rmqa 0.2 Opens tar.xz and zstd Releases and Verifies Their Signatures
rmqa 0.1 couldn’t open a large share of the releases people actually publish. cargo-dist, the release tool most Rust projects use, packs every build as .tar.xz. More C and Rust projects ship .tar.zst each year. rmqa saw those files, counted their bytes and moved on, so a wrong build inside one went through.
0.2 reads both. The xz and zstd readers are rmqa’s own, written in Go from the format specifications, so rmqa is still one file with nothing to install beside it. Before trusting them, they were checked against files made by the real tools: xz and zstd at many levels and window sizes, with every kind of built-in check, and damaged copies that must fail. They agreed byte for byte. Each format’s own check (CRC32, CRC64 or SHA-256 for xz, the content checksum for zstd) is verified on the way.
Checksums Beside Each File
cargo-dist and many other tools put a small .sha256 next to every archive instead of, or as well as, one list for the whole release. rmqa 0.1 treated those as ordinary files. Now X.sha256, X.sha512 and their sum spellings are checked against X, declared or not. A stale one, one that names a different file, or one whose file is missing is an error.
Signatures, When You Give the Key
Put your public key in the manifest and rmqa verifies what sits beside your files: minisign .minisig files, trusted comment included, and .sig files from cosign sign-blob --key. With signatures = "require", every file needs one that verifies with that key. A GPG file or a garbled .sig doesn’t count. Keyless Sigstore signatures need Sigstore’s own trust roots and log, so rmqa notes them and leaves them to cosign verify-blob.
A Manifest From the Build Tool
GoReleaser writes dist/artifacts.json and cargo-dist writes dist-manifest.json, each listing exactly what it built. rmqa init --from reads either one and writes the manifest, with or without the release folder in hand.
Checked on Real Releases
A workflow downloads the latest cargo-dist release, writes its manifest with init --from dist-manifest.json and checks all 23 files. It does the same for the latest minisign release with its author’s published key. Both pass. The first run also found a bug that 0.1 had: the commit-ID header git archive puts at the start of a source tarball was taken for a special file. That’s fixed.
Two independent review rounds went over the new readers before release. They found a way to make require pass without a verified signature, inputs that made the decoders use too much memory or time, and GoReleaser files that init --from dropped. All were fixed with tests. Downloads are on the download page, and the manifest reference has every new setting.