Skip to content

v0.1.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jul 17:05
v0.1.2
319e61f
This commit was signed with the committer’s verified signature.
Neirda24 Adrien Roches
SSH Key Fingerprint: PLvLJqhpXRYU6ZO+FYd7TgwdTMTW2JN3Ylvcktf1YGU
Verified
Learn about vigilant mode.

Changelog

  • 319e61f Overhaul contributor and user-facing docs for accuracy and tone
  • d5dfbab Document allow's confirm prompt, diff-on-reallow, and envoke version
  • 903c6c3 Show a diff instead of a full re-dump when re-allowing a changed config
  • 09770ae Merge feature 1: explicit confirm gate on envoke allow
  • cc36942 Make envoke allow actually confirm before trusting a config
  • 712225e Merge feature 5: wire up envoke version with real build info
  • def1127 Wire up version/commit/date ldflags for release builds
  • 8ccbe94 Merge feature 2: persist approved config content in trust store
  • 670d660 Persist approved config content in the trust store for diff-on-allow
  • 546fa51 Replace broad-scope PAT with a scoped GitHub App token for homebrew-tap

Install / upgrade

  • Homebrew (macOS/Linux): brew install neirda24/tap/envoke, or brew upgrade envoke if already installed.
  • Manual download: grab the archive for your OS/arch from the Assets above, extract it, and put envoke on your PATH. Verify against checksums.txt.
  • Go toolchain: go install github.com/Neirda24/envoke/cmd/envoke@v0.1.2

Verifying releases

checksums.txt is signed keylessly with cosign via GitHub Actions OIDC (Sigstore/Fulcio) — no long-lived signing key exists. checksums.txt.sigstore.json (in Assets above) bundles the signature, signing certificate, and Rekor transparency-log entry. Verify with:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/Neirda24/envoke/\.github/workflows/release\.yml@.*$" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

A successful verification proves checksums.txt (and, transitively, every archive it hashes) was built and signed by this repository's own release.yml workflow, not tampered with in transit.

Assets 10
Loading