asdf-community / asdf-zig

Zig plugin for the asdf version manager

asdf-zig

Zig plugin for asdf version manager

Build History

Installation

asdf plugin-add zig https://github.com/asdf-community/asdf-zig.git

Usage

Check asdf readme for instructions on how to install & manage versions.

License

Licensed under the Apache License, Version 2.0.

asdf-zig's Issues

Minisign / Signify Cryptographic Verification Missing

Provide environment information

N/A

To Reproduce

N/A

Describe the Bug

Since 0.10.1, Zig releases have been cryptographically signed using https://jedisct1.github.io/minisign/ which I believe is compatible with OpenBSD's signify and the various ports to other systems. The public key, which you can find at either https://github.com/ziglang/zig/releases/tag/0.11.0 or https://github.com/ziglang/zig/releases/tag/0.10.1, is RWSGOq2NVecA2UPNdBUZykf1CCb147pkmdtYxgb3Ti+JO/wCYvhbAb/U. I am not sure if any other asdf plugin has already implemented minisign / signify support yet. I do not recall any "standard" location for the public keys to go, so maybe something asdf-specific, like how we store PGP public keys, in a private, plugin-specific keyring.

Expected Behaviour

Some additional assurance that the binaries downloaded are not tampered with.

Minisign / Signify Cryptographic Verification Missing

Provide environment information

N/A

To Reproduce

N/A

Describe the Bug

Since 0.10.1, Zig releases have been cryptographically signed using https://jedisct1.github.io/minisign/ which I believe is compatible with OpenBSD's signify and the various ports to other systems. The public key, which you can find at either https://github.com/ziglang/zig/releases/tag/0.11.0 or https://github.com/ziglang/zig/releases/tag/0.10.1, is RWSGOq2NVecA2UPNdBUZykf1CCb147pkmdtYxgb3Ti+JO/wCYvhbAb/U. I am not sure if any other asdf plugin has already implemented minisign / signify support yet. I do not recall any "standard" location for the public keys to go, so maybe something asdf-specific, like how we store PGP public keys, in a private, plugin-specific keyring.

Expected Behaviour

Some additional assurance that the binaries downloaded are not tampered with.

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update actions/checkout action to v4
• Update asdf-vm/actions action to v3

Detected dependencies

github-actions

.github/workflows/workflow.yml

• asdf-vm/actions v1
• actions/checkout v3
• asdf-vm/actions v1
• actions/checkout v3
• actions/checkout v3

---

• Check this box to trigger a request for Renovate to run again on this repository

Include nightly versions

The Bash script retrieves https://ziglang.org/download/index.json, which lists the current v11.0-dev.* nightly versions. However, when I run asdf list all zig I only see the stable versions (0.1.1 through 0.10.1).

Could this be changed to also include nightly versions?

Unfortunately, I can't really tell where in the script the filtering happens, otherwise I'd change it myself.