf67d907ff2fc845d14de3e8fbf62660858afab",
+      "hash": "f96401f427ec096162493f85ecf67d907ff2fc845d14de3e8fbf62660858afab",
       "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
     },
     "x86_64_windows": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.7/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
       "etag": "0x8DD10E0A0B6CF5E",
-      "checksum": "f9f39802660c25fa2a841ca098158462b36e59567ed3ea07a57b23bed63f6474",
+      "hash": "f9f39802660c25fa2a841ca098158462b36e59567ed3ea07a57b23bed63f6474",
       "bin": "cargo-cyclonedx.exe"
     },
     "aarch64_macos": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.7/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
       "etag": "0x8DD10E0A0395289",
-      "checksum": "39ae80025f67a98974b4bd9e072ea09d42d3e11d05ef1375e6ff6b8345cf3cfe",
+      "hash": "39ae80025f67a98974b4bd9e072ea09d42d3e11d05ef1375e6ff6b8345cf3cfe",
       "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
     }
   },
@@ -38,25 +101,25 @@
     "x86_64_linux_musl": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.6/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
       "etag": "0x8DCFF38D5B5ABE0",
-      "checksum": "2238e1be087623eb139fa03896271612f9bb5d0fe3c67bdc5bcdccae078d53a4",
+      "hash": "2238e1be087623eb139fa03896271612f9bb5d0fe3c67bdc5bcdccae078d53a4",
       "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
     },
     "x86_64_macos": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.6/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
       "etag": "0x8DCFF38D55CA58A",
-      "checksum": "66d5b8550ccdc07161fa2052e64e63710717978a32ceefe3c780e17b9817d686",
+      "hash": "66d5b8550ccdc07161fa2052e64e63710717978a32ceefe3c780e17b9817d686",
       "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
     },
     "x86_64_windows": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.6/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
       "etag": "0x8DCFF38D5A5916F",
-      "checksum": "bdd6048a476edaa59e15902ff277f906f28ab74267b44b02b6019242e1ad7f50",
+      "hash": "bdd6048a476edaa59e15902ff277f906f28ab74267b44b02b6019242e1ad7f50",
       "bin": "cargo-cyclonedx.exe"
     },
     "aarch64_macos": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.6/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
       "etag": "0x8DCFF38D561F6C1",
-      "checksum": "77d1d014e9ef6a9b0e9481b80c35f4d22bf446ddabfbbc9ebd2e17b4167343f1",
+      "hash": "77d1d014e9ef6a9b0e9481b80c35f4d22bf446ddabfbbc9ebd2e17b4167343f1",
       "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
     }
   },
@@ -64,25 +127,25 @@
     "x86_64_linux_musl": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.5/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
       "etag": "0x8DCB605BF2376BB",
-      "checksum": "e0a872a5a8e32b9621334636e9da444d70527fb138aa75380e0dc20db8b0714b",
+      "hash": "e0a872a5a8e32b9621334636e9da444d70527fb138aa75380e0dc20db8b0714b",
       "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
     },
     "x86_64_macos": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.5/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
       "etag": "0x8DCB605BECCDE9E",
-      "checksum": "98beb669323396428b5c6c7003adc4235207442c7b025743366ee98759b2c3a6",
+      "hash": "98beb669323396428b5c6c7003adc4235207442c7b025743366ee98759b2c3a6",
       "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
     },
     "x86_64_windows": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.5/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
       "etag": "0x8DCB605BF0BEA8D",
-      "checksum": "7b4507cb8fb260df35bed0ad59f675d569f9bde3423228e8b44c7c378876a410",
+      "hash": "7b4507cb8fb260df35bed0ad59f675d569f9bde3423228e8b44c7c378876a410",
       "bin": "cargo-cyclonedx.exe"
     },
     "aarch64_macos": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.5/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
       "etag": "0x8DCB605BEC91251",
-      "checksum": "c296b0821c02ad13cbea6a7173ba6c37fa777acc7d066c5ff8570a600aeb62a7",
+      "hash": "c296b0821c02ad13cbea6a7173ba6c37fa777acc7d066c5ff8570a600aeb62a7",
       "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
     }
   },
@@ -90,25 +153,25 @@
     "x86_64_linux_musl": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.4/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
       "etag": "0x8DCA65134CEC9A1",
