One Link 0.21.0

One Link 0.21.0

Locked, quality-gated artifacts published with Sigstore keyless
provenance attestations. Anyone can verify a download
with:

bash scripts/verify-release.sh dist/<artifact> v0.21.0

Or with the sigstore tool directly:

python -m sigstore verify identity \
  --bundle <artifact>.sigstore \
  --cert-identity 'https://github.com/coherence-energy-labs/one-link/.github/workflows/release.yml@refs/tags/v0.21.0' \
  --cert-oidc-issuer 'https://token.actions.githubusercontent.com' \
  <artifact>

SOURCE_DATE_EPOCH: 1785550237
(the deterministic source-timestamp input used by this build).

SHA256SUMS verifies the exact published bytes. Separate unsigned
CI evidence currently proves byte-for-byte reproducibility only for
the explicitly compared Linux native wheel; no such claim is made
for the standalone cross-platform binaries.

sbom.cdx.json inventories the frozen Python graph, the complete
native Cargo.lock/workspace graph, and SHA-256 hashes of the exact
wheels and standalone bundles assembled by this run. The SBOM is
itself covered by SHA256SUMS, Sigstore, and provenance attestation.

UPDATE_MANIFEST.json is the signed, commit-bound authority used by
the standalone transactional updater. It names and hashes each
platform archive and is covered by SHA256SUMS, Sigstore, and
provenance attestation.

Full Changelog: v0.20.6...v0.21.0

Rolling build (master 4a5802b98c750b0b9159ae4f4ab4e6a702b57f9b)

Rolling continuous build from master 4a5802b98c750b0b9159ae4f4ab4e6a702b57f9b.

Published only after tests, security, and the platform
build matrix were green for this exact commit.

Every artifact carries a GitHub build-provenance attestation:

gh attestation verify <downloaded-file> --repo coherence-energy-labs/one-link

Read that attestation precisely. It proves the file was emitted
by this repository's publish_rolling.yml on a GitHub-hosted
runner, so a third party cannot substitute their own upload. Its
sourceRepositoryDigest is the commit the PUBLISHER ran from,
which is not necessarily the commit the binary was COMPILED from
(4a5802b98c750b0b9159ae4f4ab4e6a702b57f9b, named in the title above). It is not a reproducible
build claim: it does not let you rebuild these bytes and compare.

This is not a signed, reproducible release. That pipeline is
release.yml, fires only on v* tags, and remains the only
channel intended for production trust. SHA-256 for every artifact
is in manifest.txt and the per-file .sha256 sidecars.