-
v4.1.1
StableAll checks were successfulpublished / fetched (push) Successful in 0spublished / release-tag (push) Successful in 2spublished / gpg-is-ready (push) Successful in 4spublished / projectfile-is-valid (push) Successful in 9spublished / source-is-compliant (push) Successful in 13spublished / signing-is-ready (push) Successful in 6spublished / source-is-tested (push) Successful in 17spublished / projectfile-is-ok (push) Successful in 7spublished / source-is-secure (push) Successful in 29spublished / documentation-passes-lint (push) Successful in 58spublished / documentation-is-ok (push) Successful in 0spublished / source-passes-lint (push) Successful in 1m11spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (riscv64, linux) (push) Successful in 7spublished / binaries-are-built (amd64, linux) (push) Successful in 7spublished / binaries-are-built (arm64, linux) (push) Successful in 7spublished / binaries-are-built (amd64, darwin) (push) Successful in 7spublished / binaries-are-built (arm64, darwin) (push) Successful in 7spublished / gsa (arm64, linux) (push) Successful in 4spublished / gsa (riscv64, linux) (push) Successful in 4spublished / gsa (amd64, linux) (push) Successful in 4spublished / gsa (arm64, darwin) (push) Successful in 4spublished / gsa (amd64, darwin) (push) Successful in 4spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (push) Successful in 11spublished / binaries-are-ready (push) Successful in 0spublished / binaries-are-torrented (push) Successful in 38spublished / binaries-torrent-is-verified (push) Successful in 9spublished / image-is-built (amd64) (push) Successful in 2m5spublished / secrets-ready (push) Successful in 0spublished / image-has-sbom (amd64) (push) Successful in 14spublished / images-are-ok (push) Successful in 0spublished / image-is-secure (amd64) (push) Successful in 19spublished / container-is-ok (push) Successful in 0spublished / container-ready-to-test (push) Successful in 0spublished / container-is-diagnosed (push) Successful in 0spublished / container-is-verified (amd64) (push) Successful in 53spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (kiota) (push) Successful in 21spublished / publish-image (dockerhub) (push) Successful in 50spublished / image-is-signed (push) Successful in 0spublished / release-is-published (push) Successful in 7spublished / release-notes-are-published (push) Successful in 6spublished / go-install-is-ok (push) Successful in 51spublished / published (push) Successful in 0sdamian-buho released this
2026-10-17 23:58:49 +00:00 | 0 commits to main since this releaseGPG key ID: 87B15EAD49FD22AB4 commits, 1 contributor, 6 hours since v4.1.0.
Bug fixes
- bridge: style the help title only on a colour terminal (
a2e77c3)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:v4.1.1If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:v4.1.1Go toolchain
Install with the Go toolchain:
go install projectfile.org/projectfile/bridge/v4/cmd/pf-bridge@v4.1.1Then run
pf-bridge --help.Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/v4.1.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64To uninstall, delete that one file:
rm ~/.local/bin/pf-bridge.Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge:v4.1.1 cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge:v4.1.1 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge:v4.1.1 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge:v4.1.1Prebuilt binary
The signature proves the binary is the one the maintainer’s release key signed.
gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257 curl --fail --location --output pf-bridge.asc https://kiota.ch/projectfile/bridge/releases/download/v4.1.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc gpg --verify pf-bridge.asc ~/.local/bin/pf-bridge # every downloaded asset at once gpg --verify pf-bridge-SHA256SUMS.asc pf-bridge-SHA256SUMS sha256sum --check --ignore-missing pf-bridge-SHA256SUMSDownload via BitTorrent
Fetch this release over BitTorrent with a magnet link, or with the attached
.torrentfile:Full changes: https://kiota.ch/projectfile/bridge/compare/3.7.0...v4.1.1
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- bridge: style the help title only on a colour terminal (
-
v4.0.2
StableAll checks were successfulpublished / fetched (push) Successful in 0spublished / gpg-is-ready (push) Successful in 4spublished / projectfile-is-valid (push) Successful in 5spublished / signing-is-ready (push) Successful in 6spublished / source-is-compliant (push) Successful in 8spublished / projectfile-is-ok (push) Successful in 6spublished / source-is-tested (push) Successful in 10spublished / source-is-secure (push) Successful in 21spublished / documentation-passes-lint (push) Successful in 54spublished / documentation-is-ok (push) Successful in 0spublished / source-passes-lint (push) Successful in 53spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (amd64, linux) (push) Successful in 5spublished / binaries-are-built (riscv64, linux) (push) Successful in 5spublished / binaries-are-built (arm64, darwin) (push) Successful in 5spublished / binaries-are-built (arm64, linux) (push) Successful in 5spublished / binaries-are-built (amd64, darwin) (push) Successful in 5spublished / gsa (amd64, darwin) (push) Successful in 6spublished / gsa (amd64, linux) (push) Successful in 6spublished / gsa (arm64, linux) (push) Successful in 6spublished / gsa (arm64, darwin) (push) Successful in 6spublished / gsa (riscv64, linux) (push) Successful in 5spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (push) Successful in 7spublished / binaries-are-torrented (push) Successful in 14spublished / image-is-built (amd64) (push) Successful in 1m13spublished / secrets-ready (push) Successful in 0spublished / images-are-ok (push) Successful in 0spublished / container-is-ok (push) Successful in 0spublished / container-ready-to-test (push) Successful in 0spublished / container-is-diagnosed (push) Successful in 0spublished / image-has-sbom (amd64) (push) Successful in 9spublished / image-is-secure (amd64) (push) Successful in 12spublished / container-is-verified (amd64) (push) Successful in 29spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 0spublished / image-is-attested (kiota) (push) Successful in 10spublished / image-is-attested (dockerhub) (push) Successful in 43spublished / release-is-published (push) Successful in 5spublished / release-notes-are-published (push) Successful in 5spublished / published (push) Successful in 0s2026-10-15 23:28:16 +00:00 | 66 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB3 commits, 1 contributor, 18 hours since v4.0.1.
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:v4.0.2If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:v4.0.2Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/v4.0.2/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge:v4.0.2 cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge:v4.0.2 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge:v4.0.2 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge:v4.0.2Prebuilt binary
The signature proves the binary is the one the maintainer’s release key signed.
gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257 curl --fail --location --output pf-bridge.asc https://kiota.ch/projectfile/bridge/releases/download/v4.0.2/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc gpg --verify pf-bridge.asc pf-bridge # every downloaded asset at once gpg --verify pf-bridge-SHA256SUMS.asc pf-bridge-SHA256SUMS sha256sum --check --ignore-missing pf-bridge-SHA256SUMSDownload via BitTorrent
Fetch this release over BitTorrent with a magnet link, or with the attached
.torrentfile:Full changes: https://kiota.ch/projectfile/bridge/compare/3.7.0...v4.0.2
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-
Source code (ZIP)
-
v4.0.1
StableAll checks were successfulpublished / fetched (push) Successful in 0spublished / gpg-is-ready (push) Successful in 4spublished / projectfile-is-valid (push) Successful in 3spublished / signing-is-ready (push) Successful in 5spublished / source-is-compliant (push) Successful in 6spublished / source-is-tested (push) Successful in 11spublished / projectfile-is-ok (push) Successful in 7spublished / source-is-secure (push) Successful in 24spublished / documentation-passes-lint (push) Successful in 1m2spublished / source-passes-lint (push) Successful in 1m44spublished / documentation-is-ok (push) Successful in 0spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (amd64, darwin) (push) Successful in 6spublished / binaries-are-built (arm64, linux) (push) Successful in 7spublished / binaries-are-built (arm64, darwin) (push) Successful in 7spublished / binaries-are-built (amd64, linux) (push) Successful in 7spublished / binaries-are-built (riscv64, linux) (push) Successful in 5spublished / gsa (amd64, darwin) (push) Successful in 6spublished / gsa (amd64, linux) (push) Successful in 6spublished / gsa (arm64, darwin) (push) Successful in 5spublished / gsa (arm64, linux) (push) Successful in 5spublished / gsa (riscv64, linux) (push) Successful in 4spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (push) Successful in 10spublished / image-is-built (amd64) (push) Successful in 1m53spublished / binaries-are-torrented (push) Successful in 20spublished / image-has-sbom (amd64) (push) Successful in 27spublished / secrets-ready (push) Successful in 1spublished / image-is-secure (amd64) (push) Successful in 23spublished / images-are-ok (push) Successful in 0spublished / container-is-ok (push) Successful in 1spublished / container-ready-to-test (push) Successful in 0spublished / container-is-diagnosed (push) Successful in 0spublished / container-is-verified (amd64) (push) Successful in 1m10spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 0spublished / image-is-attested (kiota) (push) Successful in 25spublished / image-is-attested (dockerhub) (push) Successful in 54spublished / release-is-published (push) Successful in 8spublished / release-notes-are-published (push) Successful in 6spublished / published (push) Successful in 0s2026-10-15 04:58:12 +00:00 | 70 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB1 commit, 1 contributor, 29 minutes since v4.0.0.
Highlights
The
pf-bridge-bridges-<version>-<os>-<arch>.tar.gzarchives announced in v4.0.0 are not published. The single-bridge binaries in them weighed about 130 MB per platform, eight times the standalonepf-bridge-<os>-<arch>, which already includes every bridge. Download that one binary; to get the single-bridge binaries, build them from source.Bug fixes
- release: publish the standalone binary only, without the bridges archive (
27d3e44)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:v4.0.1If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:v4.0.1Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/v4.0.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge:v4.0.1 cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge:v4.0.1 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge:v4.0.1 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge:v4.0.1Prebuilt binary
The signature proves the binary is the one the maintainer’s release key signed.
gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257 curl --fail --location --output pf-bridge.asc https://kiota.ch/projectfile/bridge/releases/download/v4.0.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc gpg --verify pf-bridge.asc pf-bridgeDownload via BitTorrent
Fetch this release over BitTorrent with a magnet link, or with the attached
.torrentfile:Full changes: https://kiota.ch/projectfile/bridge/compare/3.7.0...v4.0.1
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- release: publish the standalone binary only, without the bridges archive (
-
v4.0.0
StableAll checks were successfulpublished / fetched (push) Successful in 0spublished / projectfile-is-valid (push) Successful in 5spublished / gpg-is-ready (push) Successful in 5spublished / signing-is-ready (push) Successful in 6spublished / source-is-compliant (push) Successful in 9spublished / source-is-tested (push) Successful in 11spublished / projectfile-is-ok (push) Successful in 5spublished / source-is-secure (push) Successful in 23spublished / documentation-passes-lint (push) Successful in 53spublished / source-passes-lint (push) Successful in 52spublished / documentation-is-ok (push) Successful in 0spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / image-is-built (amd64) (push) Successful in 1m0spublished / image-has-sbom (amd64) (push) Has been skippedpublished / secrets-ready (push) Successful in 0spublished / images-are-ok (push) Successful in 1spublished / container-is-ok (push) Successful in 0spublished / binaries-are-built (riscv64, linux) (push) Successful in 1m7spublished / binaries-are-built (arm64, linux) (push) Successful in 1m9spublished / container-ready-to-test (push) Successful in 0spublished / container-is-diagnosed (push) Successful in 0spublished / binaries-are-built (arm64, darwin) (push) Successful in 1m11spublished / image-is-secure (amd64) (push) Successful in 14spublished / binaries-are-built (amd64, linux) (push) Successful in 1m18spublished / binaries-are-built (amd64, darwin) (push) Successful in 1m19spublished / gsa (riscv64, linux) (push) Successful in 5spublished / gsa (amd64, darwin) (push) Successful in 5spublished / gsa (arm64, linux) (push) Successful in 5spublished / gsa (arm64, darwin) (push) Successful in 5spublished / gsa (amd64, linux) (push) Successful in 5spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (push) Has been skippedpublished / binaries-are-torrented (push) Has been skippedpublished / container-is-verified (amd64) (push) Successful in 31spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Has been skippedpublished / image-is-attested (dockerhub) (push) Successful in 6spublished / image-is-attested (kiota) (push) Successful in 8spublished / release-is-published (push) Has been skippedpublished / release-notes-are-published (push) Has been skippedpublished / published (push) Successful in 0s2026-10-15 03:47:11 +00:00 | 72 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB609 commits, 1 contributor.
Upgrade notes
-
sinks: compose a ref from declared parts, not from a Go default (
acb157b) -
ai-policy: rename the llm bridge to ai-policy (
2cfd6f0)pf-bridge llmis nowpf-bridge ai-policy; the
pf-bridge-llm binary is now pf-bridge-aipolicy. -
ai: read org.projectfile.ai (
16a2cc1)a document declaring org.projectfile.llm is no longer
read; rename the key to org.projectfile.ai. -
fragments: inherit live at generate, no committed cache (
acec2f1)--refresh and core.Options.Refresh are gone; generate now
reaches the forge by default (--offline preserves committed sections), and
docs/.d/.inherited/ is no longer written or read. -
results on stdout, one colour decision and a network timeout (
0aa38e6)result lines move from stderr to stdout.
-
forge: take the network timeout from the shared --timeout (
6e068d7)forge push no longer declares its own --timeout; the
persistent flag of the same name replaces it. -
module: move the module to projectfile.org/projectfile/bridge/v4 (
a9eb9b2)the Go module path is now projectfile.org/projectfile/bridge/v4.