-      "checksum": "8a499153bf20c2e6c180b21404f0a0c8b229f4c254c4b5d1623ae15d130afe49",
+      "hash": "8a499153bf20c2e6c180b21404f0a0c8b229f4c254c4b5d1623ae15d130afe49",
       "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
     },
     "x86_64_macos": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.4/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
       "etag": "0x8DCA651345F6E35",
-      "checksum": "a88e604e696f806559b5a3ade35dccfe0baee885b4e5ad0ef34e280d7073c1c7",
+      "hash": "a88e604e696f806559b5a3ade35dccfe0baee885b4e5ad0ef34e280d7073c1c7",
       "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
     },
     "x86_64_windows": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.4/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
       "etag": "0x8DCA65134B6A1E2",
-      "checksum": "6f42f40bb0a7dd86337cdd3f9dc698167b601b077eaf199161a4e38d209f003a",
+      "hash": "6f42f40bb0a7dd86337cdd3f9dc698167b601b077eaf199161a4e38d209f003a",
       "bin": "cargo-cyclonedx.exe"
     },
     "aarch64_macos": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.4/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
       "etag": "0x8DCA65134508ADB",
-      "checksum": "e8751fb79e8dd33286e85acd3ac34af9ecc7a36e634c35720ed3b302b2a936b0",
+      "hash": "e8751fb79e8dd33286e85acd3ac34af9ecc7a36e634c35720ed3b302b2a936b0",
       "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
     }
   },
@@ -116,25 +179,25 @@
     "x86_64_linux_musl": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.3/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
       "etag": "0x8DC84D1C05C733F",
-      "checksum": "d303058cfdd5151da7645cc642f0d64e9b4e6ce90cfb8e4955329c58c887114b",
+      "hash": "d303058cfdd5151da7645cc642f0d64e9b4e6ce90cfb8e4955329c58c887114b",
       "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
     },
     "x86_64_macos": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.3/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
       "etag": "0x8DC84D1C1F0DBBC",
-      "checksum": "e7e19ae5d6f938912c87ea57e27d1549197c4f30ea9e5814ee7dc46d3004a945",
+      "hash": "e7e19ae5d6f938912c87ea57e27d1549197c4f30ea9e5814ee7dc46d3004a945",
       "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
     },
     "x86_64_windows": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.3/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
       "etag": "0x8DC84D1C1809711",
-      "checksum": "abc9408ea8239f6a35be92c1ca34d759a12e6e2b804191fbd39e515450c7a104",
+      "hash": "abc9408ea8239f6a35be92c1ca34d759a12e6e2b804191fbd39e515450c7a104",
       "bin": "cargo-cyclonedx.exe"
     },
     "aarch64_macos": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.3/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
       "etag": "0x8DC84D1C2D24E48",
-      "checksum": "7e3ebf1d9074d5b580561509e30c31bb5b80c6cd3b9df4516c49c1e1062c6391",
+      "hash": "7e3ebf1d9074d5b580561509e30c31bb5b80c6cd3b9df4516c49c1e1062c6391",
       "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
     }
   },
@@ -142,25 +205,25 @@
     "x86_64_linux_musl": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.2/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
       "etag": "0x8DC849208047BE6",
-      "checksum": "4018528cd125a8b0f4d1f990a06a67942a6091d6af519af4ada05918eeea70ef",
+      "hash": "4018528cd125a8b0f4d1f990a06a67942a6091d6af519af4ada05918eeea70ef",
       "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
     },
     "x86_64_macos": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.2/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
       "etag": "0x8DC8492096A685B",
-      "checksum": "aae1a9127a1a7651ec8f648b6924b3139171d2e9faf6548df962feb89f161292",
+      "hash": "aae1a9127a1a7651ec8f648b6924b3139171d2e9faf6548df962feb89f161292",
       "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
     },
     "x86_64_windows": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.2/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
       "etag": "0x8DC849208F850B0",
-      "checksum": "f6961d56104fa7755bd16590bd98899822a3e06037a88c6899a56803507671c3",
+      "hash": "f6961d56104fa7755bd16590bd98899822a3e06037a88c6899a56803507671c3",
       "bin": "cargo-cyclonedx.exe"
     },
     "aarch64_macos": {
       "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.2/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",