Skip to content

v0.1.1

Choose a tag to compare

View all tags
@Neirda24 Neirda24 released this 16 Jul 12:50
v0.1.1
c0f2281
This commit was signed with the committer’s verified signature.
Neirda24 Adrien Roches
SSH Key Fingerprint: PLvLJqhpXRYU6ZO+FYd7TgwdTMTW2JN3Ylvcktf1YGU
Verified
Learn about vigilant mode.

Changelog

  • c0f2281 Fix release.yml: correct Dagger CLI flag names for Publish's OIDC params
  • fa13d21 Merge branch 'main' of github.com:Neirda24/envoke
  • 79dfc6e Check in a reusable zero-skip shellinit verification script
  • f73d087 Harden release chain: sign checksums.txt, document PAT/quarantine tradeoffs
  • 8c3b977 Add zsh/fish/powershell behavioral shell-hook tests
  • d122ad6 Show config script before trust, warn on unsafe config permissions
  • 96f85c9 Merge pull request #5 from Neirda24/renovate/major-dagger-pipeline-images
  • e643879 Update Node.js to v24
  • aadc8d7 Authenticate zizmor/actions-up in CI to fix rate-limit failures
  • b253782 Merge pull request #3 from Neirda24/renovate/dagger-pipeline-images
  • ffc041f Disable Renovate for .dagger/go.mod
  • a45f86a Update dagger pipeline images
  • ade96fb Add Renovate config and a daily zizmor/actions-up autofix workflow
  • 83a26ba Fix ci.yml: use dagger-for-github's check input, not call: check
  • 79f76ed Add zizmor and actions-up CI maintenance, wire dagger check into GitHub Actions
  • a458d0f Note old Formula/envoke.rb cleanup in homebrew-tap
  • cdd2ff0 Document v0.1.0 reset and regeneration with casks + footer

Install / upgrade

  • Homebrew (macOS/Linux): brew install neirda24/tap/envoke, or brew upgrade envoke if already installed.
  • Manual download: grab the archive for your OS/arch from the Assets above, extract it, and put envoke on your PATH. Verify against checksums.txt.
  • Go toolchain: go install github.com/Neirda24/envoke/cmd/envoke@v0.1.1

Verifying releases

checksums.txt is signed keylessly with cosign via GitHub Actions OIDC (Sigstore/Fulcio) — no long-lived signing key exists. checksums.txt.sigstore.json (in Assets above) bundles the signature, signing certificate, and Rekor transparency-log entry. Verify with:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/Neirda24/envoke/\.github/workflows/release\.yml@.*$" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

A successful verification proves checksums.txt (and, transitively, every archive it hashes) was built and signed by this repository's own release.yml workflow, not tampered with in transit.

Assets 10
Loading