Release 2.75.0

Support cosign
ci: Enable dependabot grouped update for github-actions
2026-04-27 01:20:28 +00:00 · 2026-04-07 15:35:56 +00:00 · 2026-04-08 00:33:03 +09:00 · 2026-04-07 23:09:26 +09:00 · 2026-04-07 23:08:37 +09:00 · 2026-04-07 22:55:56 +09:00
32 changed files with 1252 additions and 542 deletions
--- a/.github/.cspell/project-dictionary.txt
+++ b/.github/.cspell/project-dictionary.txt
@@ -45,3 +45,4 @@ watchexec
 worktree
 xbuild
 xscale
+xwin
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1 @@
+blank_issues_enabled: true
--- a/.github/ISSUE_TEMPLATE/new_tool.yml
+++ b/.github/ISSUE_TEMPLATE/new_tool.yml
@@ -0,0 +1,46 @@
+name: New tool suggestion
+description: Suggest support for a new tool
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for a new tool suggestion!
+
+        Normally, you don't need to open an issue to request support for a new tool.
+        Instead, please submit a pull request.
+        (See [DEVELOPMENT.md](https://github.com/taiki-e/install-action/blob/main/DEVELOPMENT.md) for how to add support for a new tool.)
+
+        That said, if you have any questions before getting started, or if you’re unable to contribute for any reason, feel free to open an issue.
+  - type: input
+    id: name
+    attributes:
+      label: Tool name
+    validations:
+      required: true
+  - type: dropdown
+    id: pre-built
+    attributes:
+      label: Are official pre-built binaries provided?
+      description: |
+        If "No", this issue will be blocked until official pre-built binaries are provided.<br>
+        If "Unknown", this issue will be blocked until it is determined that it is provided.<br>
+        (When the tool is a Rust crate, it may already be available via fallback even if "No" or "Unknown".)<br>
+      options:
+        - 'Yes'
+        - 'No'
+        - Unknown
+      default: 2
+    validations:
+      required: true
+  - type: input
+    id: url
+    attributes:
+      label: Website or repository link
+    validations:
+      required: true
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Any additional context that you believe may be relevant.
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -21,3 +21,7 @@ updates:
    commit-message:
      prefix: ''
    labels: []
+    groups:
+      github-actions:
+        patterns:
+          - '*'
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,20 +33,20 @@ concurrency:

 jobs:
  miri:
-    uses: taiki-e/github-actions/.github/workflows/miri.yml@main
+    uses: taiki-e/github-actions/.github/workflows/miri.yml@606d6c78d69927c489d319133073a03157928a7a # main
    with:
      # NB: sync with test job's --exclude option
      args: --exclude install-action-internal-codegen
  msrv:
-    uses: taiki-e/github-actions/.github/workflows/msrv.yml@main
+    uses: taiki-e/github-actions/.github/workflows/msrv.yml@606d6c78d69927c489d319133073a03157928a7a # main
  test-manifest-schema:
-    uses: taiki-e/github-actions/.github/workflows/test.yml@main
+    uses: taiki-e/github-actions/.github/workflows/test.yml@606d6c78d69927c489d319133073a03157928a7a # main
    with:
      # NB: sync with miri job's --exclude option
      test-args: --exclude install-action-internal-codegen
      no-std: false
  tidy:
-    uses: taiki-e/github-actions/.github/workflows/tidy.yml@main
+    uses: taiki-e/github-actions/.github/workflows/tidy.yml@606d6c78d69927c489d319133073a03157928a7a # main
    permissions:
      contents: write # for creating branch for pr
      pull-requests: write # unused (used in `codegen-automerge: true` case)
@@ -95,7 +95,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@83ed61bfbe2b8abbb3c66e8b65b1335484c70009 # v1.4.1
      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
      - run: rm -- Cargo.toml
      - name: Generate tool list
@@ -154,7 +154,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@83ed61bfbe2b8abbb3c66e8b65b1335484c70009 # v1.4.1
      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
      - run: rm -- Cargo.toml
      - run: env
@@ -187,7 +187,7 @@ jobs:
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 60
    steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@83ed61bfbe2b8abbb3c66e8b65b1335484c70009 # v1.4.1
      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
      - run: rm -- Cargo.toml
      - run: env
@@ -221,11 +221,13 @@ jobs:
          - ubuntu:22.04 # glibc 2.35
          - ubuntu:24.04 # glibc 2.39
          - ubuntu:26.04 # glibc 2.42
+          - ubuntu:rolling
          - debian:9-slim # glibc 2.24
          - debian:10-slim # glibc 2.28
          - debian:11-slim # glibc 2.31
          - debian:12-slim # glibc 2.36
          - debian:13-slim # glibc 2.41
+          - debian:testing
          - fedora:latest # glibc 2.39 (as of fedora 40)
          - almalinux:8 # glibc 2.28
          - almalinux:8-minimal # glibc 2.28
@@ -264,6 +266,16 @@ jobs:
        if: startsWith(matrix.container, 'debian:9') || startsWith(matrix.container, 'debian:10')
      - name: Install requirements (centos)
        run: |
+          retry() {
+            for i in {1..10}; do
+              if "$@"; then
+                return 0
+              else
+                sleep "${i}"
+              fi
+            done
+            "$@"
+          }
          # In CentOS, the old repositories is removed from the main mirrors just after EoL.
          # https://github.com/rust-lang/rust/pull/126352
          sed -i /etc/yum.repos.d/*.repo -e 's!^mirrorlist!#mirrorlist!' \
@@ -271,22 +283,22 @@ jobs:
          sed -i 's/enabled=1/enabled=0/' /etc/yum/pluginconf.d/fastestmirror.conf
          if [[ "${CONTAINER}" == "centos:6" ]]; then
            # CentOS 6's curl (7.19.7) has no curl has no --proto/--tlsv1.2.
-            yum install -y gcc openssl-devel
-            curl -fsSL --retry 10 https://curl.se/download/curl-7.34.0.tar.gz | tar xzf -
+            retry yum install -y gcc openssl-devel
+            retry curl -fsSL --retry 10 https://curl.se/download/curl-7.34.0.tar.gz | tar xzf -
            cd -- curl-*
            ./configure --prefix=/usr/local --with-ssl
            make
            make install
            # for checkout-action https://github.com/taiki-e/checkout-action/blob/v1.3.0/.github/workflows/ci.yml#L135-L143
-            yum install -y openssh-clients perl perl-Error perl-TermReadKey rsync
-            rpm -i \
+            retry yum install -y openssh-clients perl perl-Error perl-TermReadKey rsync
+            retry rpm -i \
              https://vault.ius.io/el6/x86_64/packages/p/perl-Git18-1.8.5.5-4.ius.el6.noarch.rpm \
              https://vault.ius.io/el6/x86_64/packages/g/git18-1.8.5.5-4.ius.el6.x86_64.rpm
          fi
        env:
          CONTAINER: ${{ matrix.container }}
        if: startsWith(matrix.container, 'centos')
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@83ed61bfbe2b8abbb3c66e8b65b1335484c70009 # v1.4.1
      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
      - run: rm -- Cargo.toml
      - name: Generate tool list
--- a/.github/workflows/manifest.yml
+++ b/.github/workflows/manifest.yml
@@ -33,7 +33,7 @@ concurrency:

 jobs:
  manifest:
-    uses: taiki-e/github-actions/.github/workflows/gen.yml@main
+    uses: taiki-e/github-actions/.github/workflows/gen.yml@606d6c78d69927c489d319133073a03157928a7a # main
    permissions:
      contents: write # for creating branch for pr
      pull-requests: write # for gh pr review --approve
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,5 +1,7 @@
 name: Release

+# Adapted from https://github.com/taiki-e/github-actions/blob/HEAD/.github/workflows/action-release.yml.
+
 permissions:
  contents: read

@@ -36,8 +38,8 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
-      - uses: taiki-e/checkout-action@v1
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/checkout-action@83ed61bfbe2b8abbb3c66e8b65b1335484c70009 # v1.4.1
+      - uses: taiki-e/install-action@7bc99eee1f1b8902a125006cf790a1f4c8461e63 # v2.69.8
        with:
          tool: parse-changelog
          fallback: none
@@ -60,19 +62,6 @@ jobs:
            printf '::error::%s\n' "$*"
            exit 1
          }
-          normalize_comma_or_space_separated() {
-            # Normalize whitespace characters into space because it's hard to handle single input contains lines with POSIX sed alone.
-            local list="${1//[$'\r\n\t']/ }"
-            if [[ "${list}" == *","* ]]; then
-              # If a comma is contained, consider it is a comma-separated list.
-              # Drop leading and trailing whitespaces in each element.
-              sed -E 's/ *, */,/g; s/^.//' <<<",${list},"
-            else
-              # Otherwise, consider it is a whitespace-separated list.
-              # Convert whitespace characters into comma.
-              sed -E 's/ +/,/g; s/^.//' <<<" ${list} "
-            fi
-          }
          if { sed --help 2>&1 || true; } | grep -Eq -e '-i extension'; then
            in_place=(-i '')
          else
@@ -218,11 +207,16 @@ jobs:
    permissions:
      contents: write # for taiki-e/create-gh-release-action
    steps:
-      - uses: taiki-e/checkout-action@v1
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/checkout-action@83ed61bfbe2b8abbb3c66e8b65b1335484c70009 # v1.4.1
+      - uses: taiki-e/install-action@7bc99eee1f1b8902a125006cf790a1f4c8461e63 # v2.69.8
        with:
          tool: parse-changelog
          fallback: none
+      - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        id: push-token
+        with:
+          app-id: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
+          private-key: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
      - name: Create and push release commit and tag
        id: push
        run: |
@@ -428,24 +422,24 @@ jobs:
          BRANCH: main
          PREPARE_REV: ${{ needs.prepare.outputs.rev }}
          # Note that if we use secrets.GITHUB_TOKEN, the pushed commit/tag cannot trigger other workflows.
-          PUSH_TOKEN: ${{ secrets.PUSH_TOKEN }}
-      - uses: taiki-e/create-gh-release-action@v1
+          PUSH_TOKEN: ${{ steps.push-token.outputs.token }}
+      - uses: taiki-e/create-gh-release-action@c5baa0b5dc700cf06439d87935e130220a6882d9 # v1.9.3
        with:
          changelog: CHANGELOG.md
          title: $version
          branch: main
-          token: ${{ secrets.GITHUB_TOKEN }}
          ref: refs/tags/${{ needs.prepare.outputs.tag }}

  release-manifest-schema:
    if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action-manifest-schema'
-    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@main
+    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@606d6c78d69927c489d319133073a03157928a7a # main
    permissions:
      contents: write # for taiki-e/create-gh-release-action
      id-token: write # for rust-lang/crates-io-auth-action
      attestations: write # unused (used when options for uploading binaries are set)
    secrets:
-      PUSH_TOKEN: ${{ secrets.PUSH_TOKEN }}
+      PUSH_TOKEN_APP_CLIENT_ID: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
+      PUSH_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
    with:
      version: ${{ inputs.version }}
      tag-prefix: install-action-manifest-schema-
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -4,7 +4,3 @@
 rules:
  anonymous-definition: { disable: true }
  dependabot-cooldown: { config: { days: 14 } }
-  unpinned-uses:
-    config:
-      policies:
-        taiki-e/*: any
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,44 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com

 ## [Unreleased]

+## [2.75.0] - 2026-04-07
+
+- Support `cosign`. ([#1677](https://github.com/taiki-e/install-action/pull/1677))
+
+## [2.74.1] - 2026-04-07
+
+- Update `mise@latest` to 2026.4.5.
+
+- Update `tombi@latest` to 0.9.15.
+
+## [2.74.0] - 2026-04-06
+
+- Support `cargo-deb`. ([#1669](https://github.com/taiki-e/install-action/pull/1669))
+
+- Update `just@latest` to 1.49.0.
+
+- Update `mise@latest` to 2026.4.4.
+
+## [2.73.0] - 2026-04-05
+
+- Introduce [dependency cooldown](https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns) when installing with `taiki-e/install-action@<tool_name>`, `tool: <tool_name>@latest`, or `tool: <tool_name>@<omitted_version>` to mitigate the risk of supply chain attacks by default. ([#1666](https://github.com/taiki-e/install-action/pull/1666))
+
+  This action without this cooldown already takes a few hours to a few days for new releases to be reflected (as with other common package managers that verify checksums or signatures), so this should not affect most users.
+
+  See the ["Security" section in readme](https://github.com/taiki-e/install-action#security) for more details.
+
+- Improve robustness for network failure.
+
+- Documentation improvements.
+
+## [2.72.0] - 2026-04-04
+
+- Support `cargo-xwin`. ([#1659](https://github.com/taiki-e/install-action/pull/1659), thanks @daxpedda)
+
+- Support trailing comma in `tool` input option.
+
+- Update `tombi@latest` to 0.9.14.
