v0.2

What's Changed

• 🕰️ [just] add local-test recipe for sanity check with real clocks by @chicks-net in #38
• Mark .just/ template boilerplate as linguist-vendored by @chicks-net in #39
• ✅ [readme] update known bugs and coming soon list by @chicks-net in #43
• 🚀 [gha] add release workflow with signed binaries and SLSA provenance, fixes #42 by @chicks-net in #44

Full Changelog: v0.1...v0.2

Verifying the binaries

Each ctm-<os>-<arch> binary is signed keyless with cosign (Sigstore).
Verify a binary against its bundle:

cosign verify-blob \
    --bundle ctm-<os>-<arch>.bundle \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-identity-regexp '^https://github\.com/chicks-net/ctm/\.github/workflows/release\.yml@.+$' \
    ctm-<os>-<arch>

Or check it the old-school way:

cosign verify-blob --bundle ctm-<os>-<arch>.bundle ctm-<os>-<arch>

SLSA-3 build provenance is attached to the release as multiple.intoto.jsonl.