piace 0.4.0

Statically linked, CGO-free binaries for linux/amd64, linux/arm64,
darwin/amd64 and darwin/arm64.

Verifying this download

Verify the signature first. The checksum manifest shows only that a
download is intact; the signature over it is what says where it came
from, and it is produced by the publishing workflow itself, so it is
attached from the moment this release exists.

cosign verify-blob SHA256SUMS \
  --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/example42/piace/.github/workflows/ci.yml@refs/tags/v0.4.0' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --check --ignore-missing SHA256SUMS   # shasum -a 256 on macOS
./piace-0.4.0-<os>-<arch> version

The binaries also carry a GitHub build provenance attestation naming the
workflow and commit that produced them:

gh attestation verify piace-0.4.0-linux-amd64 --repo example42/piace

SHA256SUMS.asc, a detached OpenPGP signature over the same manifest,
is attached separately for sites that require one. It is an extra, not the
verification path: see docs/release.md.

SHA256SUMS

5c564f8a87b6405110e7c8f2ec2864100cd0ae5e1261cd5559a0ed65636a664f  piace-0.4.0-darwin-amd64
856b40dcb5e94a34fc7bde6cbd4a8fa222e665fb41c31ff2e3ee1065362983fb  piace-0.4.0-darwin-arm64
6cb0cd87f5913dbba2f01e3aefa4605dee31b33b602ea2b51ed50f4df77d9149  piace-0.4.0-linux-amd64
df9dc4ff9c79ebebdc8ed67c3291705b50014cdf402d3d27a004c740d5fee263  piace-0.4.0-linux-arm64