+
 ## [2.71.3] - 2026-04-04

 - Update `wasm-tools@latest` to 1.246.2.
@@ -6127,7 +6165,12 @@ Note: This release is considered a breaking change because installing on version

 Initial release

-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.71.3...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.0...HEAD
+[2.75.0]: https://github.com/taiki-e/install-action/compare/v2.74.1...v2.75.0
+[2.74.1]: https://github.com/taiki-e/install-action/compare/v2.74.0...v2.74.1
+[2.74.0]: https://github.com/taiki-e/install-action/compare/v2.73.0...v2.74.0
+[2.73.0]: https://github.com/taiki-e/install-action/compare/v2.72.0...v2.73.0
+[2.72.0]: https://github.com/taiki-e/install-action/compare/v2.71.3...v2.72.0
 [2.71.3]: https://github.com/taiki-e/install-action/compare/v2.71.2...v2.71.3
 [2.71.2]: https://github.com/taiki-e/install-action/compare/v2.71.1...v2.71.2
 [2.71.1]: https://github.com/taiki-e/install-action/compare/v2.71.0...v2.71.1
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -21,9 +21,7 @@ See JSON files in `tools/codegen/base` directory for examples of the manifest.
 > GITHUB_TOKEN=$(gh auth token) ./tools/manifest.sh <tool>
 > ```

-## Refresh TOOLS.md
-
-To update `TOOLS.md`, run
+3\. Update `TOOLS.md` with the following command.

 ```sh
 ./tools/update-markdown.sh
--- a/README.md
+++ b/README.md
@@ -23,7 +23,7 @@ GitHub Action for installing development tools (mainly from GitHub Releases).
 | Name | Required | Description | Type | Default |
 | ---- | :------: | ----------- | ---- | ------- |
 | tool | **✓** | Tools to install (whitespace or comma separated list) | String | |
-| checksum | | Whether to enable checksums | Boolean | `true` |
+| checksum | | Whether to enable checksums (strongly discouraged to disable) | Boolean | `true` |

 ### Example workflow

@@ -100,18 +100,28 @@ See the [development guide](DEVELOPMENT.md) for how to add support for new tool.

 ## Security

-The `@v<major>` and `@<tool_name>` tags are updated with each release. To enhance workflow stability and security against supply chain attacks, use the `@v<major>.<minor>.<patch>` tag or their hash to pin the version. Since all releases are immutable, pinning the version in either way should have the same effect.
+The `@v<major>` and `@<tool_name>` tags are updated with each release. If you want to enhance workflow stability and security against supply chain attacks, consider using the `@v<major>.<minor>.<patch>` tag or their hash to pin the version and regularly updating with [dependency cooldown]. Since all releases are immutable, pinning the version in either way should have the same effect. Pinning `@<tool_name>` tags by hash is strongly discouraged, as it causes the workflow to reference a [commit that is not present on the repository](https://docs.zizmor.sh/audits/#impostor-commit) when a new version is released.

-When installing the tool from GitHub Releases, the tool version that install-action installs with `tool: <tool_name>@latest` or `tool: <tool_name>@<omitted_version>` is associated with the install-action version, so pinning install-action version with the above ways also pins the version of the tool being installed. This also means that if a [dependency cooldown](https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns) applies to the action itself, a cooldown of the same duration or a few days longer will apply to the tools installed by that action.
+<!-- omit in toc -->
+### Security on installation from GitHub Releases

-### Security on tool installation
+**Tools covered in this section:** Tools in the [supported tools list](TOOLS.md) where column "Where will it be installed from" is "GitHub Releases".

-When installing the tool from GitHub Releases, this action will download the tool or its installer from GitHub Releases using HTTPS with tlsv1.2+. This is basically considered to be the same level of security as [the recommended installation of rustup](https://www.rust-lang.org/tools/install).
+This action will download the tool or its installer from GitHub Releases using HTTPS with tlsv1.2+. This is basically considered to be the same level of security as [the recommended installation of rustup](https://www.rust-lang.org/tools/install).

-Additionally, this action will also verify SHA256 checksums for downloaded files in all tools installed from GitHub Releases. This is enabled by default and can be disabled by setting the `checksum` input option to `false`.
+Additionally, this action will also verify SHA256 checksums for downloaded files for all tools covered in this section. This is enabled by default and can be disabled by setting the `checksum` input option to `false` (strongly discouraged to disable).

 Additionally, we also verify [artifact attestations](https://docs.github.com/en/actions/concepts/security/artifact-attestations) or signature if the tool publishes artifact attestations or distributes signed archives. Verification is done at the stage of getting the checksum, so disabling the checksum will also disable verification.

+When installing with `taiki-e/install-action@<tool_name>`, `tool: <tool_name>`, or `tool: <tool_name>@<omitted_version>`, The tool version is reflects upstream releases with a delay of one to a few days (as with other common package managers that verify checksums or signatures). A delay of at least one day is known as [dependency cooldown] and is intended to mitigate the risk of supply chain attacks (the specific cooldown period may be changed in the future). You can bypass the cooldown by explicitly specifying a version. If you want a longer cooldown, consider using the property described below.
+
+When installing with `tool: <tool_name>` or `tool: <tool_name>@<omitted_version>`, the tool version is associated with the install-action version, so pinning install-action version with the `@v<major>.<minor>.<patch>` tag or their hash also pins the version of the tool being installed. This also means that if a [dependency cooldown] applies to the action itself, a cooldown of one to a few days longer will apply to the tools installed by that action.
+
+[dependency cooldown]: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
+
+<!-- omit in toc -->
+### Security on other installation methods
+
 See the linked documentation for information on security when installed using [snap](https://snapcraft.io/docs) or [cargo-binstall](https://github.com/cargo-bins/cargo-binstall#faq).

 See the [Supported tools section](#supported-tools) for how to ensure that fallback is not used.
--- a/TOOLS.md
+++ b/TOOLS.md
@@ -22,6 +22,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**cargo-careful**](https://github.com/RalfJung/cargo-careful) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/RalfJung/cargo-careful/releases) | Linux, macOS, Windows | [MIT](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-APACHE) |
 | [**cargo-cyclonedx**](https://github.com/CycloneDX/cyclonedx-rust-cargo) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/CycloneDX/cyclonedx-rust-cargo/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/CycloneDX/cyclonedx-rust-cargo/blob/main/LICENSE) |
 | [**cargo-deadlinks**](https://github.com/deadlinks/cargo-deadlinks) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/deadlinks/cargo-deadlinks/releases) | Linux, macOS, Windows | [MIT](https://github.com/deadlinks/cargo-deadlinks/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/deadlinks/cargo-deadlinks/blob/master/LICENSE-APACHE) |
+| [**cargo-deb**](https://github.com/kornelski/cargo-deb) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/kornelski/cargo-deb/releases) | Linux | [MIT](https://github.com/kornelski/cargo-deb/blob/main/LICENSE) |
 | [**cargo-deny**](https://github.com/EmbarkStudios/cargo-deny) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/EmbarkStudios/cargo-deny/releases) | Linux, macOS, Windows | [MIT](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-APACHE) |
 | [**cargo-dinghy**](https://github.com/sonos/dinghy) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sonos/dinghy/releases) | Linux, macOS | [MIT](https://github.com/sonos/dinghy/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/sonos/dinghy/blob/main/LICENSE-APACHE) |
 | [**cargo-export**](https://github.com/bazhenov/cargo-export) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bazhenov/cargo-export/releases) | Linux, macOS, Windows | [MIT](https://github.com/bazhenov/cargo-export/blob/master/LICENSE) |
@@ -43,8 +44,10 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**cargo-tarpaulin**](https://github.com/xd009642/tarpaulin) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/xd009642/tarpaulin/releases) | Linux, macOS, Windows | [MIT](https://github.com/xd009642/tarpaulin/blob/develop/LICENSE-MIT) OR [Apache-2.0](https://github.com/xd009642/tarpaulin/blob/develop/LICENSE-APACHE) |
 | [**cargo-udeps**](https://github.com/est31/cargo-udeps) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/est31/cargo-udeps/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/est31/cargo-udeps/blob/HEAD/LICENSE) |
 | [**cargo-valgrind**](https://github.com/jfrimmel/cargo-valgrind) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/jfrimmel/cargo-valgrind/releases) | Linux, macOS, Windows | [MIT](https://github.com/jfrimmel/cargo-valgrind/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/jfrimmel/cargo-valgrind/blob/master/LICENSE-APACHE) |
+| [**cargo-xwin**](https://github.com/rust-cross/cargo-xwin) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-cross/cargo-xwin/releases) | Linux, macOS, Windows | [MIT](https://github.com/rust-cross/cargo-xwin/blob/main/LICENSE) |
 | [**cargo-zigbuild**](https://github.com/rust-cross/cargo-zigbuild) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-cross/cargo-zigbuild/releases) | Linux, macOS, Windows | [MIT](https://github.com/rust-cross/cargo-zigbuild/blob/main/LICENSE) |
 | [**coreutils**](https://github.com/uutils/coreutils) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/uutils/coreutils/releases) | Linux, macOS, Windows | [MIT](https://github.com/uutils/coreutils/blob/main/LICENSE) |
+| [**cosign**](https://github.com/sigstore/cosign) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/sigstore/cosign/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/sigstore/cosign/blob/main/LICENSE) |
 | [**covgate**](https://github.com/jesse-black/covgate) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/jesse-black/covgate/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/jesse-black/covgate/blob/main/LICENSE) |
 | [**cross**](https://github.com/cross-rs/cross) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cross-rs/cross/releases) | Linux, macOS, Windows | [MIT](https://github.com/cross-rs/cross/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/cross-rs/cross/blob/main/LICENSE-APACHE) |
 | [**cyclonedx**](https://github.com/CycloneDX/cyclonedx-cli) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/CycloneDX/cyclonedx-cli/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/CycloneDX/cyclonedx-cli/blob/main/LICENSE) |
@@ -85,7 +88,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**trunk**](https://github.com/trunk-rs/trunk) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/trunk-rs/trunk/releases) | Linux, macOS, Windows | [MIT](https://github.com/trunk-rs/trunk/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/trunk-rs/trunk/blob/main/LICENSE-APACHE) |
 | [**typos**](https://github.com/crate-ci/typos) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/crate-ci/typos/releases) | Linux, macOS, Windows | [MIT](https://github.com/crate-ci/typos/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/crate-ci/typos/blob/master/LICENSE-APACHE) |
 | [**ubi**](https://github.com/houseabsolute/ubi) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/houseabsolute/ubi/releases) | Linux, macOS, Windows | [MIT](https://github.com/houseabsolute/ubi/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/houseabsolute/ubi/blob/master/LICENSE-APACHE) |
-| [**uv**](https://github.com/astral-sh/uv) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/astral-sh/uv/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT) |
+| [**uv**](https://github.com/astral-sh/uv) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/astral-sh/uv/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT) |
 | [**vacuum**](https://github.com/daveshanley/vacuum) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/daveshanley/vacuum/releases) | Linux, macOS, Windows | [MIT](https://github.com/daveshanley/vacuum/blob/main/LICENSE) |
 | [**valgrind**](https://valgrind.org/) | `/snap/bin` | [snap](https://snapcraft.io/install/valgrind/ubuntu) | Linux | [GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD) |
 | [**wait-for-them**](https://github.com/shenek/wait-for-them) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/shenek/wait-for-them/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/shenek/wait-for-them/blob/v0.4.0/Cargo.toml#L7) |
--- a/action.yml
+++ b/action.yml
@@ -7,7 +7,7 @@ inputs:
    required: true
    # default: #publish:tool
  checksum:
-    description: Whether to enable checksums
+    description: Whether to enable checksums (strongly discouraged to disable)
    required: false
    default: 'true'
  fallback:
@@ -40,10 +40,8 @@ runs:
            exit 1
          fi
        fi
+        bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
      shell: sh
-      if: runner.os == 'Linux'
-    - run: bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
-      shell: bash
      env:
        # NB: Sync with Windows case.
        INPUT_TOOL: ${{ inputs.tool }}
--- a/main.sh
+++ b/main.sh
@@ -35,7 +35,7 @@ normalize_comma_or_space_separated() {
  if [[ "${list}" == *","* ]]; then
    # If a comma is contained, consider it is a comma-separated list.
    # Drop leading and trailing whitespaces in each element.
-    sed -E 's/ *, */,/g; s/^.//' <<<",${list},"
+    sed -E 's/ *, */,/g; s/^.//; s/,,$/,/' <<<",${list},"
  else
    # Otherwise, consider it is a whitespace-separated list.
    # Convert whitespace characters into comma.
@@ -56,7 +56,7 @@ download_and_checksum() {
    checksum=''
  fi
  info "downloading ${url}"
-  retry curl --proto '=https' --tlsv1.2 -fsSL "${url}" -o tmp
+  retry curl --proto '=https' --tlsv1.2 -fsSL --retry 10 -o tmp "${url}"
  if [[ -n "${checksum}" ]]; then
    info "verifying sha256 checksum for $(basename -- "${url}")"
    if type -P sha256sum >/dev/null; then
@@ -161,6 +161,17 @@ download_and_extract() {
        esac
      fi
      ;;
+    *.deb)
+      if ! type -P dpkg-deb >/dev/null; then
+        case "${base_distro}" in
+          debian | fedora | suse | arch | alpine)
+            printf '::group::Install packages required for installation (dpkg)\n'
+            sys_install dpkg
+            printf '::endgroup::\n'
+            ;;
+        esac
+      fi
+      ;;
  esac

  mkdir -p -- "${tmp_dir}"
@@ -194,6 +205,12 @@ download_and_extract() {
            mv -- "${tmp}" "${bin_dir}/"
          done
          ;;
+        *.deb)
+          dpkg-deb -x tmp .
