Releases can now say where they came from — and this one does.

Source linking

A release can pin the git commit and annotated tag it was cut from, right in the immutable record. publish --tag v0.3.0 reads both hashes from your local checkout; since git is content-addressed, the tag object hash transitively pins the entire source tree. Names are labels, hashes are truth: force-moving a tag never moves a published claim.

Set your repository once with the new disttown project set --source, and every release inherits it. When the source is a record in your own atproto repo — a Tangled repository — the association is signed by the same key as the release itself, and release pages badge it same-repo. This is honest verification: it proves association, not build provenance.

Tangled artifacts are first-class

If your CI uploads artifacts to Tangled, dist.town now treats them as locations rather than rivals:

At publish time, tag-matched Tangled artifacts are offered for attachment (--attach-tangled for CI). The CLI downloads and hashes every blob locally — each digest in your release is your own measurement, never the forge's claim.
Afterward, any Tangled upload whose bytes match a declared digest becomes an additional verified download location, including for releases published before the upload existed.
Uploads that match nothing appear under an explicit "not in the record" caveat — visible, and honestly unverified.

Windows builds

This is the first release with Windows artifacts (amd64 and arm64, as zip archives), alongside Linux and macOS. The CLI is pure Go, so the whole matrix cross-compiles from one machine — tools/dist.sh in the repo is the two-line recipe. disttown --version now exists, stamped at build time.

Also

Release pages show the source claim in the record rail: repo, tag, and commit, with copy-to-clipboard hashes.
project set updates a project's display name, description, source, and website — only the flags you pass change.

Latest

0.3.0 — releases that say where they came from