v1.0.1

Release notes are in CHANGELOG.md — read the
Needs action section before upgrading.

Verifying what you downloaded

Checksums:

sha256sum -c checksums.txt --ignore-missing

The checksums file is signed with cosign
keyless signing, so there is no public key to trust — the signature is
tied to this repository and this workflow:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.bundle \
  --certificate-identity-regexp '^https://github\.com/Warewave-Technology/postern/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Needs cosign v3 or later — that is the version this signature is
produced with, and the bundle format is its default.

To see which dependency versions a binary was built with — the
question that matters when an advisory lands:

go version -m ./postern