One Link 0.21.0

One Link 0.21.0

Locked, quality-gated artifacts published with Sigstore keyless
provenance attestations. Anyone can verify a download
with:

bash scripts/verify-release.sh dist/<artifact> v0.21.0

Or with the sigstore tool directly:

python -m sigstore verify identity \
  --bundle <artifact>.sigstore \
  --cert-identity 'https://github.com/coherence-energy-labs/one-link/.github/workflows/release.yml@refs/tags/v0.21.0' \
  --cert-oidc-issuer 'https://token.actions.githubusercontent.com' \
  <artifact>

SOURCE_DATE_EPOCH: 1785550237
(the deterministic source-timestamp input used by this build).

SHA256SUMS verifies the exact published bytes. Separate unsigned
CI evidence currently proves byte-for-byte reproducibility only for
the explicitly compared Linux native wheel; no such claim is made
for the standalone cross-platform binaries.

sbom.cdx.json inventories the frozen Python graph, the complete
native Cargo.lock/workspace graph, and SHA-256 hashes of the exact
wheels and standalone bundles assembled by this run. The SBOM is
itself covered by SHA256SUMS, Sigstore, and provenance attestation.

UPDATE_MANIFEST.json is the signed, commit-bound authority used by
the standalone transactional updater. It names and hashes each
platform archive and is covered by SHA256SUMS, Sigstore, and
provenance attestation.

Full Changelog: v0.20.6...v0.21.0