Highlights
pf-bridge-<os>-<arch>is now one standalone binary that includes every bridge, so a single download is the whole tool. The single-bridge binaries no longer ship as loose release assets; they come together inpf-bridge-bridges-<version>-<os>-<arch>.tar.gzwith a dispatcher that runs the binaries beside it. Extract the archive anywhere; deleting that directory uninstalls it.Features
- core: show native language names in the cross-language bar (
35e1190) - security: add GPG fingerprint, reporting guidance, acknowledged vulnerabilities (
cde42be) - security: derive gpg-fingerprint from the network when unset (
189d07d) - security: note absence of a bug bounty programme when unset (
8d4c246) - i18n: move localized docs to docs// and add default-language (
cca4500) - readme: improve generator with platforms, variants, collection bar and merged header (
6b767d4) - bridge: wrap localized docs in textlint terminology disable (
635be0c) - contributing: merge workflow and commits into a Conventions section (
54e9cf6) - readme: drive the related-projects bar from links[] tagged 'related' (
f57453a) - pfmodel: add priority field for link and shield ordering (
73d4fa1) - readme: order badges and links by priority (
d5f2fb8) - support: order links by priority in SUPPORT.md (
f3464fc) - contributing: order forge stars and socials by priority (
884cf6e) - derive: address forge mirrors by capability, not by slug (
15d229d) - scan: propose capability tags from the forge host table (
e767a9d) - scan: name the shields route family, and add --force (
528b432) - forge: add the badges route families to the mirror links (
838c823) - readme: rank installation and usage groups by priority (
2fc9d01) - registries: compose a pull reference per container registry (
5fb44af) - sync: let --force rewrite a file whose fields already agree (
f7dfa6d) - sink: compose pull references from sinks, replacing the registry model (
e1391b3) - bridge: localize prose links and add a generated-file footer (
377ade7) - bridge: localize scan/derive link labels per declared language (
e96a8d4) - bridge/support: render paid-support as a SUPPORT.md block (
5c7219c) - fragments: localize assembled documents per org.projectfile.i18n (
5a43813) - i18n: translate feature fragments to Spanish and Ukrainian (
2aa2017) - i18n: localized link labels, GitHub issues link, llm-generator doc (
0e23d81) - i18n: localize identity summary and description (
a29431e) - fragments: localize inherited sections from the parent's published documents (
a04bc15) - readme: group install commands per sink with joined fences (
cd90818) - readme: curate Links by readme tag and list docs/how-to articles (
1240e5b) - dispatcher: annotate --list with descriptions, skip platform artifacts (
52d00f1) - pfmodel: parse org.projectfile.llm extension namespace (
3e8b8d1) - bridge: add pf-bridge-llm — render LLM.md from org.projectfile.llm (
5484376) - bridge: cross-link LLM.md from readme and contributing (
4148d30) - llm: render AI_POLICY.md with the three-direction shape (
106a7e6) - ai-policy: make default activity coverage and internal-practice link explicit (
e8a04a8) - bridge: add --preview flag (
55c46b9) - bridge: make the generated-from-projectfile footer opt-in (
9e5712e) - bridge: add See also section from project-authored links (
6600436) - readme: localize the related bar prefix and drop the self link (
4825923) - ignore: generate .textlintignore and .fdignore (
207f6c5) - check: derive the check sweep from the project manifest (
56531c5) - ocisinks: compose the own artifact through a sink's selfref (
453c445) - forge: filter push by forge, support scp-style URLs (
ca3cf2b) - readme: label the ssh artifact kind (
ac02194) - release: add riscv64 binary to published matrix (
a99eadf) - vulnerabilities: fan out suppress list to audit-ci.jsonc (
b1fe4a7) - derive: infer Docker Hub and GHCR links from resolved sinks (
a09d0e7) - bridge: add shard.yml sync bridge for Crystal projects (
f228946) - forge: declare Codeberg and GitHub mirrors and enable GitHub CI (
5863f25) - ci: build linux/amd64, arm64 and riscv64 images (
1ce3ae1) - ci: sign and attest the published image with cosign (
b48bbe8) - readme: resolve badge hrefs per language and CI-matrix series (
0363e14) - forges: rank alias claims by link priority (
a45be94) - scan: materialize forge link and repository templates (
0f640dd) - derive: releases alias from repositories[releases=true] (
11ec24c) - scan: sinks scanner materializes package-registry links (
83a056c) - ci: sign released binaries with the org GPG key (
907efbb) - publish: push to Docker Hub (
fd38608) - readme: prefer identity.description over summary in basics (
41d1e16) - readme: summarise inherited features as one note naming each parent (
e18b24a) - readme: lead the building block with declared groups, keep derived goals (
37799d6) - readme: fan command sections over per-node matrix axes too (
a9a45cc) - readme: label the action artifact kind (
7efc375) - readme: per-cell groups render one headed fence per matrix cell (
b84b94e) - readme: optional title gives a section group its own heading (
dfeb1a8) - readme: fleet default platforms for an image declaring none (
754a0ec) - readme: inputs table from an action artifact's action.yaml (
0dad9b4) - readme: axis-args keeps matrix axes as Dockerfile ARG lines (
e43925c) - readme: one runnable line per fan-out, variants listed below it (
523deb1) - readme: render a localized ci goal description in the reader’s language (
f64bcc6) - readme: embed a declared file as a section group's fence (
1c6df5c) - fragments: let a conventions shell opt out of inheritance (
6f3127c) - readme: quote USAGE.md's top-level help and first example (
fc4edc9) - readme: name the packaged upstream and keep its license apart (
8b11a8b) - rootflags: bind -V to --version on every bridge binary (
bcca94e) - readme: join same-sink groups and show channel titles only when there is a choice (
c477877) - readme: recognise a help capture by its console command line (
bf4f9af) - readme: quote only the top-level help in Usage, link USAGE.md for examples (
8e8fa0b) - readme: name each registry’s platforms on its install heading (
d6b3346) - readme: label an npm or PyPI package by its registry (
841e9d7) - readme: name the command an artifact exports on its line (
e432585) - fragments: assemble fragment documents under docs/ (
0d69aed) - readme: link companion documents by their title (
1da87d8) - readme: continue a single fence with a group that carries no prose (
0953e24) - readme: list a group’s published matrix cells under its fence (
3053449) - readme: render the Building section as docs/BUILD.md behind build-doc (
11f5118) - contributing: link docs/BUILD.md once the readme renders it (
c69cdd1) - badges: render each badge on the documents it declares (
89e165b) - release-notes: render release notes from git (
63b4038) - release-notes: pin README install and usage blocks to the release (
9c5d9be) - release-notes: adaptive elapsed time in the summary line from a template (
0cf8256) - release-notes: publish the per-forge half of a release body (
a8eeb9b) - release-notes: compare against the previous release the forge lists (
cd5127e) - derive: expose stable version parts as org.projectfile.semver (
