v0.1.0

Changelog

Verifying this release

Every binary is checksummed and signed keyless. The signature is
bound to this repository's workflow identity and recorded in the
public Rekor transparency log, so it can be verified by anyone
without trusting anything GitHub says.

Download the binary for your platform, plus its .pem and .sig,
and the checksum file. Then, from that directory:

# 1. Checksums. Verifies every binary present in this directory
#    against scram_0.1.0_checksums.txt. If you downloaded
#    only one platform, the lines for the others report "No such
#    file" -- that is expected, and is not a verification failure.
shasum -a 256 -c scram_0.1.0_checksums.txt
#    (Linux: sha256sum -c scram_0.1.0_checksums.txt)

# 2. Signature. Replace the platform suffix with yours:
#    darwin-arm64, darwin-amd64, linux-amd64, linux-arm64, or
#    windows-amd64.exe
cosign verify-blob \
  --certificate scram_0.1.0-linux-amd64.pem \
  --signature    scram_0.1.0-linux-amd64.sig \
  --certificate-identity-regexp 'https://github.com/0xsan7/SCRAM/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  scram_0.1.0-linux-amd64

Success prints Verified OK. A signature from a different
repository is rejected with none of the expected identities matched what was in the certificate.

The certificate's identity is
https://github.com/0xsan7/SCRAM/.github/workflows/ci.yml@refs/tags/v0.1.0-rc1,
which is what ties the binary to this specific tag.

Built from commit de903ac.

What is in this binary

The CycloneDX and SPDX SBOMs ship as release assets alongside these
binaries, generated by this project's own code from this
repository. They list every module in the released binary's own
dependency graph, so you can enumerate exactly what shipped without
rebuilding or re-running anything.