Version 0.30.3 (2025-12-14)

Release Notes

This release contains a few minor bugfixes. It also updates dependencies, including a rimraf upgrade that resolves a CVE in glob. This vulnerability was not exploitable in the way dist used rimraf.

Fixes

• impl @AThePeanut4 fix: invalid file permissions when running the shell installer under sudo
• impl @ryanobjc fix: macOS codesigning configuration not being respected

Thanks to @zachstence for handling the rimraf/glob upgrade!

Install cargo-dist 0.30.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.3/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.30.3/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/[email protected]

Download cargo-dist 0.30.3

File	Platform	Checksum
cargo-dist-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-dist-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-dist-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.30.2 (2025-10-31)

Release Notes

• When customizing when artifacts are attested, you can now use the announce phase.

Install cargo-dist 0.30.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.2/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.30.2/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/[email protected]

Download cargo-dist 0.30.2

File	Platform	Checksum
cargo-dist-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-dist-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-dist-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.30.2-prerelease.1

Release Notes

• When customizing when artifacts are attested, you can now use the announce phase.

Install cargo-dist 0.30.2-prerelease.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.2-prerelease.1/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.30.2-prerelease.1/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/[email protected]

Download cargo-dist 0.30.2-prerelease.1

File	Platform	Checksum
cargo-dist-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-dist-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-dist-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.30.1 (2025-10-29)

Release Notes

• Bump default x64 macos runners to macos-15-intel (macos-13 is deprecated)
• In order to avoid overly broad permissions, GitHub attestations permissions scope is moved to the job level.
• Don't run host job if plan fails

Install cargo-dist 0.30.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.1/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.30.1/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/[email protected]

Download cargo-dist 0.30.1

File	Platform	Checksum
cargo-dist-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-dist-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-dist-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.30.1-prerelease.2

Release Notes

• Bump default x64 macos runners to macos-15-intel (macos-13 is deprecated)
• In order to avoid overly broad permissions, GitHub attestations permissions scope is moved to the job level.
• Don't run host job if plan fails

Install cargo-dist 0.30.1-prerelease.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.1-prerelease.2/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.30.1-prerelease.2/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/[email protected]

Download cargo-dist 0.30.1-prerelease.2

File	Platform	Checksum
cargo-dist-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-dist-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-dist-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.30.1-prerelease.1

Release Notes

• Bump default x64 macos runners to macos-15-intel (macos-13 is deprecated)
• In order to avoid overly broad permissions, GitHub attestations permissions scope is moved to the job level.
• Don't run host job if plan fails

Install cargo-dist 0.30.1-prerelease.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.1-prerelease.1/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.30.1-prerelease.1/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/[email protected]

Download cargo-dist 0.30.1-prerelease.1

File	Platform	Checksum
cargo-dist-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-dist-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-dist-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.30.0 (2025-09-07)

Release Notes

This release contains several improvements to ZIP archives, the installers and additional build workflow customization options.

ZIP archive improvements

Previous versions of dist produced uncompressed ZIP archives which meant that they were much larger than necessary. ZIP archives are now compressed.

• impl @trim21 feat: enable compression on zip

In previous versions, ZIP archives were only suitable for Windows binaries because they didn't preserve executable permissions. ZIP archives now correctly preserve extended Unix permissions.

• impl @mistydemeo fix: preserve Unix permissions in ZIPs

The npm installer previously used the unzip commandline utility to unpack ZIP archives on Windows. This isn't available in all installations, so some users would experience errors at install time. We've improved this by switching to the builtin PowerShell Expand-Archive cmdlet.

• impl @jacobtread
  • fix: windows use powershell to extract zip file
  • fix: platform.includes bug

Additional installer configuration environment variables

dist's installers are configurable using a variety of different environment variables, but in previous versions only some of these would be branded with your app's name. We now provide branded versions of all of the other environment variables as well. The previous unbranded environment variables will continue to work. The new variables are:

• ${APP_NAME}_DOWNLOAD_URL
• ${APP_NAME}_PRINT_QUIET
• ${APP_NAME}_PRINT_VERBOSE

• impl @Gankra
  • make every last INSTALLER_ variable have a branded version
  • support {BRAND}_DOWNLOAD_URL in ps1 installer

This feature previously appeared in version 0.28.7 of Astral's fork.

Shell installer refuses to use Snap-installed curl

The shell installers will now refuse to fetch archives using a copy of curl installed via the Snap package manager for Ubuntu. Snap-installed copies of curl have limitations on their ability to write downloaded files to disk which makes them unsuitable for dist's installers. If a Snap-installed curl is detected, the installer will try to fall back to using another download tool; if no other tool is present, a message will be shown to the user and the installation will abort.

• impl @konstin Avoid snap curl

This feature previously appeared in version 0.28.5 of Astral's fork.

PowerShell installer now supports proxies

The PowerShell installer now respects the HTTPS_PROXY and ANY_PROXY environment variables and uses them to configure a proxy when fetching artifacts. These were already supported by the shell installer.

• impl @zanieb and @zsol Powershell installer: respect HTTPS_PROXY and ANY_PROXY env vars

macOS code signing now supports the --options flag

When using the experimental macOS codesigning feature, users can now specify a value to be passed to the --options flag using the CODESIGN_OPTIONS environment variable.

• impl @jackkleeman Support --options in mac code signing

Linux arm64 GitHub Actions builds now use native arm64 runners by default

In previous versions of dist, we used cross-compilation to build arm64 Linux binaries from an x86_64 host. GitHub now provides free native arm64 runners, so we've switched to using these by default. Users can still use cross-compilation if they prefer by specifying the x86_64 runners using the custom runners feature in the dist config.

GitHub Actions artifact attestations can now be customized

It's now possible to customize exactly which artifacts are attested, and which phase of the build process to perform the attestations in. Currently, customizing which artifacts to attest requires the attestation to happen during the host phase; this restriction may be lifted in the future.

To specify which artifacts to attest, you can use a list of globs; any artifacts matching any of those globs will receive an attestation. For example:

github-attestations-phase = "host"
github-attestations-filters = ["*.json", "*.sh", "*.ps1", "*.zip", "*.tar.gz"]

• impl @samypr100 Add support for attestations in the host phase

Install cargo-dist 0.30.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.0/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.30.0/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/[email protected]

Download cargo-dist 0.30.0

File	Platform	Checksum
cargo-dist-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-dist-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-dist-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.30.0-prerelease.5

Release Notes

• Add support for GitHub Attestations in the host phase.

Install cargo-dist 0.30.0-prerelease.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.0-prerelease.5/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.30.0-prerelease.5/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/[email protected]

Download cargo-dist 0.30.0-prerelease.5

File	Platform	Checksum
cargo-dist-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-dist-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-dist-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.30.0-prerelease.4

Release Notes

• Add support for GitHub Attestations in the host phase.

Install cargo-dist 0.30.0-prerelease.4

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.0-prerelease.4/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.30.0-prerelease.4/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/[email protected]

Download cargo-dist 0.30.0-prerelease.4

File	Platform	Checksum
cargo-dist-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-dist-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-dist-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.30.0-prerelease.3

Release Notes

• Add support for GitHub Attestations in the host phase.

Install cargo-dist 0.30.0-prerelease.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.0-prerelease.3/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.30.0-prerelease.3/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/[email protected]

Download cargo-dist 0.30.0-prerelease.3

File	Platform	Checksum
cargo-dist-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-dist-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-dist-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>