release: cargo-binstall v1.4.0

[github-actions]

This is a release PR for cargo-binstall version 1.4.0 (performing a minor bump).

Use squash merge.

Upon merging, this will automatically create the tag v1.4.0, build the CLI,
create a GitHub release with the release notes below
, and CI will publish to crates.io on merge of this PR.

To trigger builds initially, close and then immediately re-open this PR once.

---

Edit release notes into the section below:

Release notes

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

• Initial support for verifying package signatures! (Support package signing and verification #1 Initial signing support #1345 Check quickinstall signatures #1382 Doc: Provide solutions for common problems encountered during signing #1383)

  After a lot of discussions, we now support verifying signatures for downloaded files. This release has support for a single algorithm, minisign. We expect to implement more later, and would warmly welcome contributions in this regard.

  With this comes two new options: --only-signed will refuse to install non-signed packages, and --skip-signatures disables the functionality entirely (for testing only!).

  Adding signature support for your package as a first party requires adding to your Cargo.toml: we don't perform auto-detection of signature schemes at this juncture. Documentation and a guide is available in SIGNING.md.

  The 3rd-party quick-install repository of packages (part of the cargo-bins umbrella organisation) has already implemented signing; if you only want first-party signed packages you should add --disable-strategies quick-install.

• Binstall's releases are now signed. (Sign our releases #1347 Revert "release: cargo-binstall v1.4.0" and fix #1398 Fix release build again #1400)

  We use a just-in-time ephemeral key or "keyless" setup which generates a brand new signing key for every release.

  You can find the public key for each release in a number of places:

  • in the crate's Cargo.toml metadata (this is where Binstall looks for it)
  • as the minisign.pub file in the packaged source crate (from crates.io)
  • as the minisign.pub file in the downloads below
  • as the minisign.pub file in the .full. variants of the packages below

  Of course, Binstall ^1.4.1 is able to verify its own signature:

  cargo binstall -y --only-signed cargo-binstall

Other changes:

• The cargo-toml-workspace crate is now independent from binstalk crates (Refactor cargo-toml-workspace: Rm dep on binstalk-types #1386)
• Bugfix: target was incorrectly detected for glibc <=2.31 (Investigate incorrect target detection #1376 Fix detect-targets on ubuntu 20.04, glibc 2.31 #1379)