← Back to blog

opentine v0.16.2: a simpler front door to agent provenance

0xcircuitbreaker··5 min read

opentine v0.16.2 is now published on GitHub and PyPI. It makes the CLI easier to navigate while preserving the commands existing scripts already use.

A smaller front door

tine --help presents everyday commands by section. tine help --all lists the full surface, and tine help COMMAND opens one command's help. Advanced commands remain available.

Related operations now share a group:

  • tine repo for repository setup, storage, and integrations.
  • tine share for transport, bundles, and archives.
  • tine trust for signing, claims, and verification policies.
  • tine agent for identity and action queries.
tine repo storage du --json
tine agent who --program git --since 7d --json
tine share bundle verify review.tinebundle

Group spellings reach the existing handlers. Old commands keep their arguments, output, and exit behavior; a pinned compatibility table guards existing invocations.

Name the roots you trust

Named policies store verification roots in user configuration outside every repository. A policy can provide a public key or pin, receipt requirement, Rekor key, expected keyless identity and issuer, and Fulcio roots.

tine trust policy set prod --pubkey ~/keys/release.pub
tine verify result.tine --attestation result.intoto.jsonl --policy prod --json

Explicit flags override the policy. An optional user default applies only when verification has no explicit policy or trust options; --no-policy bypasses it. A repository cannot define or select trust roots, and unsafe policy files fail closed.

Small fixes that matter in automation

Plain tine verify FILE recognizes a bundle when no other arguments are supplied. Repository tine show REF --json preserves JSON output instead of silently selecting human rendering.

The release also fixes two storage races: retrying Windows sharing violations during GC removal and rescanning pack listings during concurrent merges before declaring an object missing.

v0.16.0 and v0.16.1 were not published; v0.16.2 is the first published release containing this work. Existing storage compatibility boundaries remain unchanged.

python -m pip install --upgrade "opentine==0.16.2"

Read the upgrade guide, trust-policy guide, and official command mapping.