Skip to content

v0.1.0-rc3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Sep 01:05
· 32 commits to main since this release
v0.1.0-rc3
ec3db02

Superseded by v0.1.0, which is the same code with the release promoted. Use v0.1.0.

Changelog

Fixes

  • 4d794f3 fix(action): a commit SHA starting with a digit was accepted as a version
  • 03c5a1c fix(action): the action could not run on a pull request at all
  • ec3db02 fix(action): the baseline could never suppress anything

Verifying this release

Every binary is checksummed and signed keyless. The signature is
bound to this repository's workflow identity and recorded in the
public Rekor transparency log, so it can be verified by anyone
without trusting anything GitHub says.

Download the binary for your platform, plus its .pem and .sig,
and the checksum file. Then, from that directory:

# 1. Checksums. Verifies every binary present in this directory
#    against scram_0.1.0-rc3_checksums.txt. If you downloaded
#    only one platform, the lines for the others report "No such
#    file" -- that is expected, and is not a verification failure.
shasum -a 256 -c scram_0.1.0-rc3_checksums.txt
#    (Linux: sha256sum -c scram_0.1.0-rc3_checksums.txt)

# 2. Signature. Replace the platform suffix with yours:
#    darwin-arm64, darwin-amd64, linux-amd64, linux-arm64, or
#    windows-amd64.exe
cosign verify-blob \
  --certificate scram_0.1.0-rc3-linux-amd64.pem \
  --signature    scram_0.1.0-rc3-linux-amd64.sig \
  --certificate-identity-regexp 'https://github.com/0xsan7/SCRAM/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  scram_0.1.0-rc3-linux-amd64

Success prints Verified OK. A signature from a different
repository is rejected with none of the expected identities matched what was in the certificate.

The certificate's identity is
https://github.com/0xsan7/SCRAM/.github/workflows/ci.yml@refs/tags/v0.1.0-rc1,
which is what ties the binary to this specific tag.

Built from commit ec3db02.

What is in this binary

The CycloneDX and SPDX SBOMs ship as release assets alongside these
binaries, generated by this project's own code from this
repository. They list every module in the released binary's own
dependency graph, so you can enumerate exactly what shipped without
rebuilding or re-running anything.

Assets 20
Loading