piace 0.5.0

Statically linked, CGO-free binaries for linux/amd64, linux/arm64,
darwin/amd64 and darwin/arm64.

Verifying this download

Verify the signature first. The checksum manifest shows only that a
download is intact; the signature over it is what says where it came
from, and it is produced by the publishing workflow itself, so it is
attached from the moment this release exists.

cosign verify-blob SHA256SUMS \
  --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/example42/piace/.github/workflows/ci.yml@refs/tags/v0.5.0' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --check --ignore-missing SHA256SUMS   # shasum -a 256 on macOS
./piace-0.5.0-<os>-<arch> version

The binaries also carry a GitHub build provenance attestation naming the
workflow and commit that produced them:

gh attestation verify piace-0.5.0-linux-amd64 --repo example42/piace

SHA256SUMS.asc, a detached OpenPGP signature over the same manifest,
is attached separately for sites that require one. It is an extra, not the
verification path: see docs/release.md.

SHA256SUMS

67bd0834f110b8edb701677a8125194809b669ad6bec9b9909a1bd3e71e11f50  piace-0.5.0-darwin-amd64
19f2a375f376e849c5c68d422b602fcb4c8c839eeb6e9a3e81b048de839bc716  piace-0.5.0-darwin-arm64
cb960d1b7117b5928a5f8ccfd6324c698214b76a586b3d8ded497d2d481ac468  piace-0.5.0-linux-amd64
fbe1124c477c1d923c1a058a618d0020edcc8109a1dba8173c17fbb8cfce0faa  piace-0.5.0-linux-arm64