+          for tmp in "${bin_in_archive[@]}"; do
+            mv -- "${tmp}" "${bin_dir}/"
+          done
+          ;;
        *)
          for tmp in "${installed_bin[@]}"; do
            mv -- tmp "${tmp}"
@@ -233,7 +250,7 @@ read_manifest() {
      # TODO: don't hardcode tool name and use 'immediate_yank_reflection' field in base manifest.
      case "${tool}" in
        cargo-nextest)
-          crate_info=$(retry curl --user-agent "${ACTION_USER_AGENT}" --proto '=https' --tlsv1.2 -fsSL "https://crates.io/api/v1/crates/${rust_crate}" || true)
+          crate_info=$(retry curl --user-agent "${ACTION_USER_AGENT}" --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${rust_crate}" || true)
          if [[ -n "${crate_info}" ]]; then
            while true; do
              yanked=$(jq -r ".versions[] | select(.num == \"${exact_version}\") | .yanked" <<<"${crate_info}")
@@ -443,13 +460,19 @@ case "$(uname -s)" in
  Linux)
    host_os=linux
    ldd_version=$(ldd --version 2>&1 || true)
-    if grep -Fq musl <<<"${ldd_version}"; then
+    if [[ "${ldd_version}" == *'musl'* ]]; then
      host_env=musl
    else
      host_env=gnu
      host_glibc_version=$(grep -E "GLIBC|GNU libc" <<<"${ldd_version}" | sed -E "s/.* //g")
    fi
-    if [[ -e /etc/os-release ]]; then
+    if [[ -e /etc/redhat-release ]]; then
+      # /etc/os-release is available on RHEL/CentOS 7+
+      base_distro=fedora
+    elif [[ -e /etc/debian_version ]]; then
+      # /etc/os-release is available on Debian 7+
+      base_distro=debian
+    elif [[ -e /etc/os-release ]]; then
      if grep -Eq '^ID_LIKE=' /etc/os-release; then
        base_distro=$(grep -E '^ID_LIKE=' /etc/os-release | cut -d= -f2)
        case "${base_distro}" in
@@ -463,12 +486,6 @@ case "$(uname -s)" in
        base_distro=$(grep -E '^ID=' /etc/os-release | cut -d= -f2)
      fi
      base_distro="${base_distro//\"/}"
-    elif [[ -e /etc/redhat-release ]]; then
-      # /etc/os-release is available on RHEL/CentOS 7+
-      base_distro=fedora
-    elif [[ -e /etc/debian_version ]]; then
-      # /etc/os-release is available on Debian 7+
-      base_distro=debian
    fi
    case "${base_distro}" in
      fedora)
@@ -597,7 +614,10 @@ fi
 enable_checksum="${INPUT_CHECKSUM:-}"
 case "${enable_checksum}" in
  true) ;;
-  false) enable_checksum='' ;;
+  false)
+    enable_checksum=''
+    warn "checksums have been disabled by 'checksum' input option; this is strongly discouraged for security reasons"
+    ;;
  *) bail "'checksum' input option must be 'true' or 'false': '${enable_checksum}'" ;;
 esac

@@ -855,8 +875,8 @@ for tool in "${tools[@]}"; do
      iai-callgrind-runner) ;;
      # cargo-zigbuild/cargo-insta has no --version flag on `cargo $tool_bin_stem` subcommand.
      cargo-zigbuild | cargo-insta) rx "${tool_bin_stem}" --version ;;
-      # deepsource has version command instead of --version flag.
-      deepsource | vacuum) rx "${tool_bin_stem}" version ;;
+      # these packages have version command instead of --version flag.
+      cosign | deepsource | vacuum) rx "${tool_bin_stem}" version ;;
      cargo-*)
        case "${tool_bin_stem}" in
          # cargo-valgrind 2.1.0's --version flag just calls cargo's --version flag
--- a/manifests/cargo-deb.json
+++ b/manifests/cargo-deb.json
@@ -0,0 +1,37 @@
+{
+  "rust_crate": "cargo-deb",
+  "template": {
+    "x86_64_linux_gnu": {
+      "url": "https://github.com/kornelski/cargo-deb/releases/download/v${version}/cargo-deb_${version}-1_amd64.deb",
+      "bin": "usr/bin/cargo-deb"
+    }
+  },
+  "license_markdown": "[MIT](https://github.com/kornelski/cargo-deb/blob/main/LICENSE)",
+  "latest": {
+    "version": "3.6.3"
+  },
+  "3": {
+    "version": "3.6.3"
+  },
+  "3.6": {
+    "version": "3.6.3"
+  },
+  "3.6.3": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE63F58EBB06E1",
+      "hash": "e4b8c1a499a8f4e5b96d72f0d1ec9da8005ba379aee95aaeef83860991c831c3"
+    }
+  },
+  "3.6.2": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE0A5D04840934",
+      "hash": "a0053e0089f0efb194013e9629087c247d1de6cb439b7381b4109e21153b991e"
+    }
+  },
+  "3.6.1": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DDE4DDD98766C4",
+      "hash": "c7c890cc90dae8c4f5f9ad0ff3d7675fec74fbb57ff89c4f27cfbbab34676e93"
+    }
+  }
+}
--- a/manifests/cargo-xwin.json
+++ b/manifests/cargo-xwin.json
@@ -0,0 +1,406 @@
+{
+  "rust_crate": "cargo-xwin",
+  "template": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/rust-cross/cargo-xwin/releases/download/v${version}/cargo-xwin-v${version}.x86_64-unknown-linux-musl.tar.gz"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/rust-cross/cargo-xwin/releases/download/v${version}/cargo-xwin-v${version}.universal2-apple-darwin.tar.gz"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/rust-cross/cargo-xwin/releases/download/v${version}/cargo-xwin-v${version}.windows-x64.zip"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/rust-cross/cargo-xwin/releases/download/v${version}/cargo-xwin-v${version}.aarch64-unknown-linux-musl.tar.gz"
+    }
+  },
+  "license_markdown": "[MIT](https://github.com/rust-cross/cargo-xwin/blob/main/LICENSE)",
+  "latest": {
+    "version": "0.21.4"
+  },
+  "0.21": {
+    "version": "0.21.4"
+  },
+  "0.21.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE600B46A93E96",
+      "hash": "fe3e4afd02c24f90da1333fc9a5896813d3daee3bd0e5c5d89a4800eb58b9687"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE600B4A82E719",
+      "hash": "ddaeb84691027edd7b5012f617ac59d5dedf8b2d3472798c1e4521808cf1be78"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE600B35C26780",
+      "hash": "6136ba7c320265a8ee6c663fad9c84bbe55185d9f6bccec8f61ae7f5798400e8"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE600AF0A1F960",
+      "hash": "c5f125e9da3ac89ec1e2fa6888afedff2b75b8c025c381150c3676817762f7cf"
+    }
+  },
+  "0.21.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE5DA9F883D575",
+      "hash": "cc4c322d4dfd5480bb4e39efa80fc51b08a65af5105d2d4f6607e9dc58ae72e2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE5DAADCC5C6A6",
+      "hash": "6e96509d70fe79224d79505e9e9467137a3f299acc57ecaafa8c701af855b537"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE5DAA849F88C7",
+      "hash": "53284aec3e9a012712123b9c155145891dcd457aad63408b5557d82281cc172e"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE5DAA3406E74D",
+      "hash": "885554586b7976de6d497be4230a22e8905d6d975b6275650a81461ee6b2fd41"
+    }
+  },
+  "0.21.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE556CBE19F2B9",
+      "hash": "b4f6305c9e9277a017caf229be21ee3a9eabafb569e48fb94bd19462374d5a0d"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE556CF3C7F023",
+      "hash": "e5668a9c89f631485a56f259671a102501854e049f48dc554d47d65ad0d64d81"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE556C77269749",
+      "hash": "e4397af02b47c11fd2dd4ef6837350c9aa85fd1ec2707cbc616f9938f48b0c1b"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE556CC89C2946",
+      "hash": "551e0fb484ebdb2528cda57982e2862ed6dc401fa94b03e6a448dc784b4a70bc"
+    }
+  },
+  "0.21.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE556BA913B810",
+      "hash": "a2854076543226e3fe7cd13b8fe3944a86aa1ec786bca2a17050fd5f10679f9e"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE556B9DEE31AE",
+      "hash": "fd7fc2dbc3a25d29855a16c0229e2faf8b7813e3583803664219a1976a8149fe"
+    }
+  },
+  "0.21.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE556A00F6F0D7",
+      "hash": "3a6cf133224c7892f3ce9a759def219a9da9b91828a1ff4c014b050f612dab40"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE556A52036390",
+      "hash": "804cb91204ca021916de2dc74861ec977656b850ac1cc1dd8c1c465eb15e9d21"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE556A42974548",
+      "hash": "d7116616379104c0a152c570750e54a62621062f64aedc82ff8dc849b87e879a"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE5569FDEE043A",
+      "hash": "b4deede6f6ab774cd508e8892eb68926542e4cd19d9329a79dbb084921fecc17"
+    }
+  },
+  "0.20": {
+    "version": "0.20.2"
+  },
+  "0.20.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE1B943AB4AF33",
+      "hash": "81eb698b63fc196ad0601167dbc4bd191fdf7543b48ff1ab6cded6eb354f92bd"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE1B942F56F595",
+      "hash": "94c9249218c0c8595d265ec0ba3780954f1ff7799fd3ab2c773669ced39ad514"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE1B93D8EF8707",
+      "hash": "02ce726fc1a89054e86eaae28315715f41e920ac8b24ae9da2c733ca5b6bae71"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE1B941A8C4951",
+      "hash": "71420b6949774eb75fc89704191b5e858146645083ef7ffba11cd008030a9a0f"
+    }
+  },
+  "0.20.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE0A454A67227E",
+      "hash": "779286435b8cfe24069ce7d21c7953d8cc1b297110b2cfc645234b511ad150f2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE0A45AF373CB0",
+      "hash": "7e2ef1b2eae202957babc595d7bc2be1f09fe8757e27ce8f3ecffac14936783a"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE0A452EB50C40",
+      "hash": "51545a33e45c7b4c26feb6fae9eeb35ab9d936bbe4ee1c15bbb6e1a06c99a91e"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE0A456EFDE36A",
+      "hash": "b7dc2239f051675e96240b1b617b2a3bcc94b58d20ee3dde329f272a8c876dfa"
+    }
+  },
+  "0.20.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE072F952C41EB",
+      "hash": "083fdc00067f69eed2ddd2b40b37436b55d417104101b4f618157c35e4125d49"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE072FC97A9F36",
+      "hash": "025ac0e6b5e5d8f7a5364e97bbe23a49297437aa4063c4cef608b5689b547293"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE072FE1FFF088",
+      "hash": "6f450cf62ec8e1dece73eea487174d83311762122a1a8196f5b229a5fb109904"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE072F974E68F2",
+      "hash": "4b35a5e69347fa29b8b051a4ece87cb74129d2bbdfcecaf35f18f6025d9cb0ce"
+    }
+  },
+  "0.19": {
+    "version": "0.19.2"
+  },
+  "0.19.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DDD4FA6C5995C9",
+      "hash": "89af8a9cef823e01c0d2f612ade731b4b638b0d199dc1dc09957017ff53a39cb"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DDD4FA0504038C",
+      "hash": "65522dbb52ddc0c59d19c594c3993a1daa4345d8b526b938f7b2da3d65dde31e"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DDD4FA6D526ECB",
+      "hash": "860473eb378e6c146bcaef7ed84deff4b465602a9300cf39442c2f9bb1f35152"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DDD4FA5CCE5810",
+      "hash": "5986e73691f67a8d97921ff0e4add4bd3c2c758867f0049e07d4468cd4f5e439"
+    }
+  },
+  "0.19.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DDBDE32F5348B4",
+      "hash": "baa5b908620ce60636a07b5cd54948f4466d6b1f4372bb17e371fa58bdfd7f95"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DDBDE30AD344DB",
+      "hash": "67b2c2d4ffd1cbe926b805b8766346b2521250650eae5b93fc397efdbe69f322"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DDBDE37F279D0D",
+      "hash": "e1e4bc3b9b52c026491a291125a7408bb74f2dd898d491b791b7a84a6753b4bd"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DDBDE2DF764B7D",
+      "hash": "85569f88ad728ae417c61350aadd4b71cc956d38f8f3eca1717cf98371d16642"
+    }
+  },
+  "0.19.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DDB266A6D4BD7C",