7ce9e4a) - release-notes: split Verify per artifact kind and check the installed binary (
fd74162) - release-notes: apply an installation entry’s release prefix and postfix on the release page (
d42db3d) - release-notes: pin images by digest and list per-platform digests (
59885fc) - release-notes: show per-platform size change against the previous release (
dd109cf) - release-notes: list package changes from the attested SBOM (
5fae330) - release-notes: configure shown commit sections from the projectfile (
27b5866) - release-notes: attach files named by release.attach to the release (
2886863) - npm: name the package after a declared npm package artifact (
1c3e545) - bridge: name the repositories[].packages entry as the package manifest source (
ff301a8) - npm: take cpu and os from the npm artifact before the project-level platform lists (
01651c4) - forge: push branch and tag protection derived from release branches (
2b2702c) - forge: set the origin default branch to release.trunk (
c06adaf) - release-notes: check every downloaded binary against the signed SHA256SUMS (
27b00bf) - bridge: scope the registry to one command so every bridge can share a binary (
90f0aec) - dispatch: run every subcommand in-process, with a lookup build for the sibling binaries (
913c66a) - release: ship one standalone pf-bridge and an archive of the single-bridge binaries (
39200f0) - release: tag releases with a v prefix (
3ecf5f7)
Bug fixes
- readme: restore blank line after Links heading (
a44b964) - readme: regenerate badges for shields.io static/v1 (
42a734b) - git: untrack the .makefile/bootstrap build marker (
9d0d87b) - readme: advertise real local entry points in the Building section (
f66ffcd) - cff: stop CITATION.cff stacking one SPDX block per sync run (
b927c3a) - readme: admit a readme-tagged non-goal into the entry-point list (
b3bcaaa) - reuse: unify the header every generator writes (
cd8309f) - cff: tidy the CITATION.cff pedigree banner (
7767b68) - codeowners: stop the REUSE header stacking on every write (
93c148c) - reuse: mark every generated Markdown file, whatever its policy (
56076a0) - contributing: repair author links, localize labels, trim dogmatic text (
7418d16) - scan: overwrite link label and preferred under --force (
fda368f) - docs: point docs references at the project's /docs, not the spec (
bd7d1fe) - bridge/core: disable English-only lint rules for localized docs (
0bff42b) - bridge/support: drop external MCVE link from SUPPORT.md (
1ad596e) - contributing: drop the redundant inline TOC link (
be8ca36) - bridge/core: reword localized-rules comment to clear misspell lint (
41c629f) - bridge: derive localized issues link in git-remotes scan (
3b032f5) - bridge: translate the Issues noun to Ukrainian as Задачі (
ba3b8ce) - fragments: blank-line seam between REUSE header and textlint wrap (
fd3df4b) - drop '# Stack:' line from generated banners (
08b835a) - readme: quote matrix axis values as code spans (
c0d18d0) - fragments: carry textlint directive pairs in translated fragment sources (
702ae87) - readme: give install and usage their own sink heading verbs (
c0c5666) - bridge: last generator bugs from FOCUS (
8441650) - bridge: rename ai-policy binary/package dir to match its CLI name (
0d95b00) - ai-policy: add language to disclosure-trailer fenced block (
2d67f7d) - dockerfile: key apt cache mounts by arch, not just series (
19ca6d3) - bridge: drop scaffold-once, use marker gate everywhere (
fa29c7b) - support: drop duplicate See also section from SUPPORT.md (
74b0a39) - contributing: link the issues tracker even when a forge label is set (
8df4780) - localize: give a body with no trailing newline exactly one (
34253ea) - fragments: drop the parent's language bar when nesting its document (
3fe1a81) - go: bump toolchain directive to 1.26.6 (
36fffa1) - deps: bump projectfile/core to v2.9.4 (
b28af09) - derive: stop warning about image sinks on projects with no image (
77a04c4) - bridge: wrap the AI_POLICY project-name line in textlint-disable (
b7086fc) - fragments: drop parent version from inherited section headings (
6e1327e) - pyproject: preserve header and comments, gate Documentation URL on the main-documentation tag (
8bc0b4e) - ignore: apply exclude so an inherited pattern can be dropped (
247a982) - ignore: emit re-includes after the patterns they answer (
836cfea) - ignore: honour the documented generate list (
b385fb2) - ignore: fall back .containerignore to docker: when unset (
03ce3ce) - readme: call a website artifact a Site (
8a6461b) - yamllint: emit only what the projectfile declares (
6cb5a3e) - container: declare the full b19 build-arg surface (
7e4ccbf) - ci: add gsa node to enforce build-binaries before auto-gsa (
b0ca449) - update .makefile/library submodule (disable check-outdated-go memoisation) (
2a96521) - ci: opt into the binary release pipeline explicitly (
a47b0a7) - fragments: defer variant warning until document has content (
d8a27d9) - deps: bump golang.org/x/crypto v0.54.0 → v0.56.0 (
1493711) - deps: bump kiota.ch/projectfile/core/v2 to v2.9.7 (
e66c32e) - build-binaries: stop writing duplicate unsuffixed binaries into dist/ (
b6c6b71) - bump core to 2.10.3 (
cfab4d0) - ocisinks: list only the sinks a publish route pushes to (
bfef8aa) - ignore: emit ignore outputs in global alphabetical order (
4316a0e) - scaffold: backfill a plain label for unlabeled bugs/homepage/documentation links (
50f6e2d) - ignore: extract dist/ literal into a test constant (
c7f8dd7) - sync: make the projectfile authoritative in sync mode (
2a7aa6a) - npm: skip repository and bugs when package.json already agrees (
e42ad63) - cleanup dirnames for dockerignore (
bf20dd7) - derive: remove package-registry inference pass (
f9aceed) - derive: fan out package-registry links per CI matrix axis (
20f2fe6) - forge: declare only existing forges (
c7f2284) - pf-cli optimize fuckup (
5d16d79) - deps: bump projectfile/core to v2.11.1 (
1450375) - deps: bump projectfile/core to v2.11.2 (
df45991) - deps: bump projectfile/core to v2.12.0 (
019614a) - readme: drop badges that name a CI-matrix series, don't fan out (
bd6f658) - scan: gap-fill a proposed link priority (
03357dc) - ci: matrix the binaries-are-signed node (
406560c) - deps: bump projectfile/core to v2.12.3 (
bf303c6) - deps: bump projectfile/core to v2.13.0 (
9bd9b84) - deps: bump github.com/ProtonMail/go-crypto to v1.5.1 (
561aa6c) - cli: rewrite pf-bridge help with categories and ro/rw tags (
73b3779) - cli: show real cache paths, entries, and freshness (
c44c47e) - cli: report forge push per repository (
a67e41c) - cli: friendlier bridge errors and empty-state guidance (
dffc5e9) - cli: ask identity.name directly with slug/title/summary hints (
4e51d02) - cli: update list rendering test for ro/rw tags (
1117512) - deps: bump go-crypto v1.5.1 -> v1.5.2 (
980a3cd) - sinks: promote a lone fallback sink to primary (
75383b1) - scan: --force keeps the tags a scanner proposed for the issue tracker (
b891998) - readme: honour matrix.exclude when fanning out command lines (
92d4372) - readme: drop the action inputs table when the action ref is unresolved (
90eaccb) - fragments: order fragments by file stem (
74937db) - fragments: keep an inherit: false document flat (
