v0.6.0

Signed release

Every binary attached below is reproducibly built (cargo build --release --locked, SOURCE_DATE_EPOCH pinned), cosign-signed (keyless, Sigstore),
and anchored in the public Rekor transparency log. An SPDX SBOM is attached
per target.

Install

All three routes below deliver the same signed bytes — the tarballs
attached to this release. They cover macOS and Linux alike, on arm64 and
x86_64 (Linux builds are statically linked against musl, so no glibc version
to match).

Native install script (recommended, macOS + Linux):

curl -fsSL https://noogram.org/cosmon/install.sh | sh
cs --version

It detects your platform, downloads the matching tarball, and fails closed
if the sha256 does not match the published SHA256SUMS.

The installer itself is attached below as cosmon-install-<version>.sh, signed
and Rekor-anchored like the binaries. Piping it into sh consumes it before
that signature can be checked, so if you want the signature to actually do work
— shared machine, CI, first install — take the verify-then-run form instead:

ver=<version>          # the release version, without the leading v
base="https://github.com/noogram/cosmon/releases/download/v${ver}"
curl -fsSLO "${base}/cosmon-install-${ver}.sh"
curl -fsSLO "${base}/cosmon-install-${ver}.sh.sig"
curl -fsSLO "${base}/cosmon-install-${ver}.sh.pem"

cosign verify-blob \
  --certificate-identity-regexp 'https://github.com/.*/cosmon/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --signature  "cosmon-install-${ver}.sh.sig" \
  --certificate "cosmon-install-${ver}.sh.pem" \
  "cosmon-install-${ver}.sh" \
  && sh "cosmon-install-${ver}.sh"

The && is load-bearing: cosign verify-blob exits non-zero on anything it
cannot tie back to release.yml at a cosmon tag, and that exit status is what
stops the script from running.

Homebrew (macOS + Linuxbrew):

brew install noogram/tap/cosmon
cs --version

The tap formula points at these very tarballs; brew checks the same digests.

From source (any platform with a Rust toolchain, MSRV 1.88):

cargo install --git https://github.com/noogram/cosmon.git --locked cosmon-cli

This compiles locally, so it produces your binary rather than the signed one
attached here — the verification steps below apply to the first two routes.

Verify the binary you installed

cosign verify-blob \
  --certificate-identity-regexp 'https://github.com/.*/cosmon/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --signature  cosmon-<version>-<target>.sig \
  --certificate cosmon-<version>-<target>.pem \
  "$(which cs)"
# exits 0 on a green signature

Self-host the remote service

Each target also ships a cosmon-service-<version>-<target>.tar.gz bundle
containing the cosmon-rpp-adapter (HTTP fente) and cs-oidc-mock (demo IdP)
binaries — signed and Rekor-anchored like the cs tarball. The
Run cosmon as a remote service
how-to deploys directly from this bundle; no Rust toolchain required.

Full operator instructions:
docs/guides/release-verification.md.

---

What's Changed

• experiments(#39): external rate-measurement data — 400 trials at 500 ms, aarch64 Colima by @jdthaler in #41
• experiments(#39): retract the pooled bounds and the reproduction claim in the external results README by @jdthaler in #42
• Add support for other IdP than forgejo by @ph-lean in #44

New Contributors

• @jdthaler made their first contribution in #41
• @ph-lean made their first contribution in #44

Full Changelog: v0.5.0...v0.6.0