feat(cli): add Sigstore/SLSA provenance verification to Rust self-update#7818

Merged

jamadeo merged 6 commits into

aaif-goose:mainfrom

fresh3nough:fix/update-checksum-verification-7552

Mar 19, 2026

Commits on Mar 19, 2026

feat(cli): add Sigstore/SLSA provenance verification to Rust self-update
fresh3nough
committed
fix(cli): enforce Sigstore verification failures and block tar symlink escapes
fresh3nough
committed
fix(cli): use entry.link_name() to validate effective PAX/GNU link targets
fresh3nough
committed
fix(cli): distinguish verified vs skipped provenance in success message
fresh3nough
committed
fix(recipe): replace deprecated eval_to_state with render_captured
fresh3nough
committed
ci: exclude vendor/v8 from clippy to fix missing rusty_v8 native lib
fresh3nough
committed