v1.1.2

Reproducible cross-target build, verified by two independent CI runners per target (issue #172).
Signed keylessly with cosign (Fulcio + Rekor) and carries SLSA Build L3 provenance (issue #173).
SBOM in both CycloneDX and SPDX formats (issue #174).
OCI image (linux/amd64 only for now -- linux/arm64 temporarily dropped, see release.yml's own comment on why), also cosign-signed: ghcr.io/agent-wkp/wkp@sha256:22eb7ef67fd8d62ede86697fc0ef5bf414bb3abf18771db5d7c9b0ac11dae036 (issue #176).
--sandbox podman image (issue #229), same repository tagged v1.1.2-sandbox, also cosign-signed: ghcr.io/agent-wkp/wkp@sha256:447239cdcc5f491b6af7c57711d12c544780baa2d0d9747918aeb817d7351966.

Verify a binary's signature:

cosign verify-blob --bundle wkp-<target>.bundle \
  --certificate-identity-regexp '^https://github\.com/agent-wkp/wkp/\.github/workflows/release\.yml@.*$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  wkp-<target>

Left as a draft: this workflow alone isn't all of M6 (design 9.6) -- a human decides when this is actually published.

v1.1.1

Reproducible cross-target build, verified by two independent CI runners per target (issue #172).
Signed keylessly with cosign (Fulcio + Rekor) and carries SLSA Build L3 provenance (issue #173).
SBOM in both CycloneDX and SPDX formats (issue #174).
OCI image (linux/amd64 only for now -- linux/arm64 temporarily dropped, see release.yml's own comment on why), also cosign-signed: ghcr.io/agent-wkp/wkp@sha256:e8d22162b317e9d676154d83f7bd709368a75774bab9da8b6eb4c7f7984cafbe (issue #176).
--sandbox podman image (issue #229), same repository tagged v1.1.1-sandbox, also cosign-signed: ghcr.io/agent-wkp/wkp@sha256:86e13cd623202dc9e00a9d6378ebfd130c9ad80249a91e247b481d9d80523f37.

Verify a binary's signature:

cosign verify-blob --bundle wkp-<target>.bundle \
  --certificate-identity-regexp '^https://github\.com/agent-wkp/wkp/\.github/workflows/release\.yml@.*$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  wkp-<target>

Left as a draft: this workflow alone isn't all of M6 (design 9.6) -- a human decides when this is actually published.

v1.1.0

Reproducible cross-target build, verified by two independent CI runners per target (issue #172).
Signed keylessly with cosign (Fulcio + Rekor) and carries SLSA Build L3 provenance (issue #173).
SBOM in both CycloneDX and SPDX formats (issue #174).
OCI image (linux/amd64 only for now -- linux/arm64 temporarily dropped, see release.yml's own comment on why), also cosign-signed: ghcr.io/agent-wkp/wkp@sha256:db04acba8d46af0334a6893de1bedb198f109b114067ba56dd43e0b4781a07b8 (issue #176).
--sandbox podman image (issue #229), same repository tagged v1.1.0-sandbox, also cosign-signed: ghcr.io/agent-wkp/wkp@sha256:393bae5d2a4c07db4b372482c311717a9af376f0fcbb5350888924d9d8483a49.

Verify a binary's signature:

cosign verify-blob --bundle wkp-<target>.bundle \
  --certificate-identity-regexp '^https://github\.com/agent-wkp/wkp/\.github/workflows/release\.yml@.*$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  wkp-<target>

Left as a draft: this workflow alone isn't all of M6 (design 9.6) -- a human decides when this is actually published.

v1.0.3

Reproducible cross-target build, verified by two independent CI runners per target (issue #172).
Signed keylessly with cosign (Fulcio + Rekor) and carries SLSA Build L3 provenance (issue #173).
SBOM in both CycloneDX and SPDX formats (issue #174).
OCI image (linux/amd64 only for now -- linux/arm64 temporarily dropped, see release.yml's own comment on why), also cosign-signed: ghcr.io/williamcaban/wkp@sha256:40e435f9bc7d4b30614ec67a99e45f78d39927d1307be56cfd150d33312da94a (issue #176).

Verify a binary's signature:

cosign verify-blob --bundle wkp-<target>.bundle \
  --certificate-identity-regexp '^https://github\.com/williamcaban/agent-wkp/\.github/workflows/release\.yml@.*$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  wkp-<target>

Left as a draft: this workflow alone isn't all of M6 (design 9.6) -- a human decides when this is actually published.

v1.0.2

Reproducible cross-target build, verified by two independent CI runners per target (issue #172).
Signed keylessly with cosign (Fulcio + Rekor) and carries SLSA Build L3 provenance (issue #173).
SBOM in both CycloneDX and SPDX formats (issue #174).
OCI image (linux/amd64 only for now -- linux/arm64 temporarily dropped, see release.yml's own comment on why), also cosign-signed: ghcr.io/williamcaban/wkp@sha256:8c2d543ff37a72824f8448a716cdb44bae39a0d336c0d607c2ec1e6f5c6b62ce (issue #176).

Verify a binary's signature:

cosign verify-blob --bundle wkp-<target>.bundle \
  --certificate-identity-regexp '^https://github\.com/williamcaban/agent-wkp/\.github/workflows/release\.yml@.*$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  wkp-<target>

Left as a draft: this workflow alone isn't all of M6 (design 9.6) -- a human decides when this is actually published.

v1.0.1

Reproducible cross-target build, verified by two independent CI runners per target (issue #172).
Signed keylessly with cosign (Fulcio + Rekor) and carries SLSA Build L3 provenance (issue #173).
SBOM in both CycloneDX and SPDX formats (issue #174).
OCI image (linux/amd64 only for now -- linux/arm64 temporarily dropped, see release.yml's own comment on why), also cosign-signed: ghcr.io/williamcaban/wkp@sha256:860c856a223883d9a5e37771501c7c8b8fb8e214c529b6d2c08f09d69fb81674 (issue #176).

Verify a binary's signature:

cosign verify-blob --bundle wkp-<target>.bundle \
  --certificate-identity-regexp '^https://github\.com/williamcaban/agent-wkp/\.github/workflows/release\.yml@.*$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  wkp-<target>

Left as a draft: this workflow alone isn't all of M6 (design 9.6) -- a human decides when this is actually published.

v1.0.0

Reproducible cross-target build, verified by two independent CI runners per target (issue #172).
Signed keylessly with cosign (Fulcio + Rekor) and carries SLSA Build L3 provenance (issue #173).
SBOM in both CycloneDX and SPDX formats (issue #174).
OCI image (linux/amd64 only for now -- linux/arm64 temporarily dropped, see release.yml's own comment on why), also cosign-signed: ghcr.io/williamcaban/wkp@sha256:a246001062701dfaf903d162f87262ec9104781b00a0a982c268b240d0ef0c14 (issue #176).

Verify a binary's signature:

cosign verify-blob --bundle wkp-<target>.bundle \
  --certificate-identity-regexp '^https://github\.com/williamcaban/agent-wkp/\.github/workflows/release\.yml@.*$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  wkp-<target>

Left as a draft: this workflow alone isn't all of M6 (design 9.6) -- a human decides when this is actually published.