v0.1.1
Release artifacts are signed with cosign
(keyless) and ship CycloneDX SBOMs. Verify the checksums:
cosign verify-blob \
--bundle checksums.txt.sigstore.json \
--certificate-identity-regexp 'https://github.com/pulsys-io/pulsys/.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
checksums.txt