38 releases 47 tags

RSS feed

• v4.0.1 693e42b909

  Compare

  v4.0.1 Stable

  damian-buho released this 2026-10-15 04:58:12 +00:00 | 70 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  1 commit, 1 contributor, 29 minutes since v4.0.0.

  Highlights

  The pf-bridge-bridges-<version>-<os>-<arch>.tar.gz archives announced in v4.0.0 are not published. The single-bridge binaries in them weighed about 130 MB per platform, eight times the standalone pf-bridge-<os>-<arch>, which already includes every bridge. Download that one binary; to get the single-bridge binaries, build them from source.

  Bug fixes

  • release: publish the standalone binary only, without the bridges archive (27d3e44)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-bridge:v4.0.1
  

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/bridge:v4.0.1
  

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/v4.0.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-bridge
  ~/.local/bin/pf-bridge --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  Usage

  pf-bridge

  $ pf-bridge --help
  pf-bridge — keep every project file in sync with your projectfile document
  
  A projectfile (projectfile.yaml) is the single source of truth for a project:
  identity, people, links, and tool config. pf-bridge copies that data out
  into the files each tool already reads — README.md, package.json,
  CITATION.cff, forge settings — and reads two-way files back.
  Spec: https://projectfile.org/specification/
  
  Usage:
    pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
    pf-bridge all [flags]       update every file from the projectfile [rw]
    pf-bridge check [flags]     verify declared files match, write nothing [ro]
    pf-bridge to all            write projectfile out to every file [rw]
    pf-bridge from all          read every two-way file back in [rw]
    pf-bridge --list            list installed bridges
    pf-bridge completion SHELL  print completion script (bash|zsh|fish)
  
  [rw] updates files, [ro] only reads or compares. `check` without names
  covers the bridges this project declares; `check <name>…` narrows it,
  `check --all` covers every installed bridge instead.
  
  Shared flags (also accepted after a bridge name):
    --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
    --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
    Drift warns by default; --fail-on-drift makes it fatal.
  
  Tools:
    cache                Manage the local SPDX and include cache
    forge                Push projectfile metadata out to the repository forge
    init                 Scaffold a new projectfile document (prefer pf-cli init)
    release-notes        Render release notes from git
    scan                 Run scanners to refresh projectfile metadata from filesystem signals
  Package manifests:
    composer   [rw]  composer.json — two-way sync
    npm        [rw]  package.json — two-way sync
    pyproject  [rw]  pyproject.toml — two-way sync
    shard      [rw]  shard.yml — two-way sync
  Citation and ownership:
    cff          [rw]  CITATION.cff — two-way sync
    codeowners   [rw]  CODEOWNERS — two-way sync
    funding      [ro]  FUNDING.yml — one-way render
    fundingjson  [ro]  funding.json — one-way render
  Documentation:
    ai-policy     [ro]  AI_POLICY.md — one-way render
    coc           [ro]  CODE_OF_CONDUCT.md — one-way render
    contributing  [ro]  CONTRIBUTING.md — one-way render
    dei           [ro]  DEI.md — one-way render
    fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
    readme        [ro]  README.md — one-way render
    security      [ro]  SECURITY.md — one-way render
    support       [ro]  SUPPORT.md — one-way render
  Repository setup:
    browserslist     [ro]  .browserslistrc — one-way render
    gitattributes    [ro]  .gitattributes — one-way render
    ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
    license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
    releaserc        [ro]  .releaserc.yaml — one-way render
    vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
    yamllint         [ro]  .yamllint — one-way render
  
  Help per bridge: pf-bridge <bridge> --help
  

  Examples and every command’s help are in Usage.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge:v4.0.1
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge:v4.0.1
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge:v4.0.1
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge:v4.0.1
  

  Prebuilt binary

  The signature proves the binary is the one the maintainer’s release key signed.

  gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
  curl --fail --location --output pf-bridge.asc https://kiota.ch/projectfile/bridge/releases/download/v4.0.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc
  gpg --verify pf-bridge.asc pf-bridge
  

  Download via BitTorrent

  Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

  • 🧲 projectfile-bridge-v4.0.1

  Full changes: https://kiota.ch/projectfile/bridge/compare/3.7.0...v4.0.1

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-bridge-darwin-arm64
    0 downloads · 2026-10-15 05:19:34 +00:00 · 16 MiB
  • pf-bridge-darwin-arm64.asc
    0 downloads · 2026-10-15 05:19:34 +00:00 · 228 B
  • pf-bridge-darwin-x86_64
    0 downloads · 2026-10-15 05:19:35 +00:00 · 18 MiB
  • pf-bridge-darwin-x86_64.asc
    0 downloads · 2026-10-15 05:19:35 +00:00 · 228 B
  • pf-bridge-linux-aarch64
    0 downloads · 2026-10-15 05:19:36 +00:00 · 16 MiB
  • pf-bridge-linux-aarch64.asc
    0 downloads · 2026-10-15 05:19:36 +00:00 · 228 B
  • pf-bridge-linux-riscv64
    0 downloads · 2026-10-15 05:19:36 +00:00 · 15 MiB
  • pf-bridge-linux-riscv64.asc
    0 downloads · 2026-10-15 05:19:37 +00:00 · 228 B
  • pf-bridge-linux-x86_64
    0 downloads · 2026-10-15 05:19:37 +00:00 · 17 MiB
  • pf-bridge-linux-x86_64.asc
    0 downloads · 2026-10-15 05:19:37 +00:00 · 228 B
  • pf-bridge-SHA256SUMS
    0 downloads · 2026-10-15 05:19:33 +00:00 · 448 B
  • pf-bridge-SHA256SUMS.asc
    0 downloads · 2026-10-15 05:19:34 +00:00 · 228 B
  • projectfile-bridge-v4.0.1.magnet
    1 download · 2026-10-15 05:19:38 +00:00 · 192 B
  • projectfile-bridge-v4.0.1.torrent
    0 downloads · 2026-10-15 05:19:38 +00:00 · 14 KiB