+      "hash": "f5bc724b6fd5af8c294b2cc9890e0600a7de47137cd84f2f0835fd3ebc885581"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DDB266C4F4C65B",
+      "hash": "1c7f4f7a161e207b7173b2b569d198f64927ba2bffaa61812b7447aa3ab59bd4"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DDB266F0C1CB68",
+      "hash": "ca1253ce4d4d287e8a03690fc644f986aef5bbdd6ed08f1438ac443c461b5d77"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DDB266AFDC5848",
+      "hash": "b40cf06a0f84221b5a722a9490c2b95a37bb562a8a1c24375107f459894f6249"
+    }
+  },
+  "0.18": {
+    "version": "0.18.6"
+  },
+  "0.18.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DDA7E03CFB71A8",
+      "hash": "5bf295561ae2fdb9aaba1a4d7b10acff125d657f0d356f20f46db788b05910d8"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DDA75324488DFA",
+      "hash": "aa6cb652d108e87175b43be8941f2ac944498310cd8525be40de03a2707f1e77"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DDA7532EA841D5",
+      "hash": "1e9cc537f098a32909242829d36c462c3e09c7f0238c80da375a8c511e071a06"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DDA7E034FF1090",
+      "hash": "ffa3d74b644883988ee41597284925c97aad183dd77f5f29db64bb6d331f29f6"
+    }
+  },
+  "0.18.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DDA1E6413EA875",
+      "hash": "97470b43878dd14f3c9c08b5f3eb5fbd8b3111e36597ae62bbb50b636b36fc52"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DDA1E64A45AE82",
+      "hash": "479013ccd59d69c3aa4b83a8f02da454b1c092f580d16757eb753194d145ae17"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DDA1E6B46DF128",
+      "hash": "2deb364f2d894ea5b50a2e0f26e96410d7f12701e1ad3286108905e2b9b8ecdc"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DDA1E661868FDE",
+      "hash": "58151eac78e2bafc9600dadc2b77607bfc1f61b95efba8707824bff455aa9824"
+    }
+  },
+  "0.18.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD33C5EAB5DD19",
+      "hash": "35d05e10b12e0f8d56bf25a4bb77700c1369e7d8db63e82a09c2dcf536c6ed71"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD33C612B24250",
+      "hash": "40ddf40369453bfbd39cdecf0e90d81718f28e7cfd64327e6d0ba963b0b2f33c"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD33C672C4572E",
+      "hash": "55600c9a0d3d85bd86afd5bd5fd5d93e18d96b7b9c9f966fd7a45337bacf5d17"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD33C5EA9BBBDC",
+      "hash": "a68290b2b2cdc4a3bc368e5e8fe25a62bf9f4a4fa53290fc8779a73d7b7b881f"
+    }
+  },
+  "0.18.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD242CB4BFE521",
+      "hash": "44136f6357c030d0f5f3f597e5a2a53e5aa8ada45ac78fffb33ab8761bbc91d5"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD242CABFC2F64",
+      "hash": "d22a3d5536dd6dea65600b3cdc006304c7416e1f930b2afd336ec5936a320f5d"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD242CE656CE47",
+      "hash": "3d0ab25517a8dcc6b0390197bdbe7ac945892a153d4f67ddd517f379cd1db86d"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD242C8D2C07DB",
+      "hash": "8bde55860b086ec502f858d988db2ca0651219cf1388ac0157fdaf325f254785"
+    }
+  },
+  "0.18.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD2340A85DD30C",
+      "hash": "2f3a954422c2f7295a64e9c7e8bfbd0c7ea160e87a0920e59e5fc8dd5bb1de4b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD2340D8DD8135",
+      "hash": "32629286ef6e16083cf89a61e027084f2f463aa5e0dc230de720dd5699f96b4d"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD2341097D16D7",
+      "hash": "35c2248edf1a48b9c1c1923de05f99ce578ce7df80615caee77a3cc7194f9e28"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD2340AA0A1674",
+      "hash": "6d21c208b33694303213c5b91e6d516f2bd2fc67bd027d210e2d72eef7b7f0d5"
+    }
+  },
+  "0.18.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD228CA218670D",
+      "hash": "24f5d63d18ab73dcb464c206fab27a60081755416d294b0f728f9dd8db2ae8fe"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD228CAA0EB75B",
+      "hash": "2271128452ef93e42f8506d086b4e86e9963b61cae727e09eb3f05174dfe43b2"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD228CD42423C6",
+      "hash": "34b78fe4abbc4723c631f987d5d1188db2498ea6dbb1b9dcdc7ce4f72ea451fe"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD228C99F2FE57",
+      "hash": "01bfbbd8f69ef64fcffac87e674c027dbdcceb5243535a31dfc97b9e94d58faa"
+    }
+  },
+  "0.18.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD21AF3AB5C8AF",
+      "hash": "c5f23cc01d0c091c67153e93ee34d92160443166ce74595d8fdbf802b5ec09cc"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD21AF54F99F2B",
+      "hash": "af9d29b44da4a8790f5cb424f73bf3dd1c4b611798f3c6789f230b5cf3b45347"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD21AF80BD488B",
+      "hash": "dc82808c5c951009f1e67fe88bace45f0e35eb8c038282c1887f080db5b10704"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD21AF349141F0",
+      "hash": "91457ab107212193b0638b5da234bbd18d8898e4ac901a0f32f5e3b1e4e7fa38"
+    }
+  },
+  "0.17": {
+    "version": "0.17.6"
+  },
+  "0.17.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD1E925AB4F528",
+      "hash": "d391b26b356bac0f642f4e94abbfb8c94d86735951ec25f8404f152468331133"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD1E9266DF9B94",
+      "hash": "50d1f80fd5b364f756dd93670f70f2b967d97839e618e6c000cbfa509bceb059"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD1E929A149415",
+      "hash": "ba6cf8ea22e0721737ccfd6dbda6d90543eabf45947a480d995334832f7719d1"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD1E925A93AFF2",
+      "hash": "c0da934baa028356ed20f57f3d10cfad33781dd457a1960e9f8b3e8f039a2e56"
+    }
+  },
+  "0.17.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD1214BD639CD2",
+      "hash": "4f179d3f543dfe6569fb00fa6655bf1939f782c50df83b7d9704b58ef84a4a81"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD1214C233ADC7",
+      "hash": "a61d590cbddca4ab898f1f1742428ce125a8e795fb8034ad76a307e7830da612"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD121501CF2759",
+      "hash": "5f0e3c1fb9ca39cc157f8f10aeb8af49980863f5f5ae140bdfbb68a2582356ac"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD1214C0F1E9E2",
+      "hash": "cb90d3e070187677c8d71aa17a1d4fd795cb39a2283bbbb71be9ae2d7f04570f"
+    }
+  },
+  "0.17.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD10EA9265F332",
+      "hash": "029bc3e5b4fc1b845dc65bb494813462ec24733ec9fee6b05b2bdfecb3d6d981"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD10EC876C59B6",
+      "hash": "b5a423b7d0fdc946af9ce51424c1b60d71082a0cd4cd01e3a14b7a601fe8d5df"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD10EAE5D42438",
+      "hash": "e88603cb77e5491730bafab5287d8f1465abd2cce731b062cd76d22d70734ac2"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD10EA59E6D198",
+      "hash": "86ac0e9a4f2697259f21fccc291ce121bfc6a39b7d264c58a781bcf89731c79e"
+    }
+  }
+}
--- a/manifests/coreutils.json
+++ b/manifests/coreutils.json
@@ -5,6 +5,50 @@
  "latest": {
    "version": "0.6.0"
  },
+  "0.8.0": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-x86_64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DE941D3DECEE20",
+      "hash": "b8977997a49b677169f7ce65bfc2ad658d4943c4f02f0493b1a802137202b0bf",
+      "bin": "coreutils-0.8.0-x86_64-unknown-linux-musl/coreutils"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-x86_64-apple-darwin.tar.gz",
+      "etag": "0x8DE941DCF25AA9A",
+      "hash": "8ac6299b298eb3ba995973b42aece162578e19f9243425a5945d9c4bd8135b0a",
+      "bin": "coreutils-0.8.0-x86_64-apple-darwin/coreutils"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DE941D6E03C003",
+      "hash": "db464cf2a6ecbfd42c85f46ed2d749be574df4df47feca1f08988fd760f324f3",
+      "bin": "coreutils-0.8.0-x86_64-pc-windows-msvc/coreutils.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-aarch64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DE941C4BA7DC07",
+      "hash": "e592200ef784deecc5ac2328b0617422c89f62b9bb841eb114528ed938ccb725",
+      "bin": "coreutils-0.8.0-aarch64-unknown-linux-musl/coreutils"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-aarch64-apple-darwin.tar.gz",
+      "etag": "0x8DE941D614F7398",
+      "hash": "add95b420f9f1b69a0a7cb7b2672648fc72cf1294384344791e8e064bdc5e8c2",
+      "bin": "coreutils-0.8.0-aarch64-apple-darwin/coreutils"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-aarch64-pc-windows-msvc.zip",
+      "etag": "0x8DE941BAE10C59A",
+      "hash": "1dfa62f18b64c70b664936b06fb1be20f0f6afa9ff041dd95dda629e987435a9",
+      "bin": "coreutils-0.8.0-aarch64-pc-windows-msvc/coreutils.exe"
+    },
+    "riscv64_linux_musl": {
+      "url": "https://github.com/uutils/coreutils/releases/download/0.8.0/coreutils-0.8.0-riscv64gc-unknown-linux-musl.tar.gz",
+      "etag": "0x8DE941BF13F7832",
+      "hash": "6e6c8823d7319f0d83a932515e248df0eb531e07f3a9193aaf05fdfb9dd63698",
+      "bin": "coreutils-0.8.0-riscv64gc-unknown-linux-musl/coreutils"
+    }
+  },
  "0.7.0": {
    "x86_64_linux_musl": {
      "url": "https://github.com/uutils/coreutils/releases/download/0.7.0/coreutils-0.7.0-x86_64-unknown-linux-musl.tar.gz",
--- a/manifests/cosign.json
+++ b/manifests/cosign.json
@@ -0,0 +1,243 @@
+{
+  "rust_crate": null,
+  "template": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-amd64"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-darwin-amd64"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-windows-amd64.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-arm64"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-darwin-arm64"
+    },
+    "powerpc64le_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-ppc64le"
+    },
+    "riscv64_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-riscv64"
+    },
+    "s390x_linux_musl": {
+      "url": "https://github.com/sigstore/cosign/releases/download/v${version}/cosign-linux-s390x"
+    }
+  },
+  "license_markdown": "[Apache-2.0](https://github.com/sigstore/cosign/blob/main/LICENSE)",
+  "latest": {
+    "version": "3.0.5"
+  },
+  "3": {
+    "version": "3.0.5"
+  },
+  "3.0": {
+    "version": "3.0.5"
+  },
+  "3.0.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9427E4F4F66D",
+      "hash": "c956e5dfcac53d52bcf058360d579472f0c1d2d9b69f55209e256fe7783f4c74"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE942809604B8D",
+      "hash": "4c3e7af8372d3ca3296e62fa56f23fcbb5721cc6ac1827900d398f110d7cd280"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE9427FF1A8F49",
+      "hash": "9b85a88ebff2d9dd30ff4984a6f61f2cedc232dd87d81fa7f2ff3c0ed96c241c"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE94280251A997",
+      "hash": "bedac92e8c3729864e13d4a17048007cfafa79d5deca993a43a90ffe018ef2b8"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9427F9B353E4",
+      "hash": "5fadd012ae6381a6a29ff86a7d39aa873878852f1073fc90b15995961ecfb084"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE9427F2F77DC2",
+      "hash": "08c3e5e0a09c440f49e9a69d8639d37fbec522ec8c5c0ac805243b098e6ea512"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE9427F6775D14",
+      "hash": "e25952e798958b0f9168d044153ccc353f5469ca4b71a1707dffad0534d27017"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE9427EF733685",
+      "hash": "3cf4b769258ed9cc3c2a93268c0d5c1cc3fbd094af8df21035cbac8fb0d7c088"
+    }
+  },
+  "3.0.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE6FF25F78B056",
