Cleanup and attest-build-provenance

.github/workflows/build.yml

@@ -4,10 +4,10 @@ name: Rust Build and Test
 on:
   push:
     branches: [ main ]
-    paths: [ .github/workflows/build.yml, keys/**, src/**, test/**, build.rs, Cargo.lock, Cargo.toml, Cross.toml ]
+    paths: [ .github/workflows/build.yml, keys/**, src/**, test/**, build.rs, Cargo.lock, Cargo.toml ]
   pull_request:
     branches: [ main ]
-    paths: [ .github/workflows/build.yml, keys/**, src/**, test/**, build.rs, Cargo.lock, Cargo.toml, Cross.toml ]
+    paths: [ .github/workflows/build.yml, keys/**, src/**, test/**, build.rs, Cargo.lock, Cargo.toml ]
   workflow_dispatch:
 
 env:

.github/workflows/checks.yml

@@ -4,10 +4,10 @@ name: Rust Checks
 on:
   push:
     branches: [ main ]
-    paths: [ .github/workflows/checks.yml, keys/**, src/**, test/**, build.rs, Cargo.lock, Cargo.toml, Cross.toml, deny.toml, rustfmt.toml ]
+    paths: [ .github/workflows/checks.yml, keys/**, src/**, test/**, build.rs, Cargo.lock, Cargo.toml, deny.toml, rustfmt.toml ]
   pull_request:
     branches: [ main ]
-    paths: [ .github/workflows/checks.yml, keys/**, src/**, test/**, build.rs, Cargo.lock, Cargo.toml, Cross.toml, deny.toml, rustfmt.toml ]
+    paths: [ .github/workflows/checks.yml, keys/**, src/**, test/**, build.rs, Cargo.lock, Cargo.toml, deny.toml, rustfmt.toml ]
   workflow_dispatch:
 
 env:

.github/workflows/release.yml

@@ -7,6 +7,11 @@ on:
       - "v**"
   workflow_dispatch:
 
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+
 env:
   bin-name: qstract
   feature-set: ''
@@ -375,6 +380,9 @@ jobs:
         run: cp ./target/${{ matrix.target }}/zmall/${{ env.bin-name }} ./${{ env.bin-name }}-${{ matrix.target }}
       - name: Chmod
         run: chmod +x ./${{ env.bin-name }}-${{ matrix.target }}
+      - uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ./${{ env.bin-name }}-${{ matrix.target }}
       - name: Hash
         run: echo "$(coreutils sha256sum ./${{ env.bin-name }}-${{ matrix.target }})" > ${{ matrix.target }}.sha256
       - name: Artifact
@@ -420,6 +428,9 @@ jobs:
         run: cp ./target/${{ matrix.target }}/zmall/${{ env.bin-name }} ./${{ env.bin-name }}-${{ matrix.target }}
       - name: Chmod
         run: chmod +x ./${{ env.bin-name }}-${{ matrix.target }}
+      - uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ./${{ env.bin-name }}-${{ matrix.target }}
       - name: Hash
         run: echo "$(coreutils sha256sum ./${{ env.bin-name }}-${{ matrix.target }})" > ${{ matrix.target }}.sha256
       - name: Artifact
@@ -459,6 +470,9 @@ jobs:
         run: cargo +nightly auditable build --verbose --workspace --profile=zmall --locked --target ${{ matrix.target }} ${{ env.feature-set }}
       - name: Rename
         run: cp ./target/${{ matrix.target }}/zmall/${{ env.bin-name }}.exe ./${{ env.bin-name }}-${{ matrix.target }}.exe
+      - uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ./${{ env.bin-name }}-${{ matrix.target }}.exe
       - name: Hash
         run: echo "$(coreutils sha256sum ./${{ env.bin-name }}-${{ matrix.target }}.exe)" > ${{ matrix.target }}.sha256
       - name: Artifact

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "qstract"
-version = "0.2.2"
+version = "0.2.3"
 edition = "2021"
 authors = ["harmless-tech"]
 description = "A very basic tar/zip extraction program"
@@ -20,8 +20,8 @@ include = [
 ]
 
 [dependencies]
-anyhow = "1.0.82"
-flate2 = "1.0.28"
+anyhow = "1.0.83"
+flate2 = "1.0.30" # TODO: zlib?
 hex = "0.4.3"
 pico-args = { version = "0.5.0", features = ["eq-separator"] }
 rc-zip-sync = { version = "4.1.0", default-features = false, features = ["deflate", "deflate64"] }