mlm is a personal-use CLI tool. This document explains how to report
security issues and how to verify that a release binary is authentic.
Please report security issues privately by emailing magikmw@michalwalczak.eu. Do not open a public issue or disclose the problem publicly until it has been addressed.
There is no bug bounty program — reports are appreciated, but no monetary reward is offered.
Only the latest released version is supported. Please update to the latest release before reporting an issue, and expect fixes to land only in new releases rather than backports to older ones.
Release binaries are signed with minisign.
The public key is committed in Cargo.toml
([package.metadata.binstall.signing]):
RWTNO3Iugq4ICzcJhLwnwtOT1T0evn7RYI0951dfE+IkEyRykSvv0V/n
If you install with cargo binstall, verification happens automatically
using that key. To verify a manually downloaded archive, fetch its matching
.sig file from the release page
and run:
minisign -Vm mlm-<target>.tar.xz -P RWTNO3Iugq4ICzcJhLwnwtOT1T0evn7RYI0951dfE+IkEyRykSvv0V/nSee docs/SIGNING.md for the full signing setup, including CI details and
key-rotation procedure.