+      "hash": "db15cc99e6e4837daabab023742aaddc3841ce57f193d11b7c3e06c8003642b2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE6FF25A90279D",
+      "hash": "e032c44d3f7c247bbb2966b41239f88ffba002497a4516358d327ad5693c386f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE6FF2745A020C",
+      "hash": "44e9e44202b67ddfaaf5ea1234f5a265417960c4ae98c5b57c35bc40ba9dd714"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE6FF265833D25",
+      "hash": "d098f3168ae4b3aa70b4ca78947329b953272b487727d1722cb3cb098a1a20ab"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE6FF25CFDD02F",
+      "hash": "4888c898e2901521a6bd4cf4f0383c9465588a6a46ecd2465ad34faf13f09eb7"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE6FF26DA417A7",
+      "hash": "ccd07709a25fd549dc3987eb378c4fecc1d7b851c904a59528cae8144f725c36"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE6FF27042D22A",
+      "hash": "9d108e72249dacb6ef5685320f34efcd0d85b842df90552b8fd7903a39a11c98"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE6FF26AFDC493",
+      "hash": "45ebd52e4cb3c1c5dc0661f76728fa9ee7a510ae211b0cde3c43e4d8bebade86"
+    }
+  },
+  "3.0.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE4FCA2BF218E5",
+      "hash": "10dab2fd2170b5aa0d5c0673a9a2793304960220b314f6a873bf39c2f08287aa"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE4FCA39840E0E",
+      "hash": "4dbafca16d29be06a6a740d517a9f63de67c78be3a64d048e42520401d88facc"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE4FCA28D7404D",
+      "hash": "a3a0dc4e8c745f9bd855ec18db346538b78ab2c4d6d510ae4186bb4a03f35438"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE4FCA1C26496E",
+      "hash": "c12fc6150195758ec0b1aeb1aade3381a1d3a299584982b66543f22bab04535b"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE4FCA3CB7AA05",
+      "hash": "7098c46809c0818d970e63f7acd10f44c6919d3b4a261a63972a60694a9c9f66"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE4FCA2210A074",
+      "hash": "784dc5461a588dd8611e7969a4c988620f08bcb7f173beb77321b7acfc9a2b5f"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE4FCA250DB25B",
+      "hash": "9ec0c4ec477aaed0dbf6d3a294405441b2cc93fff0d23482eba5c2e84af5aba4"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE4FCA35FC9609",
+      "hash": "0516fe2ea7d3c039cb6ed99aefbd86b69d661ff35956484c16fb480c29f3897d"
+    }
+  },
+  "3.0.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE378193840B57",
+      "hash": "052363a0e23e2e7ed53641351b8b420918e7e08f9c1d8a42a3dd3877a78a2e10"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE378184E3D243",
+      "hash": "6c75981e85e081a73f0b4087f58e0ad5fd4712c71b37fa0b6ad774c1f965bafa"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE37818A249E3E",
+      "hash": "2593655025b52b5b1c99e43464459b645a3acbe5d4a5a9f3a766e77beec5a441"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE37819892DC0D",
+      "hash": "81398231362031e3c7afd6a7508c57049460cd7e02736f1ebe89a452102253e5"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE378186BF54D2",
+      "hash": "38349e45a8bb0d1ed3a7affb8bdd2e9d597cee08b6800c395a926b4d9adb84d2"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE37819135D5B6",
+      "hash": "6af9ed378d289ffd1bce9b6de02a47a25f9bf32d01a2f6b0f43f0fbb544f14c6"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE3781829B3B92",
+      "hash": "86bbb2c0da0a80107fbe6d500da4148c3f84fa2595f76db68d4499664da2b90d"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE37818ED171E1",
+      "hash": "e8cda1bb6b6719e46fe72a89789852971a228d364063cc961d065c3cd4e3db4b"
+    }
+  },
+  "3.0.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE082BF53266ED",
+      "hash": "46dbdcb5467a3dfec2526923d0b3365e40c8d9dc00ec23d5aca3437449e8cbfd"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE082BF2D094CE",
+      "hash": "0fc2b6f16b900abdfda3153b11fc435a8cbe3830e8e820fe8ad5fe4149a5b472"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE082C03974CE8",
+      "hash": "7a137280d8686665ceb4d8565df2a0ac63f28031e014cdcae5d56891a6c8a400"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE082C0648458F",
+      "hash": "17fd784737ca54d7d8a343c82da6c5d6dbdee971e66644d923d1b057fb97d7ed"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE082C0064BD15",
+      "hash": "3823b044de184da21e300bc5e20dd29d3fa9243af3ba70c4a5da1712f3385d46"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE082C0B62CF31",
+      "hash": "650aefe9d2bf0ee5282e8e40a7fc93ef6d66ef718a83ac3c3ec06b22b797ff00"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE082C0E28E598",
+      "hash": "0ffd9125ada732d3d3f0f1702fefd8031c04383d070cda895c5df2dfaca6e7b8"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE082BFDC4C845",
+      "hash": "f45331cfa5dfb6f908a5ed4f20f6fda4f31716028d6f0dcff9c775f006d486df"
+    }
+  },
+  "3.0.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE05F22B41933C",
+      "hash": "23c9ff889672f03676b673539de07d5ad4e8efc8247a3ad55c9bc00169aa2305"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE05F23E3EC0F5",
+      "hash": "260c174b80d6401a7d2703109eb32f6a0bdbddd2ac91d3268dc96a51238d96ab"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE05F21CA08FF9",
+      "hash": "21843dbb2e910097531ca23e9f87d0ca2ae9a412e056009eae670b090418e8ed"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE05F232E5B6D9",
+      "hash": "8f5bb6899118d521d7b12252f06d5808fba4e6cb0a23ff120ed6c14d7c87863a"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE05F2419FF210",
+      "hash": "dad2a161d91fba199d1ebae7e5652a4c2dd412cbb1ab6b4cc8ad6a15378319fe"
+    },
+    "powerpc64le_linux_musl": {
+      "etag": "0x8DE05F2278FB689",
+      "hash": "82ed1e2c4b37927fc39c488dd1871f2a51ea40140a8c7911ed90026b8d8bf2cd"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE05F23A221742",
+      "hash": "07b7ce941bf9918bf245153bf029d53873f4f0b1bc5e8f9141876b3523c1de0b"
+    },
+    "s390x_linux_musl": {
+      "etag": "0x8DE05F22438B32A",
+      "hash": "6e30ae5e33014197a888b9492728e49aaf72343e31e26da8f7b3720518e8f6df"
+    }
+  }
+}
--- a/manifests/just.json
+++ b/manifests/just.json
@@ -22,10 +22,39 @@
  },
  "license_markdown": "[CC0-1.0](https://github.com/casey/just/blob/master/LICENSE)",
  "latest": {
-    "version": "1.48.1"
+    "version": "1.49.0"
  },
  "1": {
-    "version": "1.48.1"
+    "version": "1.49.0"
+  },
+  "1.49": {
+    "version": "1.49.0"
+  },
+  "1.49.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE92D62FFEE2CA",
+      "hash": "05eb2f068b641b06e5b318796c2e27d4dcca608e65b34329a08c1b9f582611bd"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE92D6315E20A9",
+      "hash": "e0b83a9352952ab25e5cf13f6cb03dd1872416e5d89388b56d6ca58f11b0a3a8"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE92D65DAA4399",
+      "hash": "657338772efd17a31d67285bb5ed691da87741e44311c0366273c6cb7d913b15"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE92D633E8329E",
+      "hash": "993b78f51004248114af22368f69715541542b3c9941c80e02f8ae10eb404ae0"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE92D61E96BBDE",
+      "hash": "d21b20df01ec9b9762b0ef08e56ae8dccf3738770edeafa8d2b3a750aee06d78"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE92D65E1C5B47",
+      "hash": "e73cd7b3c4fb363f703f99caaa71d4ab114a92205b2ef313212f3b2085d3ee64"
+    }
  },
  "1.48": {
    "version": "1.48.1"
--- a/manifests/mise.json
+++ b/manifests/mise.json
@@ -28,13 +28,65 @@
  },
  "license_markdown": "[MIT](https://github.com/jdx/mise/blob/main/LICENSE)",
  "latest": {
-    "version": "2026.4.3"
+    "version": "2026.4.5"
  },
  "2026": {
-    "version": "2026.4.3"
+    "version": "2026.4.5"
  },
  "2026.4": {
-    "version": "2026.4.3"
+    "version": "2026.4.5"
+  },
+  "2026.4.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE93CF28627B72",
+      "hash": "8fa8eb3f3df6054089c1b8d8ab328927add851216053f83e681374f0cf34e4aa"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE93CF2AE7FEDD",
+      "hash": "a6915b8b25548a1556a3880a3d2f75dd8544ccd67ce49cc70f13661fa4eee24c"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE93CF2BA1F279",
+      "hash": "f379f668f5c51e27fab90a70007d7b5140bbabae1a78be85ef9ddef243c936b6"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE93CF253B2C4C",
+      "hash": "384fe2cf9864b1bd0c91beb65c38a0d59b01c7ce1d82f05bd6ea5136e119a6c2"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE93CF29D221B3",
+      "hash": "e2b3e912ab9405daacb79ac283a99ad5b1a04667ad4c0a69dd7ab406ba0ceba9"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE93CF2B2BC09D",
+      "hash": "0dd01e1e456e79db7de39a135e8d73218841d9489b69560ce9e010141b3f21ae"
+    }
+  },
+  "2026.4.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE92B8CD42D7A7",
+      "hash": "3d746d5a137e63ed88e4e2213a9706a43dff68c995376fabb753a90ec799af18"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE92B8CF701697",
+      "hash": "e3fe092643f3e68c3a2be9eef217937f241accb81891332678550c15224627c0"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE92B8D03C1E31",
+      "hash": "5c879723f693514f6f8f725270724561cd8ebdf913188839ad1f879900bf5719"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE92B8CA044A7E",
+      "hash": "e2da1fd598b4aa347761daf373e51608cbc4465c6b076b60b22cb1ef659cf97e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE92B8CEAE639C",
+      "hash": "22459d2852b716f5dbbdb07173ae0fb28d99b701589f6f6a73d85ac47a497de8"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE92B8D051630C",
+      "hash": "6cada4eeeef1a9cd074962a76fa9a6f107b5b791b01839fc3355d3f3b1604c85"
+    }
  },
  "2026.4.3": {
    "x86_64_linux_musl": {
--- a/manifests/shfmt.json
+++ b/manifests/shfmt.json
@@ -27,6 +27,28 @@
  "3.13": {
    "version": "3.13.0"
  },
+  "3.13.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE9425968D392A",
+      "hash": "fb096c5d1ac6beabbdbaa2874d025badb03ee07929f0c9ff67563ce8c75398b1"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE9425982BD0F0",
+      "hash": "6feedafc72915794163114f512348e2437d080d0047ef8b8fa2ec63b575f12af"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE942594A8E60E",
+      "hash": "60cd368533d0ad73fa86d93d5bbf95ef40587245ce684ed138c1b31557b5fe97"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE942595A9A537",
+      "hash": "32d92acaa5cd8abb29fc49dac123dc412442d5713967819d8af2c29f1b3857c7"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9425979B56CB",
+      "hash": "9680526be4a66ea1ffe988ed08af58e1400fe1e4f4aef5bd88b20bb9b3da33f8"
+    }
+  },
  "3.13.0": {
    "x86_64_linux_musl": {
      "etag": "0x8DE7DC7C27DBB2E",
--- a/manifests/tombi.json
+++ b/manifests/tombi.json
@@ -22,10 +22,62 @@
  },
  "license_markdown": "[MIT](https://github.com/tombi-toml/tombi/blob/main/LICENSE)",
  "latest": {
-    "version": "0.9.13"
+    "version": "0.9.15"
  },
  "0.9": {
-    "version": "0.9.13"
+    "version": "0.9.15"
+  },
+  "0.9.15": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE93A3FAF30C3B",
+      "hash": "5be8b5d8d01044d135d9a08b407ad08ca1a6c7fd2e214eb892442968cdca7cf5"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE93A3FB045DDD",
+      "hash": "3cf44fa8853b08c895d72583303a3fc402a97c933869c517a006f9b72c30819b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE93A3FB001D02",
+      "hash": "6fd8dde2c095ac060c22a1797377c8b30c7e6f6fb56a4a4dde482303e5ec62f0"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE93A3FB846F95",
