Skip to content

v0.1.0-rc2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Sep 00:41
· 35 commits to main since this release
v0.1.0-rc2
5c17745

Known broken — superseded by v0.1.0. Do not use.

Changelog

Fixes

  • 5c17745 fix(action): the output directory was never created, and a crash was reported as a policy failure
  • 6802f79 fix(action): the v0.1.0-rc1 action could not run at all

Other

  • a0cb565 release: publish correctly, and fix instructions that verify nothing

Verifying this release

Every binary is checksummed and signed keyless. The signature is
bound to this repository's workflow identity and recorded in the
public Rekor transparency log, so it can be verified by anyone
without trusting anything GitHub says.

Download the binary for your platform, plus its .pem and .sig,
and the checksum file. Then, from that directory:

# 1. Checksums. Verifies every binary present in this directory
#    against scram_0.1.0-rc2_checksums.txt. If you downloaded
#    only one platform, the lines for the others report "No such
#    file" -- that is expected, and is not a verification failure.
shasum -a 256 -c scram_0.1.0-rc2_checksums.txt
#    (Linux: sha256sum -c scram_0.1.0-rc2_checksums.txt)

# 2. Signature. Replace the platform suffix with yours:
#    darwin-arm64, darwin-amd64, linux-amd64, linux-arm64, or
#    windows-amd64.exe
cosign verify-blob \
  --certificate scram_0.1.0-rc2-linux-amd64.pem \
  --signature    scram_0.1.0-rc2-linux-amd64.sig \
  --certificate-identity-regexp 'https://github.com/0xsan7/SCRAM/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  scram_0.1.0-rc2-linux-amd64

Success prints Verified OK. A signature from a different
repository is rejected with none of the expected identities matched what was in the certificate.

The certificate's identity is
https://github.com/0xsan7/SCRAM/.github/workflows/ci.yml@refs/tags/v0.1.0-rc1,
which is what ties the binary to this specific tag.

Built from commit 5c17745.

What is in this binary

The CycloneDX and SPDX SBOMs ship as release assets alongside these
binaries, generated by this project's own code from this
repository. They list every module in the released binary's own
dependency graph, so you can enumerate exactly what shipped without
rebuilding or re-running anything.

Assets 20
Loading