Skip to content

v0.36.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Aug 21:12
· 0 commits to main since this release
v0.36.0
a7a1d24

Install

curl -fsSL https://raw.githubusercontent.com/cboxdk/telemetryd/main/install.sh | sh

Or with Homebrew:

brew install cboxdk/tap/telemetryd

Debian and Ubuntu: download the .deb for your architecture and
sudo dpkg -i telemetryd_*.deb. There is no hosted apt repository —
see the README for why.

Verifying

SHA256SUMS covers every archive, and SHA256SUMS.cosign.bundle is a
keyless Sigstore signature over it. There is no public key to fetch: the
signing identity is this release workflow, attested by GitHub's OIDC
provider and recorded in the public transparency log.

cosign verify-blob \
  --bundle SHA256SUMS.cosign.bundle \
  --certificate-identity "https://github.com/cboxdk/telemetryd/.github/workflows/release.yml@refs/tags/v0.36.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  SHA256SUMS

Pin --certificate-identity as shown. Without it any valid Sigstore
signature would pass, including one made by somebody else.

sbom.json is a CycloneDX 1.5 manifest of everything linked into the
binary.

Full Changelog: v0.35.0...v0.36.0

Assets 11
Loading