piace 0.6.0

Statically linked, CGO-free binaries for linux/amd64, linux/arm64,
darwin/amd64 and darwin/arm64.

Verifying this download

Verify the signature first. The checksum manifest shows only that a
download is intact; the signature over it is what says where it came
from, and it is produced by the publishing workflow itself, so it is
attached from the moment this release exists.

cosign verify-blob SHA256SUMS \
  --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/example42/piace/.github/workflows/ci.yml@refs/tags/v0.6.0' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --check --ignore-missing SHA256SUMS   # shasum -a 256 on macOS
./piace-0.6.0-<os>-<arch> version

The binaries also carry a GitHub build provenance attestation naming the
workflow and commit that produced them:

gh attestation verify piace-0.6.0-linux-amd64 --repo example42/piace

SHA256SUMS.asc, a detached OpenPGP signature over the same manifest,
is attached separately for sites that require one. It is an extra, not the
verification path: see docs/release.md.

SHA256SUMS

055f7083b8c8efabbe51f4bdfdf9806c6b90ae458104ca920ec2094f594ecb92  piace-0.6.0-darwin-amd64
c22dd205c7e7a4a22d46e05c646f28b178fc40044824cdd0a74ff901c5d711b1  piace-0.6.0-darwin-arm64
720d3220fde1781a2f1a82053af2f3e8983817a508db323994929e6c5a4fe3f1  piace-0.6.0-linux-amd64
b0b1d5196ba842d4efc3e21f24d89c13a5277273770878ab5a1080ed279329aa  piace-0.6.0-linux-arm64