1544f7b) - readme: keep USAGE.md lint directives out of the usage excerpt (
e2de45f) - readme: read upstream where the parser keeps it (
002496c) - bridgerun: gate interactive prompts on a terminal stdin (
7e69d7c) - buildinfo: derive the version from Go build info when unstamped (
0c65178) - scanners: run the forge and sinks scanners only where a projectfile exists (
1b6437f) - reject an unknown shell in pf-bridge completion (
fe20537) - report a flag typed before the pf-bridge command (
31327e0) - keep per-bridge runs non-interactive without a terminal (
fb41824) - readme: spell Docker Hub references without the docker.io host (
7eb753b) - readme: name inherited parents without the heading prefix (
0549b4c) - readme: drop a lone sink heading outside Installation (
4741073) - readme: let a series example name any value of its matrix axis (
7551847) - deps: update projectfile core to v2.15.0 (
249a9d8) - readme: percent-encode spaces in badge link destinations (
c2162c7) - sync: never read a synced file back into the projectfile (
63c56c7) - readme: name series line by the image part and mark its values (
4001da6) - release-notes: count only feat fragments as new, root fragment links (
5716016) - forge: rewind the request body before a retry (
2f81eec) - release-notes: verify offline cosign signatures without the transparency log (
aae94a1) - release-notes: name the token source and stop early without one (
fa29649) - release-notes: render magnets as links, fenced where the forge strips the scheme (
36f1356) - dispatch: skip -<uname -m> release copies during discovery (
1b8bba2) - assert on a here-string, not a grep -q pipeline (
62a8d75) - deps: bump charm.land/bubbletea/v2 to v2.1.0 (
9c13779) - container: restore M6E_VERSION in final image (
39a810f) - bridge: default sync converges without destroying file data (
90d99d6) - deps: bump projectfile/core to v2.16.0 (
2947808) - deps: bump core to 2.18.0 (
46ed1d4) - npm: skip a non-SemVer identity.version instead of writing it (
87f0f5c) - net: retry every network crossing on core's shared policy (
251e0eb) - security: suppress CVE-2026-92392 in the Ubuntu cURL (
5dfaa8e) - security: generate the scanner ignore files from the projectfile (
a5e54da) - ci: sign every binary cell in one job (
54c671e) - build: fetch public Go modules through proxy.golang.org (
5d7b84f) - build: copy every root Go file into the image build (
43165eb)
Performance
- fragments: batch and parallelize parent fetches (
eb0c403) - container: declare M6E_VERSION next to the user stage (
3d74a7d)
Reverts
- undo local submodule edit (fix belongs in m6e/library) (
1ccc531)
Dependencies
- 8 dependency updates
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-
-
3.7.0
StableAll checks were successfulpublished / fetched (push) Successful in 0spublished / projectfile-is-valid (push) Successful in 4spublished / gpg-is-ready (push) Successful in 4spublished / signing-is-ready (push) Successful in 5spublished / source-is-compliant (push) Successful in 6spublished / projectfile-is-ok (push) Successful in 6spublished / source-is-tested (push) Successful in 11spublished / source-is-secure (push) Successful in 22spublished / documentation-passes-lint (push) Successful in 1m0spublished / documentation-is-ok (push) Successful in 0spublished / source-passes-lint (push) Successful in 1m7spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (amd64, linux) (push) Successful in 40spublished / binaries-are-built (arm64, darwin) (push) Successful in 41spublished / binaries-are-built (amd64, darwin) (push) Successful in 42spublished / binaries-are-built (arm64, linux) (push) Successful in 36spublished / binaries-are-built (riscv64, linux) (push) Successful in 33spublished / gsa (arm64, darwin) (push) Successful in 8spublished / gsa (amd64, darwin) (push) Successful in 10spublished / gsa (amd64, linux) (push) Successful in 10spublished / gsa (arm64, linux) (push) Successful in 6spublished / gsa (riscv64, linux) (push) Successful in 6spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (arm64, linux) (push) Successful in 24spublished / binaries-are-signed (arm64, darwin) (push) Successful in 24spublished / binaries-are-signed (amd64, linux) (push) Successful in 24spublished / binaries-are-signed (amd64, darwin) (push) Successful in 25spublished / image-is-built (amd64) (push) Successful in 1m29spublished / secrets-ready (push) Successful in 0spublished / images-are-ok (push) Successful in 0spublished / binaries-are-signed (riscv64, linux) (push) Successful in 19spublished / container-is-ok (push) Successful in 0spublished / container-ready-to-test (push) Successful in 0spublished / container-is-diagnosed (push) Successful in 0spublished / image-has-sbom (amd64) (push) Successful in 11spublished / image-is-secure (amd64) (push) Successful in 14spublished / container-is-verified (amd64) (push) Successful in 35spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 0spublished / image-is-attested (kiota) (push) Successful in 27spublished / image-is-attested (dockerhub) (push) Successful in 45spublished / binaries-are-torrented (push) Successful in 1m54spublished / release-is-published (push) Successful in 1m3spublished / release-notes-are-published (push) Successful in 5spublished / published (push) Successful in 0s2026-10-15 01:22:58 +00:00 | 82 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB11 commits, 1 contributor, 21 hours since 3.6.1.
Features
- forge: push branch and tag protection derived from release branches (
2b2702c) - forge: set the origin default branch to release.trunk (
c06adaf)
Bug fixes
- npm: skip a non-SemVer identity.version instead of writing it (
87f0f5c) - net: retry every network crossing on core's shared policy (
251e0eb) - security: suppress CVE-2026-92392 in the Ubuntu cURL (
5dfaa8e) - security: generate the scanner ignore files from the projectfile (
a5e54da)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:3.7.0This release also publishes the
3.7and3tags — pull the precision you want to pin.If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:3.7.0Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.7.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Image digests
A tag can move; a digest cannot. Pull this exact build:
docker pull docker.io/damianbuho/projectfile-bridge@sha256:22dc2c16b663cb92491bda93177ee63b338da975cbcf2c2d6fafccbd1ccc097b docker pull kiota.ch/projectfile/bridge@sha256:22dc2c16b663cb92491bda93177ee63b338da975cbcf2c2d6fafccbd1ccc097bPlatform Digest Size linux/amd64 sha256:bf2808b00c4c5d357e62e516921edb077a31dbe2e067846defba85e7b9bcc212242.1 MB Sizes are compressed layer bytes as stored in the registry.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge@sha256:22dc2c16b663cb92491bda93177ee63b338da975cbcf2c2d6fafccbd1ccc097b cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge@sha256:22dc2c16b663cb92491bda93177ee63b338da975cbcf2c2d6fafccbd1ccc097b cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge@sha256:22dc2c16b663cb92491bda93177ee63b338da975cbcf2c2d6fafccbd1ccc097b cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge@sha256:22dc2c16b663cb92491bda93177ee63b338da975cbcf2c2d6fafccbd1ccc097bPrebuilt binary
The signature proves the binary is the one the maintainer’s release key signed.
gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257 curl --fail --location --output pf-bridge.asc https://kiota.ch/projectfile/bridge/releases/download/3.7.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc gpg --verify pf-bridge.asc pf-bridgeDownload via BitTorrent
Fetch this release over BitTorrent with a magnet link, or with the attached
.torrentfile:Full changes: https://kiota.ch/projectfile/bridge/compare/3.6.1...3.7.0
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- forge: push branch and tag protection derived from release branches (
-
3.6.1
StableAll checks were successfulpublished / fetched (push) Successful in 0spublished / gpg-is-ready (push) Successful in 4spublished / projectfile-is-valid (push) Successful in 4spublished / signing-is-ready (push) Successful in 5spublished / source-is-compliant (push) Successful in 8spublished / source-is-tested (push) Successful in 12spublished / projectfile-is-ok (push) Successful in 6spublished / source-is-secure (push) Successful in 23spublished / documentation-passes-lint (push) Successful in 57spublished / documentation-is-ok (push) Successful in 0spublished / source-passes-lint (push) Successful in 1m1spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (arm64, linux) (push) Successful in 39spublished / binaries-are-built (arm64, darwin) (push) Successful in 39spublished / binaries-are-built (amd64, linux) (push) Successful in 39spublished / binaries-are-built (riscv64, linux) (push) Successful in 39spublished / binaries-are-built (amd64, darwin) (push) Successful in 42spublished / gsa (arm64, darwin) (push) Successful in 8spublished / gsa (amd64, linux) (push) Successful in 8spublished / gsa (riscv64, linux) (push) Successful in 8spublished / gsa (arm64, linux) (push) Successful in 8spublished / gsa (amd64, darwin) (push) Successful in 8spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (arm64, darwin) (push) Successful in 23spublished / binaries-are-signed (riscv64, linux) (push) Successful in 23spublished / binaries-are-signed (arm64, linux) (push) Successful in 23spublished / binaries-are-signed (amd64, linux) (push) Successful in 24spublished / binaries-are-signed (amd64, darwin) (push) Successful in 24spublished / image-is-built (amd64) (push) Successful in 1m32spublished / secrets-ready (push) Successful in 0spublished / images-are-ok (push) Successful in 0spublished / container-is-ok (push) Successful in 1spublished / container-ready-to-test (push) Successful in 0spublished / container-is-diagnosed (push) Successful in 0spublished / image-has-sbom (amd64) (push) Successful in 10spublished / image-is-secure (amd64) (push) Successful in 14spublished / container-is-verified (amd64) (push) Successful in 28spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 0spublished / image-is-attested (kiota) (push) Successful in 24spublished / image-is-attested (dockerhub) (push) Successful in 45spublished / release-is-published (push) Successful in 53spublished / release-notes-are-published (push) Successful in 4spublished / published (push) Successful in 0s2026-10-14 03:32:05 +00:00 | 94 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB8 commits, 1 contributor, 1 day since 3.6.0.
Bug fixes
- deps: bump core to 2.18.0 (
46ed1d4)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:3.6.1This release also publishes the
3.6and3tags — pull the precision you want to pin.If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:3.6.1Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.6.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Image digests
A tag can move; a digest cannot. Pull this exact build:
docker pull docker.io/damianbuho/projectfile-bridge@sha256:3051806d8fff718ad2183f8b18ce923cb8a11dd72f952c1851d4e01dc78b7276 docker pull kiota.ch/projectfile/bridge@sha256:3051806d8fff718ad2183f8b18ce923cb8a11dd72f952c1851d4e01dc78b7276Platform Digest Size linux/amd64 sha256:c1db8957bd85019ab35f52e8ae7e2d457ba1fcc7bf65eaeca1c29540cb03adc3242.1 MB (+0.1 MB) Sizes are compressed layer bytes as stored in the registry.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge@sha256:3051806d8fff718ad2183f8b18ce923cb8a11dd72f952c1851d4e01dc78b7276 cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge@sha256:3051806d8fff718ad2183f8b18ce923cb8a11dd72f952c1851d4e01dc78b7276 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge@sha256:3051806d8fff718ad2183f8b18ce923cb8a11dd72f952c1851d4e01dc78b7276 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge@sha256:3051806d8fff718ad2183f8b18ce923cb8a11dd72f952c1851d4e01dc78b7276Prebuilt binary
The signature proves the binary is the one the maintainer’s release key signed.
gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257 curl --fail --location --output pf-bridge.asc https://kiota.ch/projectfile/bridge/releases/download/3.6.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc gpg --verify pf-bridge.asc pf-bridgeFull changes: https://kiota.ch/projectfile/bridge/compare/3.6.0...3.6.1
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- deps: bump core to 2.18.0 (
-
3.6.0
StableAll checks were successfulpublished / fetched (push) Successful in 1spublished / gpg-is-ready (push) Successful in 4spublished / projectfile-is-valid (push) Successful in 4spublished / signing-is-ready (push) Successful in 4spublished / source-is-compliant (push) Successful in 6spublished / projectfile-is-ok (push) Successful in 6spublished / source-is-tested (push) Successful in 11spublished / source-is-secure (push) Successful in 19spublished / documentation-passes-lint (push) Successful in 54spublished / documentation-is-ok (push) Successful in 0spublished / source-passes-lint (push) Successful in 55spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (arm64, linux) (push) Successful in 41spublished / binaries-are-built (riscv64, linux) (push) Successful in 42spublished / binaries-are-built (amd64, linux) (push) Successful in 42spublished / binaries-are-built (arm64, darwin) (push) Successful in 45spublished / binaries-are-built (amd64, darwin) (push) Successful in 45spublished / gsa (amd64, linux) (push) Successful in 19spublished / gsa (amd64, darwin) (push) Successful in 19spublished / gsa (riscv64, linux) (push) Successful in 18spublished / gsa (arm64, linux) (push) Successful in 20spublished / gsa (arm64, darwin) (push) Successful in 20spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (riscv64, linux) (push) Successful in 22spublished / binaries-are-signed (arm64, linux) (push) Successful in 25spublished / binaries-are-signed (arm64, darwin) (push) Successful in 25spublished / binaries-are-signed (amd64, darwin) (push) Successful in 28spublished / binaries-are-signed (amd64, linux) (push) Successful in 28spublished / image-is-built (amd64) (push) Successful in 1m52spublished / secrets-ready (push) Successful in 0spublished / images-are-ok (push) Successful in 0spublished / container-is-ok (push) Successful in 0spublished / container-ready-to-test (push) Successful in 1spublished / image-has-sbom (amd64) (push) Successful in 9spublished / container-is-diagnosed (push) Successful in 1spublished / image-is-secure (amd64) (push) Successful in 14spublished / container-is-verified (amd64) (push) Successful in 31spublished / image-is-ready (push) Successful in 1spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 1spublished / image-is-attested (kiota) (push) Successful in 30spublished / image-is-attested (dockerhub) (push) Successful in 55spublished / release-is-published (push) Successful in 1m33spublished / release-notes-are-published (push) Successful in 16spublished / published (push) Successful in 0s2026-10-12 18:52:38 +00:00 | 103 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB5 commits, 1 contributor, 6 hours since 3.5.3.
