Skip to content

v2.2.1

Latest
Latest

Choose a tag to compare

View all tags
@hllvc hllvc released this 06 Aug 22:57
v2.2.1
4059335
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

  • 2dc640229d26bd5a26cebbf663d443a96a82eb74 fix: take version from the release tag and sign releases with cosign (#2)

Verifying this download

Check the archive against the checksums file, then confirm that file came
from StackGuardian's release pipeline rather than from whoever served it
to you:

cosign verify-blob sg-cli_2.2.1_checksums.txt \
  --certificate sg-cli_2.2.1_checksums.txt.pem \
  --signature sg-cli_2.2.1_checksums.txt.sig \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/StackGuardian/sg-cli-v2/\.github/workflows/release\.yml@refs/tags/'

The signing is keyless, so the certificate names the workflow and tag that
built the release rather than a key someone has to keep.

Assets 11
Loading