+      "hash": "ba5b907a945a40aa544ba1519434037018fd88b25d2134882c3e774e4702499a"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE93A3FAF6D883",
+      "hash": "d9235496e896874ab8799b4d7efa9c8dff61962478bce6647dbbb81b1937e822"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE93A3FB6A2752",
+      "hash": "015b47b6d266c49cd6b7d43b4bae82726be6134971dd2232092b020d555b9976"
+    }
+  },
+  "0.9.14": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE91E8D04C6FA6",
+      "hash": "0c6a3141cfa53948bb02148ec48b9cd2afad636b782b6f4770104d306caa8d95"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE91E8D02B514D",
+      "hash": "e7d2adeef03a9b65d280e31ddca75510fe11dcc1864ee443b75a1872b9a47937"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE91E8CF98900F",
+      "hash": "449c28b597c902862d799ad99d67d9de05eb2bb142e6f81e29c25ab95567c3a3"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE91E8CF650FD6",
+      "hash": "983aab4bba3dd9a8aafd4f6e7922f0d687564101199f66d48cd6b670c2c996d6"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE91E8CF5C6701",
+      "hash": "9fc05caf7bf58a37d9a925e2fc1e17d7bf0591120790665bb2142c0076ca3f15"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE91E8CF87B31E",
+      "hash": "70202f4fcdfa081ad928052757cd16bae99b445fd775eaac6b1d0ef8a7265775"
+    }
  },
  "0.9.13": {
    "x86_64_linux_musl": {
--- a/manifests/trivy.json
+++ b/manifests/trivy.json
@@ -96,446 +96,5 @@
      "etag": "0x8DE77C6B3B3F88B",
      "hash": "557b9b1ad75e9aa6762f64a338fa7f581f50375e054b946c67361d88b3f762be"
    }
-  },
-  "0.69.1": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DE64B81CF95EEF",
-      "hash": "dd93975bc1e58053810a9bafea89923e5df42ddd3f99905fdf840fd797145157"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DE64B819F91DC6",
-      "hash": "1054f37ba02173a7e1a05e2bcc1179d7573124cea1502a37cc59de89582de307"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DE64B819F13777",
-      "hash": "7a37fafd7a62fef07d4ebe9c5a90bb079e929eac78d691863b013eec14d57eac"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DE64B81CCE12EB",
-      "hash": "7a98c13e6c5799fc46219c94fa500b807532b4555501cce85fa4eead9f755516"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DE64B81B7978AC",
-      "hash": "ae5ce4a7b9bf2bd3794ccb3c257993526fa47470b3814d729a73788d36aff3d0"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DE64B81A1B2572",
-      "hash": "b4314efdb60e19567072586c0ae0120053fa3453ca6f3f93b7002cfb98848759"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DE64B81BB8F941",
-      "hash": "5a813df48a525d0ed5a87c92a49b715bc1142787bb51562fc84156f28c68e9c1"
-    }
-  },
-  "0.69.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DE5FE98E1231FF",
-      "hash": "fff5813d6888fa6f8bd40042a08c4f072b3e65aec9f13dd9ab1d7b26146ad046"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DE5FE98CD6F5A8",
-      "hash": "4264e4fcc73259de36a68c112a586d65bf6cd488ef2aea857f37d00d8cb5c4e6"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DE5FE98CABA986",
-      "hash": "4b34440f0a854428e846b1d2329eede3f0663bec8eff865ae2dffca42542a076"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DE5FE98B60C75A",
-      "hash": "425e883f37cad0b512478df2803f58532e7d235267303375a3d0f97e4790a1ca"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DE5FE98CCAF53A",
-      "hash": "bd35348d963d3f661ff4d7d138e65a75fedbfade0378689f3a349c824c6e5b75"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DE5FE98B58BA1E",
-      "hash": "719963fc7ba3b0c1db69dd39c4410c7e01f4a13d4bf8cbd7085f2f7e7b5cf22c"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DE5FE98B514869",
-      "hash": "f747c09a5b6b401c573d36e9b7bece73c95c685de566f8077c0ddc8adfb718f4"
-    }
-  },
-  "0.68": {
-    "version": "0.68.2"
-  },
-  "0.68.2": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DE3D36FA8B041A",
-      "hash": "3d933bbc3685f95ec15280f620583d05d97ee3affb66944d14481d5d6d567064"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DE3D36F8E8C779",
-      "hash": "c0790530cd717b6bdd02ed437be0710f5c7043078fafaf6841be7c865bf251ce"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DE3D36FBDA4DDA",
-      "hash": "2aaa0ce06f9f2221a6bb21e1fc0e0ecc6aeb56362bc5c9463e9fd7b06983c3c3"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DE3D36FA31D6BE",
-      "hash": "33c87995fd0c3d1559086c3e18fd3148051296dfd0ca2a67583eb64f89998c91"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DE3D36FBE6276F",
-      "hash": "dfbe15ffe47426dad9fd3e0d52aeacf3dbbb25ca5dbc66049f5920834435988d"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DE3D36F8C75B58",
-      "hash": "e8e0391fb23706885371aa26d98bf7d43ed330dda2dce5cd0098444955d3b071"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DE3D36FA754A9D",
-      "hash": "fd45fc808622ecb11393f4c27d1fbd20e1d78838148a282b1129624964dd0628"
-    }
-  },
-  "0.68.1": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DE3251848BE364",
-      "hash": "63e37242088e418651931f891963c19554faa19f0591fe6b40b606152051df2f"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DE3251830BD5BF",
-      "hash": "d5b5bd3b3c3626d223c3981cc40f4709f00a6327a681b588d2fc64a3aa9d02c5"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DE325185F54E47",
-      "hash": "600fc65bdb486e160efeedf8fff8ef6be8e9d2e82f2ea4db82ad23263ed5f902"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DE325182E5186B",
-      "hash": "b29ea550f573afbcae3c86fb2b5e0ebba76b7cb0965e3787c4e8cb884d2c1d57"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DE32518617A3C8",
-      "hash": "4dd3d2e74e1b6f6f7fd5fbf55489727698f586d6a6a0cff3421031a05b80bcac"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DE325182EA1BD7",
-      "hash": "85fad2f54d695044ff4c7cfbf527a339bbba624e248ca78c81b24d3ff505ec36"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DE325184AA45AE",
-      "hash": "5fd10a554ffc2a82bdc0212112352f0641d1ccf46b60f7c3be8b1f6c9e98a291"
-    }
-  },
-  "0.67": {
-    "version": "0.67.2"
-  },
-  "0.67.2": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DE080439A9226F",
-      "hash": "546511a5514afc813c0b72e4abeea2c16a32228a13a1e5114d927c190e76b1f9"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DE08043B0FD1EC",
-      "hash": "4a5b936a8d89b508ecdc6edd65933b6fe3e9a368796cbdf917fd0df393f26542"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DE0804388E4204",
-      "hash": "ad6a7a706902ec3248d8905a32d0c15630958ab3040b8ea0373a6f5a2da30a94"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DE0804398EB34F",
-      "hash": "e4f28390b06cdaaed94f8c49cce2c4c847938b5188aefdeb82453f2e933e57cb"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DE08043AF0386A",
-      "hash": "6b3163667f29fc608a2ed647c1bd42023af5779349286148190a168c5b3f28f1"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DE0804383BC3C5",
-      "hash": "168f8a8009433de6fb82f4119370b873f96dbbe115968899100aff5512204fb7"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DE080439F69D3F",
-      "hash": "82ae68e011861a91adad87efa88d85d9a2f3a35099a531edd255999a36b07428"
-    }
-  },
-  "0.67.1": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DE072A82C7AB42",
-      "hash": "945c004188970dddb634db8bbac332b00f477858918a2026866367268a810678"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DE072A813C381F",
-      "hash": "36001046e4a52885b664b7a5f40da5f0e1883c07a72763dee57c7d5b9676d901"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DE072A8320FFA5",
-      "hash": "f68c6b04c8984766d95413fcb438e6a6e242eadb9d5e9b6ca4d1ba9c84ffa4cb"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DE072A82CFB88B",
-      "hash": "dbc17ea23d75c9f93d3e781468cf0fd82d46e2e772353a4ff9da6d88919a1052"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DE072A81571BFA",
-      "hash": "81e24fd39ddecda180cc9abefaea184e0c22c331d7b683993a9bc89e67d07bb9"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DE072A815A7387",
-      "hash": "3def8ad164495d431eca7643671a5076b12364a7875f7dae53d01b0b179aede0"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DE072A842C87F8",
-      "hash": "ac9c61256a890cf99cca33415fbd7d0931f5489575c4bcf9e6cdde8e22723e84"
-    }
-  },
-  "0.67.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DDFFF9F277E803",
-      "hash": "5b10e9bba00a508b0f3bcb98e78f1039f7eee26b57c9266961a415642a9208ab"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DDFFF9F4297CF7",
-      "hash": "ae8a13d8c3abf7f7e7981ac1a5f5ec094d68835f2aac67da102d4ba36e820c3c"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DDFFF9F465316A",
-      "hash": "cbdc0dea7563da0f1258bedb5c6782dfe762ec8b4377db2629555fbdd7e6425f"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DDFFF9F5C29C5E",
-      "hash": "0f3ac33954dd918cad708bdf06731b4aa8cc14b12e879932b4ceef2f22640a9e"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DDFFF9F2834CFC",
-      "hash": "feea8727b501f654683774fe0f98a9c1a128c7d8bcd7c942a8e6f6d05b33bd4b"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DDFFF9F5DDA710",
-      "hash": "f1a685c309679ff23bca2dd42e017a22d235d0d9dbc0b129d1221590d9e1bc1b"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DDFFF9F4253BFB",
-      "hash": "f4b09750400c4a4ed68b5fe7a744fbe1b0ea14fc797d122119c9fa82ef167165"
-    }
-  },
-  "0.66": {
-    "version": "0.66.0"
-  },
-  "0.66.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DDEA4865EC0918",
-      "hash": "93678741c3223c15120934ac00671ca7e797c9a5a4d89148db9ffca9184a5f0d"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DDEA486A0448AA",
-      "hash": "284a3d3346429837f3da11aa6c25bf196e4fe5431733d4f6f99eac8578b329ed"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DDEA4867FEFF09",
-      "hash": "402d083f7b6b75005bef6dcc75613c41fc09c0ba735bbdbbcce418d7b3250ad6"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DDEA4868075A08",
-      "hash": "a51268845bdeb68f5f885f7de6c92fe33b64d630392e546eec0e16f79cfd42e8"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DDEA4865C5C055",
-      "hash": "964bb69fc0e652891b38514fed4ee31de004a58ac22ea2a23c6891728bb6b6eb"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DDEA486824D2F2",
-      "hash": "dbcf43998bafcd1adae26fc57ea6128f8a1c66da1523096e37fe29c30c68990f"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DDEA4865B3FA0A",
-      "hash": "8d5387862cec090d0f4922b3d2969291774097965649624d0d968e241d53a65e"
-    }
-  },
-  "0.65": {
-    "version": "0.65.0"
-  },
-  "0.65.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DDCFFB2522E989",
-      "hash": "f0c5e3c912e7f5194a0efc85dfd34c94c63c4a4184b2d7b97ec7718661f5ead2"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DDCFFB23C5CCA2",
-      "hash": "b022f86ac91d1c4e79cc548f3e470880a2f8150a369058fbd055bee537aca798"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DDCFFB23CC2E24",
-      "hash": "736ea5990e1a8432624039b0438324b6b7542e94810f9bc83a56f37c56a05b87"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DDCFFB23875C2C",
-      "hash": "013c67e6aff35429cbbc9f38ea030f5a929d128df08f16188af35ca70517330b"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DDCFFB26795759",
-      "hash": "3076e27024b92d634fe09947934d36dc8b651a8539ff1d69b4cfac008dfb59ce"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DDCFFB236CC627",
-      "hash": "6c54d2393322e493bd80ed2a208708fcca1d30e5ae9b0bfcbd3acb1c3212627e"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DDCFFB2546EAE0",