Features
- bridge: name the repositories[].packages entry as the package manifest source (
ff301a8) - npm: take cpu and os from the npm artifact before the project-level platform lists (
01651c4)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:3.6.0This release also publishes the
3.6and3tags — pull the precision you want to pin.If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:3.6.0Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.6.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Image digests
A tag can move; a digest cannot. Pull this exact build:
docker pull docker.io/damianbuho/projectfile-bridge@sha256:cdeefa5255caac6a216dd46bcd56cccfc8e7eb784a296d34f72fc7046b69c9d9 docker pull kiota.ch/projectfile/bridge@sha256:cdeefa5255caac6a216dd46bcd56cccfc8e7eb784a296d34f72fc7046b69c9d9Platform Digest Size linux/amd64 sha256:ab3e701e04f49a6fd6e7d6373b248963d6412469d62bc3ffaccd2e39dbe0736b242.0 MB Sizes are compressed layer bytes as stored in the registry.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge@sha256:cdeefa5255caac6a216dd46bcd56cccfc8e7eb784a296d34f72fc7046b69c9d9 cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge@sha256:cdeefa5255caac6a216dd46bcd56cccfc8e7eb784a296d34f72fc7046b69c9d9 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge@sha256:cdeefa5255caac6a216dd46bcd56cccfc8e7eb784a296d34f72fc7046b69c9d9 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge@sha256:cdeefa5255caac6a216dd46bcd56cccfc8e7eb784a296d34f72fc7046b69c9d9Prebuilt binary
The signature proves the binary is the one the maintainer’s release key signed.
gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257 curl --fail --location --output pf-bridge.asc https://kiota.ch/projectfile/bridge/releases/download/3.6.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc gpg --verify pf-bridge.asc pf-bridgeFull changes: https://kiota.ch/projectfile/bridge/compare/3.5.3...3.6.0
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- bridge: name the repositories[].packages entry as the package manifest source (
-
3.5.3
StableAll checks were successfulpublished / fetched (push) Successful in 1spublished / projectfile-is-valid (push) Successful in 10spublished / signing-is-ready (push) Successful in 9spublished / source-is-compliant (push) Successful in 11spublished / projectfile-is-ok (push) Successful in 7spublished / source-is-tested (push) Successful in 13spublished / source-is-secure (push) Successful in 37spublished / documentation-passes-lint (push) Successful in 1m5spublished / documentation-is-ok (push) Successful in 0spublished / source-passes-lint (push) Successful in 1m5spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (arm64, darwin) (push) Successful in 38spublished / binaries-are-built (riscv64, linux) (push) Successful in 37spublished / binaries-are-built (arm64, linux) (push) Successful in 43spublished / binaries-are-built (amd64, linux) (push) Successful in 43spublished / binaries-are-built (amd64, darwin) (push) Successful in 43spublished / gsa (arm64, darwin) (push) Successful in 21spublished / gsa (amd64, linux) (push) Successful in 21spublished / gsa (riscv64, linux) (push) Successful in 20spublished / gsa (amd64, darwin) (push) Successful in 21spublished / gsa (arm64, linux) (push) Successful in 21spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (arm64, darwin) (push) Successful in 18spublished / binaries-are-signed (arm64, linux) (push) Successful in 17spublished / binaries-are-signed (amd64, linux) (push) Successful in 19spublished / binaries-are-signed (amd64, darwin) (push) Successful in 24spublished / image-is-built (amd64) (push) Successful in 2m25spublished / secrets-ready (push) Successful in 0spublished / images-are-ok (push) Successful in 0spublished / container-is-ok (push) Successful in 0spublished / container-ready-to-test (push) Successful in 1spublished / container-is-diagnosed (push) Successful in 0spublished / image-has-sbom (amd64) (push) Successful in 9spublished / image-is-secure (amd64) (push) Successful in 13spublished / container-is-verified (amd64) (push) Successful in 31spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 0spublished / image-is-attested (kiota) (push) Successful in 25spublished / image-is-attested (dockerhub) (push) Successful in 53spublished / binaries-are-signed (riscv64, linux) (push) Successful in 3m17spublished / release-is-published (push) Successful in 1m2spublished / release-notes-are-published (push) Successful in 6spublished / published (push) Successful in 0s2026-10-11 19:18:10 +00:00 | 109 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB2 commits, 1 contributor, 49 minutes since 3.5.2.
Features
- npm: name the package after a declared npm package artifact (
1c3e545)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:3.5.3This release also publishes the
3.5and3tags — pull the precision you want to pin.If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:3.5.3Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.5.3/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Image digests
A tag can move; a digest cannot. Pull this exact build:
docker pull docker.io/damianbuho/projectfile-bridge@sha256:5431221cce9780e3ccc1259dc151daf96b444a07c8bb0155ead222a195554dea docker pull kiota.ch/projectfile/bridge@sha256:5431221cce9780e3ccc1259dc151daf96b444a07c8bb0155ead222a195554deaPlatform Digest Size linux/amd64 sha256:f929402782b6480a5c248e8a15d42378e51b2164cf05b6b46ba1bcc77ff676b2242.0 MB (+0.5 MB) Sizes are compressed layer bytes as stored in the registry.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge@sha256:5431221cce9780e3ccc1259dc151daf96b444a07c8bb0155ead222a195554dea cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge@sha256:5431221cce9780e3ccc1259dc151daf96b444a07c8bb0155ead222a195554dea cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge@sha256:5431221cce9780e3ccc1259dc151daf96b444a07c8bb0155ead222a195554dea cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge@sha256:5431221cce9780e3ccc1259dc151daf96b444a07c8bb0155ead222a195554deaFull changes: https://kiota.ch/projectfile/bridge/compare/3.5.1...3.5.3
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- npm: name the package after a declared npm package artifact (
-
3.5.1
StableAll checks were successfulpublished / fetched (push) Successful in 0spublished / projectfile-is-valid (push) Successful in 10spublished / signing-is-ready (push) Successful in 51spublished / source-is-compliant (push) Successful in 1m0spublished / source-is-tested (push) Successful in 31spublished / documentation-passes-lint (push) Successful in 1m31spublished / source-is-secure (push) Successful in 1m29spublished / projectfile-is-ok (push) Successful in 7spublished / source-passes-lint (push) Successful in 3m26spublished / documentation-is-ok (push) Successful in 0spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (amd64, darwin) (push) Successful in 46spublished / binaries-are-built (amd64, linux) (push) Successful in 47spublished / binaries-are-built (arm64, darwin) (push) Successful in 50spublished / binaries-are-built (arm64, linux) (push) Successful in 49spublished / binaries-are-built (riscv64, linux) (push) Successful in 51spublished / image-is-built (amd64) (push) Successful in 2m14spublished / gsa (amd64, darwin) (push) Successful in 10spublished / gsa (amd64, linux) (push) Successful in 10spublished / gsa (arm64, darwin) (push) Successful in 11spublished / gsa (arm64, linux) (push) Successful in 7spublished / gsa (riscv64, linux) (push) Successful in 5spublished / image-has-sbom (amd64) (push) Successful in 15spublished / secrets-ready (push) Successful in 0spublished / binaries-are-ok (push) Successful in 0spublished / image-is-secure (amd64) (push) Successful in 20spublished / images-are-ok (push) Successful in 0spublished / binaries-are-signed (amd64, darwin) (push) Successful in 22spublished / binaries-are-signed (amd64, linux) (push) Successful in 21spublished / binaries-are-signed (arm64, darwin) (push) Successful in 19spublished / binaries-are-signed (arm64, linux) (push) Successful in 20spublished / binaries-are-signed (riscv64, linux) (push) Successful in 24spublished / container-is-ok (push) Successful in 0spublished / container-ready-to-test (push) Successful in 0spublished / container-is-diagnosed (push) Successful in 0spublished / container-is-verified (amd64) (push) Successful in 2m2spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 0spublished / image-is-attested (kiota) (push) Successful in 38spublished / image-is-attested (dockerhub) (push) Successful in 1m8spublished / release-is-published (push) Successful in 54spublished / release-notes-are-published (push) Successful in 5spublished / published (push) Successful in 0s2026-10-08 23:59:15 +00:00 | 138 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB5 commits, 1 contributor, 4 hours since 3.5.0.
