From 42c1769eae47dd58ca87968665c4210caad2ffec Mon Sep 17 00:00:00 2001 From: Maxim Stykow Date: Sun, 11 Oct 2026 15:47:25 -0700 Subject: [PATCH] fix(install): add cargo-binstall metadata and recommend --locked Without [package.metadata.binstall], cargo-binstall guesses a release asset name that does not match ours and falls back to compiling from source, which re-resolves dependencies and can pick up broken upstream releases. Point it at the published per-platform archives, and document `cargo install --locked` so source installs use the tested dependency set. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: Maxim Stykow --- Cargo.toml | 20 ++++++++++++++++++++ README.md | 6 ++++-- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 16bae986d..f8ecee871 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -40,6 +40,26 @@ include = [ "/SECURITY.md", ] +[package.metadata.binstall] +pkg-fmt = "tgz" +bin-dir = "provenant{ binary-ext }" + +[package.metadata.binstall.overrides.x86_64-unknown-linux-musl] +pkg-url = "{ repo }/releases/download/v{ version }/provenant-linux-x86_64.tar.gz" + +[package.metadata.binstall.overrides.aarch64-unknown-linux-musl] +pkg-url = "{ repo }/releases/download/v{ version }/provenant-linux-aarch64.tar.gz" + +[package.metadata.binstall.overrides.x86_64-apple-darwin] +pkg-url = "{ repo }/releases/download/v{ version }/provenant-macos-x86_64.tar.gz" + +[package.metadata.binstall.overrides.aarch64-apple-darwin] +pkg-url = "{ repo }/releases/download/v{ version }/provenant-macos-aarch64.tar.gz" + +[package.metadata.binstall.overrides.x86_64-pc-windows-msvc] +pkg-url = "{ repo }/releases/download/v{ version }/provenant-windows-x86_64.zip" +pkg-fmt = "zip" + [package.metadata.cargo-machete] ignored = ["md-5", "kamadak-exif"] diff --git a/README.md b/README.md index b5a580ab6..49770866f 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ brew install getprovenant/tap/provenant provenant scan --json-pp - --license --package /path/to/repo ``` -Not on Homebrew (or on Windows)? `cargo install provenant-cli`, grab a [prebuilt archive](https://github.com/getprovenant/provenant/releases), or run the [container image](#container-image). +Not on Homebrew (or on Windows)? `cargo install --locked provenant-cli`, grab a [prebuilt archive](https://github.com/getprovenant/provenant/releases), or run the [container image](#container-image). ## Why Provenant? @@ -75,9 +75,11 @@ Installs a prebuilt `provenant` binary from the [Provenant tap](https://github.c Install the crates.io package `provenant-cli`: ```sh -cargo install provenant-cli +cargo install --locked provenant-cli ``` +`--locked` builds against the dependency versions we tested, instead of re-resolving to the newest releases. + This installs the `provenant` command-line binary. ### Download Precompiled Binary