Skip to content

v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Jul 11:59
Immutable release. Only release title and notes can be modified.
v0.2.0
ed774fe
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

  • ed774fe Update dagger pipeline images (#11)
  • 4a26661 Add "envoke vs. direnv" comparison page to the docs site (#16)
  • d13c8d4 Update dependency mkdocs-material to v9.7.7 (#12)
  • 2d926f5 Fix autofix PR push via peter-evans/create-pull-request (#14)
  • 7b63c4f Fix a command injection and a trust TOCTOU, and work through the rest of the review (#15)
  • 7504470 Apply zizmor/actions-up autofix (#13)
  • e18a00a Update dependency yamllint to v1.38.0 (#10)
  • 4b18aa4 Add uninstall documentation per install method (#9)

Install / upgrade

  • Homebrew (macOS/Linux): brew install neirda24/tap/envoke, or brew upgrade envoke if already installed.
  • Scoop (Windows): scoop bucket add neirda24 https://github.com/Neirda24/scoop-bucket, then scoop install envoke, or scoop update envoke if already installed.
  • Debian/Ubuntu: download the .deb from the Assets above and sudo dpkg -i envoke_*.deb.
  • Fedora/RHEL: download the .rpm from the Assets above and sudo rpm -i envoke_*.rpm.
  • Manual download: grab the archive for your OS/arch from the Assets above, extract it, and put envoke on your PATH. Verify against checksums.txt.
  • Go toolchain: go install github.com/Neirda24/envoke/cmd/envoke@v0.2.0

Verifying releases

Each archive ships an SPDX SBOM alongside it (*.sbom.json), generated by syft and hashed in checksums.txt like every other asset — so it inherits the signature below.

checksums.txt is signed keylessly with cosign via GitHub Actions OIDC (Sigstore/Fulcio) — no long-lived signing key exists. checksums.txt.sigstore.json (in Assets above) bundles the signature, signing certificate, and Rekor transparency-log entry. Verify with:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/Neirda24/envoke/\.github/workflows/release\.yml@.*$" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

A successful verification proves checksums.txt (and, transitively, every archive it hashes) was built and signed by this repository's own release.yml workflow, not tampered with in transit.

Assets 21
Loading