-      "hash": "383c80b9fee80c46d5232da40237fe1886baa76db9275adb5028184bba90adc0"
-    }
-  },
-  "0.64": {
-    "version": "0.64.1"
-  },
-  "0.64.1": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DDBA3D4C6732DE",
-      "hash": "1a09d86667b3885a8783d1877c9abc8061b2b4e9b403941b22cbd82f10d275a8"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DDBA3D4E2ADC31",
-      "hash": "107a874b41c1f0a48849f859b756f500d8be06f2d2b8956a046a97ae38088bf6"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DDBA3D4C6E56C5",
-      "hash": "d03bce6326ff75d041f2499e801357d3da6b08a28be085580d9b0bdf84971d12"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DDBA3D4C3CD009",
-      "hash": "a57d4d48a90f8ed875b821fc3078ba5a8572f86e90adfea0995cefd51d583bd7"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DDBA3D4C4000C5",
-      "hash": "7489c69948cda032adc2862923222917cd025411abc4bba8517a8d581aed226c"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DDBA3D4DECB971",
-      "hash": "98a9d625e614d16fbb6e467777282a0a43ab1505fcc1a77c0b97aafab1d9baf8"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DDBA3D4FB6EB18",
-      "hash": "4a8249d6fc7a9ca80179902923d1988ce4942359cc22c5ee68131b50ebd3a3f7"
-    }
-  },
-  "0.64.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DDB87C74419214",
-      "hash": "e50755b3be29ae515091a45c96a2bc126846334210c30202331b797b9ae6e366"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DDB87C72C4B5BC",
-      "hash": "f7c649c3e9598fde7074bb34b024d11f5b836d230c391a0cdde319db73e0fedc"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DDB87C75CF7247",
-      "hash": "7f34d0cd2813cf7f89064ffbc04af891f7839f673e9a0a0505cf91391d07826e"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DDB87C72D67BFC",
-      "hash": "c7e78d67af98dad178f18b4b8d20929b7f9d267e9c556f8ad815f8997035bcd9"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DDB87C7591EB49",
-      "hash": "77e70dd2fdbac5986cc02a8def382bdaf78777f0050fc37af72916cc47b56a20"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DDB87C7505B2B4",
-      "hash": "13322bad430380ed58d52cafa706dd68127a20dcba5707ecea24ee00b7ad44ba"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DDB87C7452482B",
-      "hash": "a13059cf174a0de9c4790bd11e1626d5529265550637474fe8442755bb73062a"
-    }
-  },
-  "0.63": {
-    "version": "0.63.0"
-  },
-  "0.63.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DD9EDB240EAE38",
-      "hash": "ea91fa393cfcb802da22832c96e99a4c8a295a8ba8faefd824c7168b7f0a741e"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DD9EDB25C39AD1",
-      "hash": "01659b540a885ee9bd1273c8c75ade1ce046fc9d6e5933d5978d9125a6a1cf6c"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DD9EDB25D2CBF6",
-      "hash": "33ba726ec9c37f15490efa1d51044c21f0db6acb9be56492d5e1429f404b602f"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DD9EDB26DF8B6D",
-      "hash": "9aeecf81e8a1dc5625dd96a1a6fbea92a1f8e51c4160cfc0e412ef5f641ea1ac"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DD9EDB26DD1D32",
-      "hash": "784f687759c647ffad54e4d7f55ed953647e4fff5ea1e38dbaf877a135254972"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DD9EDB25608D60",
-      "hash": "f810c4fe9b3cf58022ce034db27780db3e64e91834dda23450407f1e6da13dab"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DD9EDB271FA7BE",
-      "hash": "af14cc441197d862d513926a7610111c8683548efb4c82202bb2d856d4603fc4"
-    }
-  },
-  "0.62": {
-    "version": "0.62.1"
-  },
-  "0.62.1": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DD8CD66B2C973F",
-      "hash": "7da92b2ca503d08eb15e717585fa4ffb95ef2c5dc4c554204882d7d26d386a6a"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DD8CD66B02A920",
-      "hash": "819bf4dad9c3bb4e78bbd11d08b61bdc4663b33777121b3f43372986f7cb3d3e"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DD8CD66CA4E62B",
-      "hash": "f6d9b422f10af2d7a21b4924d36400d8a76932c9159b5feefaa8aee3e45a82bd"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DD8CD669AB51A2",
-      "hash": "50e13c5cdd3e3b610e0dc554e3bc58bc6f58eabe3e42a6b28961a23ac6eff0df"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DD8CD66C735F7B",
-      "hash": "0bbfa581a4139c6fef21f4129233ae6f02a9f4b53039327e62eccd7956af2ba1"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DD8CD66C56CFD2",
-      "hash": "682f1b82e1def454a231f1aef7cadc58cf15aca48b8837caaec49cb41d8b5d2f"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DD8CD66981D82D",
-      "hash": "e36efe2d7b421960fd58e635e77f850e2a9934001c2033dc48431f5727e1b3b5"
-    }
-  },
-  "0.62.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DD880CCF3EE84C",
-      "hash": "1be4420999ffde59b9a6900f2c2481a2f4e50fd2e0ac738ad028944563ee6c60"
-    },
-    "x86_64_macos": {
-      "etag": "0x8DD880CCD4C9C5F",
-      "hash": "8f6d54c7de5c7247bb92b51d29d2542be8006111515ceaf50fe8185adb59ad89"
-    },
-    "x86_64_windows": {
-      "etag": "0x8DD880CCD7359BB",
-      "hash": "b30da5d15587824335cbb88a62585f00a3aac18f3f754d3ad74d68327e2efc46"
-    },
-    "aarch64_linux_gnu": {
-      "etag": "0x8DD880CCF085E40",
-      "hash": "82c8acca00390bf5e014b26abb03e24ba754824c4f87ead5564cd56375df07c1"
-    },
-    "aarch64_macos": {
-      "etag": "0x8DD880CCF853F18",
-      "hash": "727a8865c2caf6841a1f4668fd7702f442ae088fd08e3c3719e4f731c1f11333"
-    },
-    "powerpc64le_linux_gnu": {
-      "etag": "0x8DD880CD0DCBCA1",
-      "hash": "fba4b69f5d3a792dc21b93e88c9304329e711eec699dd9b2067dca0297ff92b5"
-    },
-    "s390x_linux_gnu": {
-      "etag": "0x8DD880CCD7DD530",
-      "hash": "a11cbdbb1b72f041f39004610a20a0b7f4b2aad4788dbd735b33b58e58190aca"
-    }
  }
 }
--- a/tools/ci/tool-list.sh
+++ b/tools/ci/tool-list.sh
@@ -8,6 +8,7 @@ cd -- "$(dirname -- "$0")"/../..
 # They don't provide prebuilt binaries for musl or old glibc host.
 # version `GLIBC_2.35' not found
 glibc_pre_2_39_incompat=(
+  cargo-deb
  zizmor
 )
 glibc_pre_2_35_incompat=(
@@ -68,7 +69,7 @@ case "$(uname -s)" in
  Linux)
    host_os=linux
    ldd_version=$(ldd --version 2>&1 || true)
-    if grep -Fq musl <<<"${ldd_version}"; then
+    if [[ "${ldd_version}" == *'musl'* ]]; then
      incompat_tools+=("${musl_incompat[@]}")
    else
      host_glibc_version=$(grep -E "GLIBC|GNU libc" <<<"${ldd_version}" | sed "s/.* //g")
@@ -116,6 +117,9 @@ case "$(uname -s)" in
    if [[ "${runner}" == "ubuntu:14.04" ]]; then
      incompat_tools+=(cyclonedx)
    fi
+    if [[ "${runner}" == "almalinux:10"* ]]; then
+      incompat_tools+=(cargo-deb) # no dpkg in package manager
+    fi
    ;;
  Darwin) host_os=macos ;;
  MINGW* | MSYS* | CYGWIN* | Windows_NT) host_os=windows ;;
@@ -232,4 +236,9 @@ for tool in "${tools[@]}"; do
    2) list+=$' \t ' ;;
  esac
 done
+if [[ "${comma_sep}" == "1" ]]; then
+  case $((RANDOM % 2)) in
+    0) list+=',' ;;
+  esac
+fi
 printf 'tool=%s\n' "${list}"
--- a/tools/codegen/Cargo.toml
+++ b/tools/codegen/Cargo.toml
@@ -8,6 +8,7 @@ install-action-manifest-schema = { path = "../manifest-schema" }
 anyhow = "1"
 flate2 = "1"
 fs-err = "3"
+jiff = { version = "0.2", default-features = false, features = ["std", "serde"] }
 minisign-verify = "0.2"
 ring = "0.17"
 semver = { version = "1", features = ["serde"] }
--- a/tools/codegen/base/cargo-deb.json
+++ b/tools/codegen/base/cargo-deb.json
@@ -0,0 +1,12 @@
+{
+  "repository": "https://github.com/kornelski/cargo-deb",
+  "license_markdown": "[MIT](https://github.com/kornelski/cargo-deb/blob/main/LICENSE)",
+  "tag_prefix": "v",
+  "rust_crate": "${package}",
+  "platform": {
+    "x86_64_linux_gnu": {
+      "asset_name": "${package}_${version}-1_amd64.deb",
+      "bin": "usr/bin/${package}"
+    }
+  }
+}
--- a/tools/codegen/base/cargo-xwin.json
+++ b/tools/codegen/base/cargo-xwin.json
@@ -0,0 +1,18 @@
+{
+  "repository": "https://github.com/rust-cross/cargo-xwin",
+  "license_markdown": "[MIT](https://github.com/rust-cross/cargo-xwin/blob/main/LICENSE)",
+  "tag_prefix": "v",
+  "rust_crate": "${package}",
+  "asset_name": "${package}-v${version}.${rust_target}.tar.gz",
+  "version_range": ">= 0.17.4",
+  "platform": {
+    "x86_64_linux_musl": {},
+    "x86_64_macos": {
+      "asset_name": "${package}-v${version}.universal2-apple-darwin.tar.gz"
+    },
+    "x86_64_windows": {
+      "asset_name": "${package}-v${version}.windows-x64.zip"
+    },
+    "aarch64_linux_musl": {}
+  }
+}
--- a/tools/codegen/base/cosign.json
+++ b/tools/codegen/base/cosign.json
@@ -0,0 +1,34 @@
+{
+  "repository": "https://github.com/sigstore/cosign",
+  "tag_prefix": "v",
+  "version_range": ">= 3.0.0",
+  "signing": {
+    "kind": "custom"
+  },
+  "platform": {
+    "x86_64_linux_musl": {
+      "asset_name": "${package}-linux-amd64"
+    },
+    "x86_64_macos": {
+      "asset_name": "${package}-darwin-amd64"
+    },
+    "x86_64_windows": {
+      "asset_name": "${package}-windows-amd64.exe"
+    },
+    "aarch64_linux_musl": {
+      "asset_name": "${package}-linux-arm64"
+    },
+    "aarch64_macos": {
+      "asset_name": "${package}-darwin-arm64"
+    },
+    "powerpc64le_linux_musl": {
+      "asset_name": "${package}-linux-ppc64le"
+    },
+    "riscv64_linux_musl": {
+      "asset_name": "${package}-linux-riscv64"
+    },
+    "s390x_linux_musl": {
+      "asset_name": "${package}-linux-s390x"
+    }
+  }
+}
--- a/tools/codegen/base/knope.json
+++ b/tools/codegen/base/knope.json
@@ -1,6 +1,6 @@
 {
  "repository": "https://github.com/knope-dev/knope",
-  "tag_prefix": "knope/v",
+  "tag_prefix": ["knope/v", "v"],
  "rust_crate": "${package}",
  "asset_name": "${package}-${rust_target}.tgz",
  "bin": "${package}-${rust_target}/${package}${exe}",
--- a/tools/codegen/base/wash.json
+++ b/tools/codegen/base/wash.json
@@ -1,6 +1,6 @@
 {
  "repository": "https://github.com/wasmCloud/wasmCloud",
-  "tag_prefix": "wash-v",
+  "tag_prefix": ["wash-v", "wash-cli-v"],
  "rust_crate": "${package}",
  "asset_name": "${package}-${rust_target}${exe}",
  "signing": {
--- a/tools/codegen/src/main.rs
+++ b/tools/codegen/src/main.rs
@@ -23,6 +23,8 @@ use install_action_internal_codegen::{
 use serde::de::DeserializeOwned;
 use spdx::expression::{ExprNode, ExpressionReq, Operator};

+const DEFAULT_COOLDOWN: u64 = 24;
+
 fn main() {
    let args: Vec<_> = env::args().skip(1).collect();
    if args.is_empty() || args.iter().any(|arg| arg.starts_with('-')) {
@@ -52,13 +54,14 @@ fn main() {
    base_info.validate();
    let repo = base_info
        .repository
-        .strip_prefix("https://github.com/")
+        .strip_prefix(GITHUB_START)
        .context("repository must start with https://github.com/")
        .unwrap();

    eprintln!("downloading metadata from {GITHUB_API_START}repos/{repo}");
    let repo_info: github::RepoMetadata = download_json(&format!("{GITHUB_API_START}repos/{repo}"));

+    let before = jiff::Timestamp::now() - Duration::from_hours(DEFAULT_COOLDOWN);
    eprintln!("downloading releases from {GITHUB_API_START}repos/{repo}/releases");
    let mut releases: github::Releases = vec![];
    // GitHub API returns up to 100 results at a time. If the number of releases
@@ -69,7 +72,7 @@ fn main() {
            "{GITHUB_API_START}repos/{repo}/releases?per_page={per_page}&page={page}"
        ));
        // If version_req is latest, it is usually sufficient to look at the latest 100 releases.
