v0.1.2

• Release pipeline: .github/workflows/release.yml builds x86_64 and
  aarch64 Linux binaries on GitHub's runners, runs the full test suite on
  each, and publishes them with an OpenSSH-signed MANIFEST.txt (Ed25519,
  public key in release-signing-key.pub / allowed_signers), a CycloneDX
  1.5 SBOM per binary, an OpenVEX document and the verifier script. cargo audit --deny warnings gates the release. Verify steps in RELEASING.md.
• No tracer or verifier changes.

Verify

Every asset is listed with its SHA-256 in MANIFEST.txt, and the manifest is signed
with the Ed25519 key in release-signing-key.pub (OpenSSH signature, namespace file).
From a clone of this repository, with the assets downloaded into release/:

ssh-keygen -Y verify -f allowed_signers -I effect-tracer-release -n file \
  -s release/MANIFEST.txt.sig < release/MANIFEST.txt
(cd release && sha256sum --ignore-missing -c MANIFEST.txt)

Details, including the key fingerprint, in RELEASING.md.

Assets

0fdfea38de4bc273eef61a0bcf95d2e94b6388a20afa5997d8f5c6d08a626775  allowed_signers
8903e324b3b31fc3356fc44598f995971f8e30e00336dfdb5edf99418d886d09  effect-tracer-v0.1.2-aarch64-unknown-linux-gnu.cdx.json
180e55832c7f5570ee0924e4012eb8d03ec742861508fa09f715d08cdf784d89  effect-tracer-v0.1.2-aarch64-unknown-linux-gnu.tar.gz
58fd549240d4351530046a6923d22a4b155dbcebfd797a5edd3c32eab5cb6a6b  effect-tracer-v0.1.2-x86_64-unknown-linux-gnu.cdx.json
b8323df9863eda11d9c6da77694fb5e1cf3da3ddee7fa595608b42724d349622  effect-tracer-v0.1.2-x86_64-unknown-linux-gnu.tar.gz
f0fb3750691414c0c9fe3046ea1aefd07072878289a98c28e49e65a993b7f13a  release-signing-key.pub
3b55e0f20153b4fc8f07a2a21f7977af11beb0f869b0fc412cc2c62e4aebde35  verify_ledger.py
a5f8336c3bc72a5e5207ffe6907be52a935a1cdc14eb18e48aeb4178800f9e41  vex.openvex.json