docs: update docs for release v2.0.1

[asraa]

This PR

• Updates the SHA256SUM.md for the releaes v2.0.1
• Updates the README.md with the v2 module path and adds a known issue for 2.0.1 panic.

To verify hash

1. Download the binary and provenance from https://github.com/slsa-framework/slsa-verifier/releases/tag/v2.0.1
2. Clone the slsa-verifier repo, compile and verify the provenance:

$ git clone git@github.com:slsa-framework/slsa-verifier.git
$ cd slsa-verifier
$ (Optional: git checkout tags/v2.0.1)
$ go run ./cli/slsa-verifier verify-artifact ~/Downloads/slsa-verifier-linux-amd64 --provenance-path ~/Downloads/slsa-verifier-linux-amd64.intoto.jsonl --source-uri github.com/slsa-framework/slsa-verifier --source-tag v2.0.1

3. Get the hash.
   Either:

cat slsa-verifier-linux-amd64.intoto.jsonl | jq -r '.payload' | base64 -d | jq -r '.subject[0].digest.sha256'

or

sha256sum slsa-verifier-linux-amd64

Signed-off-by: Asra Ali asraa@google.com

[laurentsimon]

$ go run ./cli/slsa-verifier verify-artifact slsa-verifier-linux-amd64 --provenance-path slsa-verifier-linux-amd64.intoto.jsonl --source-uri github.com/slsa-framework/slsa-verifier --source-tag v2.0.1

Verified signature against tlog entry index 9037754 at URL: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77a92fa27d40d1bb6932df92832fe2c5bf9d021497df0ceb40852dfc53eb99f93c6
Verified build using builder https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@refs/tags/v1.2.2 at commit a43888265e1f6aae98c924538298944f2721dcf0
PASSED: Verified SLSA provenance

$ cat slsa-verifier-linux-amd64.intoto.jsonl | jq -r '.payload' | base64 -d | jq -r '.subject[0].digest.sha256'
ad4b408c43504d439827998c27ab4be1c44ff467ccb39b78da01568f8542b10e

$ sha256sum slsa-verifier-linux-amd64
ad4b408c43504d439827998c27ab4be1c44ff467ccb39b78da01568f8542b10e  slsa-verifier-linux-amd64

All matches the ad4b408c43504d439827998c27ab4be1c44ff467ccb39b78da01568f8542b10e added to the SHA256SUM.md

[laurentsimon]

Thanks!

[laurentsimon]

Something seems off with the pre-submits: they are not running

[laurentsimon]

I have updated the pre-submits in the branch protection settings to be like #398, but it does not seem to help :/ Maybe need to restart the runs?

[asraa]

I have updated the pre-submits in the branch protection settings to be like #398, but it does not seem to help :/ Maybe need to restart the runs?

Weird, let me try pushing an empty commit.

[laurentsimon]

Fyi, #398 will fix the check-dist pre-submit. Waiting for final ack from Ian to merge.