-        if r.len() < per_page || version_req.is_some_and(|req| req == "latest") {
+        if r.len() < per_page {
            releases.append(&mut r);
            break;
        }
@@ -146,12 +149,19 @@ fn main() {
        match serde_json::from_slice(&fs::read(manifest_path).unwrap()) {
            Ok(m) => {
                manifests = m;
-                for (k, manifest) in &mut manifests.map {
-                    let ManifestRef::Real(manifest) = manifest else {
-                        continue;
-                    };
-                    let version = &*k.0.to_string();
-                    if let Some(template) = &manifests.template {
+                manifests.map.retain(|v, m| match v.0.to_semver() {
+                    Some(v) => releases.contains_key(&Reverse(v.clone())),
+                    None => {
+                        let ManifestRef::Ref { version } = m else { unreachable!() };
+                        releases.contains_key(&Reverse(version.to_semver().unwrap()))
+                    }
+                });
+                if let Some(template) = &manifests.template {
+                    for (k, manifest) in &mut manifests.map {
+                        let ManifestRef::Real(manifest) = manifest else {
+                            continue;
+                        };
+                        let version = &*k.0.to_string();
                        #[allow(clippy::literal_string_with_formatting_args)]
                        for (platform, d) in &mut manifest.download_info {
                            let template = &template.download_info[platform];
@@ -375,6 +385,58 @@ fn main() {
                            );
                            eprintln!("done");
                        }
+                        "cosign" => {
+                            let [checksum, bundle] =
+                                ["cosign_checksums.txt", "cosign_checksums.txt.sigstore.json"].map(
+                                    |f| {
+                                        let asset = release
+                                            .assets
+                                            .iter()
+                                            .find(|asset| asset.name.ends_with(f))
+                                            .unwrap();
+                                        let download_cache =
+                                            download_cache_dir.join(format!("{version}-{f}"));
+                                        let url = &asset.browser_download_url;
+                                        eprint!(
+                                            "downloading {url} for signature verification ... "
+                                        );
+                                        if download_cache.is_file() {
+                                            eprintln!("already downloaded");
+                                        } else {
+                                            download_to_buf(url, &mut buf);
+                                            eprintln!("download complete");
+                                            fs::write(&download_cache, &buf).unwrap();
+                                            buf.clear();
+                                        }
+                                        download_cache
+                                    },
+                                );
+                            eprint!("verifying checksum file for {package}@{version} ... ");
+                            cmd!(
+                                "cosign",
+                                "verify-blob",
+                                &checksum,
+                                "--bundle",
+                                bundle,
+                                "--certificate-identity",
+                                "keyless@projectsigstore.iam.gserviceaccount.com",
+                                "--certificate-oidc-issuer",
+                                "https://accounts.google.com"
+                            )
+                            .run()
+                            .unwrap();
+                            verified_checksum = Some(
+                                fs::read_to_string(checksum)
+                                    .unwrap()
+                                    .lines()
+                                    .filter_map(|l| l.split_once("  "))
+                                    .map(|(h, f)| {
+                                        (f.trim_ascii().to_owned(), h.trim_ascii().to_owned())
+                                    })
+                                    .collect(),
+                            );
+                            eprintln!("done");
+                        }
                        "syft" => {
                            // Refs: https://oss.anchore.com/docs/installation/verification/
                            let [checksum, certificate, signature] =
@@ -562,10 +624,7 @@ fn main() {
                            );
                        };
                        let url = url.clone() + ".sig";
-                        let sig_download_cache = &download_cache.with_extension(format!(
-                            "{}.sig",
-                            download_cache.extension().unwrap_or_default().to_str().unwrap()
-                        ));
+                        let sig_download_cache = &download_cache.with_added_extension("sig");
                        eprint!("downloading {url} for signature validation ... ");
                        let sig = if sig_download_cache.is_file() {
                            eprintln!("already downloaded");
@@ -765,17 +824,20 @@ fn main() {
    } else if !semver_versions.is_empty() {
        let mut prev_version = semver_versions.iter().next().unwrap();
        for version in &semver_versions {
+            if releases[&Reverse(version.clone())].1.published_at > before {
+                continue; // Exclude very recently released version from candidate for latest and omitted versions.
+            }
            if let Some(crates_io_info) = &crates_io_info {
                if let Some(v) = crates_io_info.versions.iter().find(|v| v.num == *version) {
                    if v.yanked {
-                        continue; // Exclude yanked version from candidate for "latest".
+                        continue; // Exclude yanked version from candidate for latest and omitted versions.
                    }
                } else {
-                    continue; // Exclude version not released on crates.io from candidate for "latest".
+                    continue; // Exclude version not released on crates.io from candidate for latest and omitted versions.
                }
            }
            if base_info.broken.contains(version) {
-                continue; // Exclude version marked as broken from candidate for "latest".
+                continue; // Exclude version marked as broken from candidate for latest and omitted versions.
            }
            if !(version.major == 0 && version.minor == 0) {
                manifests.map.insert(
@@ -961,6 +1023,7 @@ struct GitHubTokens {
    // https://github.com/*/*/releases/download/
    other: RwLock<Option<String>>,
 }
+const GITHUB_START: &str = "https://github.com/";
 const GITHUB_API_START: &str = "https://api.github.com/";
 const GITHUB_RAW_START: &str = "https://raw.githubusercontent.com/";
 impl GitHubTokens {
@@ -969,7 +1032,7 @@ impl GitHubTokens {
            self.raw.read().unwrap().clone()
        } else if url.starts_with(GITHUB_API_START) {
            self.api.read().unwrap().clone()
-        } else if url.starts_with("https://github.com/") {
+        } else if url.starts_with(GITHUB_START) {
            self.other.read().unwrap().clone()
        } else {
            None
@@ -980,7 +1043,7 @@ impl GitHubTokens {
            *self.raw.write().unwrap() = None;
        } else if url.starts_with(GITHUB_API_START) {
            *self.api.write().unwrap() = None;
-        } else if url.starts_with("https://github.com/") {
+        } else if url.starts_with(GITHUB_START) {
            *self.other.write().unwrap() = None;
        }
    }
@@ -1241,6 +1304,7 @@ mod github {
    pub(crate) struct Release {
        pub(crate) tag_name: String,
        pub(crate) prerelease: bool,
+        pub(crate) published_at: jiff::Timestamp,
        pub(crate) assets: Vec<ReleaseAsset>,
    }

--- a/tools/tidy.sh
+++ b/tools/tidy.sh
@@ -27,15 +27,14 @@ fi
 if [[ -n "${TIDY_DEV:-}" ]]; then
  image="ghcr.io/taiki-e/tidy:latest"
 else
-  image="ghcr.io/taiki-e/tidy@sha256:4552cbce9426e102f9650cd9f8381e836fc8fda081dcbddcc7f31b15d48d1654"
+  image="ghcr.io/taiki-e/tidy@sha256:bce85a4321f80c09f2b68420e9149bcf7c085130ab1e1fca54443f76833cd184"
 fi
 user="$(id -u):$(id -g)"
 workdir=$(pwd)
 tmp=$(mktemp -d)
 trap -- 'rm -rf -- "${tmp:?}"' EXIT
-mkdir -p -- "${tmp}/zizmor"
-touch -- "${tmp}/dummy"
-mkdir -- "${tmp}/dummy-dir"
+mkdir -p -- "${tmp}"/{pwsh-cache,pwsh-local,zizmor-cache,dummy-dir,tmp}
+touch -- "${tmp}"/dummy
 code=0
 color=''
 if [[ -t 1 ]] || [[ -n "${GITHUB_ACTIONS:-}" ]]; then
@@ -84,22 +83,25 @@ docker_run() {
 set +e
 docker_run \
  --mount "type=bind,source=${workdir},target=${workdir}" --workdir "${workdir}" \
+  --mount "type=bind,source=${tmp}/tmp,target=/tmp/tidy" \
+  --mount "type=bind,source=${tmp}/pwsh-cache,target=/.cache/powershell" \
+  --mount "type=bind,source=${tmp}/pwsh-local,target=/.local/share/powershell" \
  --network=none \
  "${image}" \
  /checks/offline.sh
 # Some good audits requires access to GitHub API.
 docker_run \
  --mount "type=bind,source=${workdir},target=${workdir},readonly" --workdir "${workdir}" \
-  --mount "type=bind,source=${tmp}/zizmor,target=/.cache/zizmor" \
+  --mount "type=bind,source=${tmp}/zizmor-cache,target=/.cache/zizmor" \
  --env GH_TOKEN --env GITHUB_TOKEN --env ZIZMOR_GITHUB_TOKEN \
  "${image}" \
  /checks/zizmor.sh
 # We use remote dictionary.
 docker_run \
  --mount "type=bind,source=${workdir},target=${workdir},readonly" --workdir "${workdir}" \
-  --mount "type=bind,source=${workdir}/.cspell.json,target=${workdir}/.cspell.json" \
  --mount "type=bind,source=${workdir}/.github/.cspell/project-dictionary.txt,target=${workdir}/.github/.cspell/project-dictionary.txt" \
  --mount "type=bind,source=${workdir}/.github/.cspell/rust-dependencies.txt,target=${workdir}/.github/.cspell/rust-dependencies.txt" \
+  --mount "type=bind,source=${tmp}/tmp,target=/tmp/tidy" \
  "${image}" \
  /checks/cspell.sh
Author	SHA1	Message	Date
Taiki Endo	cf39a74df4	Release 2.75.0	2026-04-07 15:35:56 +00:00
Taiki Endo	0486bdd90e	Support cosign	2026-04-08 00:33:03 +09:00
Taiki Endo	fbe29f7fa6	ci: Enable dependabot grouped update for github-actions This partially reverts `5f3e9b7a2d`.	2026-04-07 23:09:26 +09:00
Taiki Endo	2438243e4c	Enable "Require actions to be pinned to a full-length commit SHA" actions policy	2026-04-07 23:08:37 +09:00
Taiki Endo	850405699d	tools: Update tidy.sh	2026-04-07 22:55:56 +09:00
Taiki Endo	dcdbf46878	ci: Update release workflow	2026-04-07 22:55:44 +09:00
Taiki Endo	8002e0e61d	Release 2.74.1	2026-04-07 12:53:35 +00:00
Taiki Endo	025d8d1457	Update `mise@latest` to 2026.4.5	2026-04-07 12:43:36 +00:00
Taiki Endo	e83b58f811	Update `tombi@latest` to 0.9.15	2026-04-07 06:54:02 +00:00
Taiki Endo	ebe7e09a94	Update shfmt manifest	2026-04-07 01:14:18 +00:00
Taiki Endo	c24beccdbc	Update coreutils manifest	2026-04-07 01:14:18 +00:00
Taiki Endo	56bf508a3f	Adjust base distro detection code	2026-04-07 00:55:49 +09:00
Taiki Endo	f0e236a2f1	ci: Remove dead code	2026-04-07 00:17:21 +09:00
Taiki Endo	94cb46f8d6	Release 2.74.0	2026-04-06 15:01:02 +00:00
Taiki Endo	7fef44e195	Update changelog	2026-04-06 23:37:36 +09:00
Taiki Endo	3bf2282bfd	Update mise manifest	2026-04-06 12:40:08 +00:00
Taiki Endo	223b1d599e	Update tombi manifest	2026-04-06 07:00:36 +00:00
Taiki Endo	fdcd834b4f	Update `just@latest` to 1.49.0	2026-04-06 07:00:36 +00:00
Taiki Endo	b45e8d6c43	Update `mise@latest` to 2026.4.4	2026-04-06 05:36:10 +00:00
Taiki Endo	4eac87a846	ci: Update config	2026-04-05 18:48:22 +09:00
Taiki Endo	5b41336748	Add issue template	2026-04-05 18:40:32 +09:00
Taiki Endo	55a981690b	Support cargo-deb	2026-04-05 17:27:20 +09:00
Taiki Endo	7a562dfa95	Release 2.73.0	2026-04-05 07:54:59 +00:00
Taiki Endo	561f72e178	Revert "Remove duplicated retry" This reverts commit `2c637c3acd`. Since this change, we’ve started encountering 5xx errors that cannot be resolved with our retry mechanism.	2026-04-05 16:37:04 +09:00
Taiki Endo	eab6539ed6	codegen: Exclude very recently released version from candidate for latest and omitted versions	2026-04-05 16:29:47 +09:00
Taiki Endo	11f5a9921c	codegen: Detect deleted releases	2026-04-05 04:19:28 +09:00
Taiki Endo	5311ff906c	ci: Update release workflow	2026-04-05 01:11:47 +09:00
Taiki Endo	de6f06126a	Release 2.72.0	2026-04-04 13:54:25 +00:00
Taiki Endo	bdc2e2796d	Add warning for disabling checksum	2026-04-04 22:20:07 +09:00
Taiki Endo	3f315c966f	Update changelog	2026-04-04 22:14:01 +09:00
Taiki Endo	c4735dd0f2	Replace some grep with [[ == ]]	2026-04-04 22:10:53 +09:00
Taiki Endo	f43d7b21e2	Accept trailing comma in tool input option	2026-04-04 22:08:16 +09:00
Taiki Endo	26f8c1ab49	ci: Add test for trailing comma in tool input option	2026-04-04 22:07:47 +09:00
daxpedda	ba78689f17	Add `cargo-xwin` (#1659 )	2026-04-04 21:52:15 +09:00
Taiki Endo	0ac54ad8ce	Merge two non-Windows steps	2026-04-04 12:14:05 +09:00
Taiki Endo	befcb22678	ci: Test ubuntu:rolling and debian:testing	2026-04-04 12:06:46 +09:00
Taiki Endo	d426f49ab8	Update `tombi@latest` to 0.9.14	2026-04-04 01:41:03 +00:00