release: cargo-binstall v0.13.0

[github-actions]

This is a release PR for cargo-binstall version 0.13.0 (performing a minor bump).

Use squash merge.

Upon merging, this will automatically create the tag v0.13.0, build the CLI, and create a GitHub release.
You will still need to manually publish the cargo crate:

$ git switch main
$ git pull
$ git switch --detach v0.13.0
$ cargo publish -p cargo-binstall

To trigger builds initially, close and then immediately re-open this PR once.

---

Edit release notes into the section below:

Release notes

Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for cargo install in most cases. Install it today with cargo install cargo-binstall, from the binaries below, or if you already have it, upgrade with cargo binstall cargo-binstall.

In this release:

• Binstall now aggressively scans the remote for a download URL if not given exact details in the metadata:

  • the filename is guessed from a wider range of version/name/target combinations (Support other git hosting services #296, Explode out even more variants of default download URLs #329)
  • the version can be with or without preceding v (Consider extending pkg-url to relax version component requirements #328)
  • the file extension can be any of the standard extensions for the supported archive formats (Make PkgFmt::pkg_fmt an Option? #295, Auto detect pkg_fmt #310)

  This means that many more packages will install out of the box without needing configuration.

• Binstall now also tries to guess the download URL for other repositories than GitHub: GitLab, BitBucket, and SourceForge. (Support other git hosting services #296, Test default pkg-url for GitLab and BitBucket #322, Trim trailing slash from repo #360)

• Downloads can now only be done over HTTPS, with TLS 1.2 or over. This also deprecates the --secure option, which enabled this; for compatibility it is still accepted but will do nothing. (Only https for requests #124, Deprecate --secure, enforce HTTPS #343)

• The source has been broken up into several crates. There are the single-purpose libraries detect-targets, detect-wasi, fs-lock, normalize-path (all licensed as Apache/MIT); and the "binstall library/toolkit", binstalk (GPL). The main interface remains the tool itself, cargo-binstall. (Split crates and clean up structure of codebase #294, Refactor: Extract new crate detect-targets and improve code quality #307, Adapt release workflow for workspace #331, Rename flock to fs-lock #338, Rename lib to binstall-lib #341, Name of lib #359, Rename lib to binstalk #361)

Other changes:

• Fix regression where we would prompt even if there was nothing to do. (Confirmation when nothing to do? #291, Don't prompt if there's nothing to do #293)
• Improve an error message when an expected file is not found in the downloaded package. (Improve err msg when source is missing in BinFile::install_bin #301)
• Use Trust DNS for hostname resolution. (Add new feature trust-dns to lib & bin #318, Ignore trust_dns log output #323)
• Use rustls on all platforms. This notably makes it easier to install on Windows, but also provides consistent TLS 1.3 support everywhere. (Add new feature trust-dns to lib & bin #318)
• Use cargo-bins/release-pr for the release process. (Use release PR action #330, Fix release PR template #336, Add important usage note for triggering builds to release template #345, Improve release-pr usage #350, Update release-pr config #364)
• Recommend taiki-e/install-action as the way to use Binstall in CI. (Recommend taiki-e/install-action #342)
• Installing via cargo install cargo-binstall no longer tries to use the high performance zlib-ng, which was causing compile issues on Windows. Instead the pure Rust miniz-oxide implementation is used. Pre-built binaries still use zlib-ng, so do a cargo binstall cargo-binstall immediately after installing from source to get it. (Disable zlib-ng for the default cargo-install build #354)
• We've forked a couple of crates to apply fixes to them: jobserver (as jobslot), tar (as binstall-tar).
• The tar fork includes support for PAX, which fixes a longstanding and very annoying bug seen occasionally where a package would fail to install with a confusing error. We hope to upstream the fix, this is not meant to be a permanent fork. (Tracking of upstream bug in tar #177, Bug: Extracting tar failed due to GNU Sparse File extension not properly supported alexcrichton/tar-rs#295, Do not use gnu sparse extension please! cargo-quickinstall#87, Improve err msg when source is missing in BinFile::install_bin #301, Fix tar by temporarily using a fork #358)
• Various minor optimisations. (Optimize GhCrateMeta::find: use FuturesUnordered #321, Use BTreeMap in field PkgMeta::overrides #324, Optimize drivers::crates_io::Vfs: Use BTreeMap #325)
• The crates.io API calls now share the same HTTP client as the rest of Binstall; this notably enforces HTTPS and TLS version policies globally. (Reuse reqwest client in crates_io_api::AsyncClient #349)
• Many dependency updates: clap, miette, serde, and others (Bump serde from 1.0.142 to 1.0.143 #297, Bump futures-util from 0.3.21 to 0.3.23 #298, Bump clap from 3.2.16 to 3.2.17 #299, Bump miette from 5.2.0 to 5.3.0 #300, Update compact_str requirement from 0.5.2 to 0.6.0 in /crates/lib #308)

[passcod]

@NobodyXu have I forgotten anything for the release notes?

[NobodyXu]

@NobodyXu have I forgotten anything for the release notes?

• crates_io_api now reuses reqwest::Client, which means that the TLS setting and https only setting will also be obeyed when accessing crates.io
• minor optimization: f973d32 , 7f9ad61 and 16b16c4
• We got quite some dep bump https://github.com/cargo-bins/cargo-binstall/commits?author=dependabot%5Bbot%5D
• Regarding the tar, we could mention that the fork we use supports PAX, now more crates can be installed instead of generating a strange error

[passcod]

Thank you! how's this now?

[NobodyXu]

Thank you! how's this now?

LGTM

[NobodyXu]

Emmm, Package and Release failed