v0.1.1

Changelog

Fixes

• 2cf4142 fix(security): sanitise foreign strings and bound decompression

Other changes

• e5f83ef bug: fix install script
• b2966fe sec: gosec and codeql

---

Verification:

cosign verify-blob \
    --bundle checksums.txt.sigstore.json \
    --certificate-identity-regexp "^https://github.com/spiffcs/hoard/.*" \
    --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
    checksums.txt