v1.0.2

Release notes are in CHANGELOG.md — read the
Needs action section before upgrading.

Note on the README.md inside these archives. It names
postern_1.0.1_linux_amd64.tar.gz and fetches it through
releases/latest/download/, so that one command returns 404. The fix was
committed after this tag was cut. Nothing else in the archive is affected —
the binary, the checksums and the signature are the ones 1.0.2 published.
Use the commands below, or the ones on
the install page.

Verifying what you downloaded

Signature first, then checksum — that order is the point. The signature is
what makes checksums.txt worth trusting; a checksum read out of an
unverified file only proves the archive and the checksum arrived together.

checksums.txt is signed with cosign
keyless signing, so there is no public key to trust — the signature is tied
to this repository, this workflow and this tag:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.bundle \
  --certificate-identity-regexp '^https://github\.com/Warewave-Technology/postern/\.github/workflows/release\.yml@refs/tags/v1\.0\.2$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Needs cosign v3 or later — that is the version this signature is produced
with, and the bundle format is its default. Only once it prints
Verified OK does the checksum mean anything:

sha256sum -c checksums.txt --ignore-missing

To see which dependency versions a binary was built with — the question
that matters when an advisory lands:

go version -m ./postern