English
CLI v0.3.1 — smaller executable, same safety checks. The self-contained Windows x64 executable was reduced from 79,338,604 to 12,827,362 bytes (83.83%) using full trimming and single-file compression. JSON responses are generated with trim-compatible System.Text.Json metadata rather than suppressed IL2026 warnings.
By default, download-all --pg all authenticates the publicly signed Catalog selection feed and downloads the current Catalog-registered set of 14 extensions × PG14–18 (70 original ZIP files). Use --pg 18 to select one major or --fixed to use the historical immutable snapshot. Each downloaded ZIP is rehashed, and a failed batch is removed without overwriting existing downloads.
Security boundary: Sigstore verification authenticates the Catalog feed and independently attested CLI executable. Extension ZIP bytes are checked against Catalog-pinned SHA256 values (INTEGRITY_ONLY); their own Sigstore signatures, provenance and installation/publication authorizations are not verified or granted. CLI v0.3.1 is a published prerelease, not a Windows Authenticode-signed installer.
Independent public EXE and 70/70 ZIP Windows verification · Full GitHub Release
-