Version 0.30.3 (2025-12-14)

Release Notes

This release contains a few minor bugfixes. It also updates dependencies, including a rimraf upgrade that resolves a CVE in glob. This vulnerability was not exploitable in the way dist used rimraf.

Fixes

• impl @AThePeanut4 fix: invalid file permissions when running the shell installer under sudo
• impl @ryanobjc fix: macOS codesigning configuration not being respected

Thanks to @zachstence for handling the rimraf/glob upgrade!

Install cargo-dist 0.30.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.3/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.30.3/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/dist@0.30.3

Download cargo-dist 0.30.3

File	Platform	Checksum
cargo-dist-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-dist-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-dist-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>