Performance
- container: declare M6E_VERSION next to the user stage (
3d74a7d)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:3.5.1This release also publishes the
3.5and3tags — pull the precision you want to pin.If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:3.5.1Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.5.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Image digests
A tag can move; a digest cannot. Pull this exact build:
docker pull docker.io/damianbuho/projectfile-bridge@sha256:80c2da51a250f7b4ab9e5d57dd26368c10d168cc28ef54772811aeade5e34d85 docker pull kiota.ch/projectfile/bridge@sha256:80c2da51a250f7b4ab9e5d57dd26368c10d168cc28ef54772811aeade5e34d85Platform Digest Size linux/amd64 sha256:b1abe18374754b31b7b81bef5885662f37fb8808fe063472c5c579129776b294241.5 MB Sizes are compressed layer bytes as stored in the registry.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge@sha256:80c2da51a250f7b4ab9e5d57dd26368c10d168cc28ef54772811aeade5e34d85 cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge@sha256:80c2da51a250f7b4ab9e5d57dd26368c10d168cc28ef54772811aeade5e34d85 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge@sha256:80c2da51a250f7b4ab9e5d57dd26368c10d168cc28ef54772811aeade5e34d85 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge@sha256:80c2da51a250f7b4ab9e5d57dd26368c10d168cc28ef54772811aeade5e34d85Full changes: https://kiota.ch/projectfile/bridge/compare/3.5.0...3.5.1
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- container: declare M6E_VERSION next to the user stage (
-
3.5.0
StableAll checks were successfulpublished / fetched (push) Successful in 0spublished / projectfile-is-valid (push) Successful in 5spublished / signing-is-ready (push) Successful in 6spublished / source-is-compliant (push) Successful in 10spublished / source-is-tested (push) Successful in 11spublished / projectfile-is-ok (push) Successful in 5spublished / source-is-secure (push) Successful in 22spublished / documentation-passes-lint (push) Successful in 55spublished / documentation-is-ok (push) Successful in 0spublished / source-passes-lint (push) Successful in 53spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (arm64, linux) (push) Successful in 41spublished / binaries-are-built (riscv64, linux) (push) Successful in 41spublished / binaries-are-built (amd64, linux) (push) Successful in 41spublished / binaries-are-built (arm64, darwin) (push) Successful in 41spublished / binaries-are-built (amd64, darwin) (push) Successful in 42spublished / gsa (amd64, linux) (push) Successful in 14spublished / gsa (riscv64, linux) (push) Successful in 15spublished / gsa (arm64, linux) (push) Successful in 15spublished / gsa (arm64, darwin) (push) Successful in 15spublished / gsa (amd64, darwin) (push) Successful in 15spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (arm64, linux) (push) Successful in 26spublished / binaries-are-signed (riscv64, linux) (push) Successful in 26spublished / binaries-are-signed (arm64, darwin) (push) Successful in 26spublished / binaries-are-signed (amd64, linux) (push) Successful in 26spublished / binaries-are-signed (amd64, darwin) (push) Successful in 27spublished / image-is-built (amd64) (push) Successful in 2m3spublished / secrets-ready (push) Successful in 0spublished / images-are-ok (push) Successful in 0spublished / container-is-ok (push) Successful in 0spublished / container-ready-to-test (push) Successful in 0spublished / container-is-diagnosed (push) Successful in 0spublished / image-has-sbom (amd64) (push) Successful in 9spublished / image-is-secure (amd64) (push) Successful in 12spublished / container-is-verified (amd64) (push) Successful in 28spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 0spublished / image-is-attested (amd64, kiota) (push) Successful in 23spublished / image-is-attested (amd64, dockerhub) (push) Successful in 50spublished / binaries-are-released (amd64, darwin) (push) Successful in 5spublished / binaries-are-released (arm64, linux) (push) Successful in 5spublished / binaries-are-released (amd64, linux) (push) Successful in 5spublished / binaries-are-released (arm64, darwin) (push) Successful in 5spublished / binaries-are-released (riscv64, linux) (push) Successful in 5spublished / release-notes-are-published (push) Successful in 8spublished / published (push) Successful in 0s2026-10-08 03:59:47 +00:00 | 144 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB11 commits, 1 contributor, 13 hours since 3.4.1.
Features
- release-notes: pin images by digest and list per-platform digests (
59885fc) - release-notes: show per-platform size change against the previous release (
dd109cf) - release-notes: list package changes from the attested SBOM (
5fae330) - release-notes: configure shown commit sections from the projectfile (
27b5866) - release-notes: attach files named by release.attach to the release (
2886863)
Bug fixes
- assert on a here-string, not a grep -q pipeline (
62a8d75)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:3.5.0This release also publishes the
3.5and3tags — pull the precision you want to pin.If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:3.5.0Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.5.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Image digests
A tag can move; a digest cannot. Pull this exact build:
docker pull docker.io/damianbuho/projectfile-bridge@sha256:77a74012cdba9d3d53185fe3d0e933021d91b555a5c6e0ff57dddfd9fffbda3a docker pull kiota.ch/projectfile/bridge@sha256:77a74012cdba9d3d53185fe3d0e933021d91b555a5c6e0ff57dddfd9fffbda3aPlatform Digest Size linux/amd64 sha256:ff381969ceae4d5ac017e5e9b158eff920f2cd66d1e1b35c70a179197798a48d241.4 MB Sizes are compressed layer bytes as stored in the registry.
Packages since the previous release: 1 updated, 0 added, 0 removed.
- projectfile.org/projectfile/bridge v3.4.1 → v3.5.0
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge@sha256:77a74012cdba9d3d53185fe3d0e933021d91b555a5c6e0ff57dddfd9fffbda3a cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge@sha256:77a74012cdba9d3d53185fe3d0e933021d91b555a5c6e0ff57dddfd9fffbda3a cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge@sha256:77a74012cdba9d3d53185fe3d0e933021d91b555a5c6e0ff57dddfd9fffbda3a cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge@sha256:77a74012cdba9d3d53185fe3d0e933021d91b555a5c6e0ff57dddfd9fffbda3aFull changes: https://kiota.ch/projectfile/bridge/compare/3.4.1...3.5.0
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- release-notes: pin images by digest and list per-platform digests (
