v0.1.0

Verifying this release

The archive carries a Sigstore attestation bound to the workflow run
and commit that produced it. There is no signing key, so there is
none to lose or leak.

gh attestation verify crimp-v0.1.0.tar.gz --repo thearchitect0x-glitch/crimp

Or offline, against the bundle attached here:

gh attestation verify crimp-v0.1.0.tar.gz --bundle crimp-v0.1.0.tar.gz.sigstore.json --repo thearchitect0x-glitch/crimp

That answers which workflow, at which commit, built this file. It
does not answer whether that commit was any good — every commit on
main requires review by somebody other than its author, and that
is what addresses the second question.

What's Changed

• A quickstart that has actually been run by @thearchitect0x-glitch in #2
• Two defects the first restore rehearsal found at step 8 by @thearchitect0x-glitch in #3
• The restore rehearsal happened, and it found four things by @thearchitect0x-glitch in #4
• Roadmap, architecture, and an assurance case that says what is not defended by @thearchitect0x-glitch in #5
• Signed releases, keyless, because a key is a continuity liability by @thearchitect0x-glitch in #6
• Crimp reports determinations; it does not authorise by @thearchitect0x-glitch in #7
• Four things that shape the contract, settled before anybody integrates by @thearchitect0x-glitch in #8
• A mark that says what the system does by @thearchitect0x-glitch in #11
• A shared device could union two people, and nothing called mergeCapable() by @thearchitect0x-glitch in #12
• The correction channel did not reach past the hundredth person by @thearchitect0x-glitch in #13
• The join key was leaving through attestation by @thearchitect0x-glitch in #14
• The claw ladder bounded who may reverse, never when by @thearchitect0x-glitch in #15
• How many may reverse, and from where by @thearchitect0x-glitch in #16
• Two processes, two probes, and an image that has actually been run by @thearchitect0x-glitch in #17
• Why, on the record — and who asked by @thearchitect0x-glitch in #10
• The upgrade: ten capabilities, signed records, an offline verifier, and the format's home by @thearchitect0x-glitch in #19
• The SNAP configuration, and the record's date without the issuer's key by @thearchitect0x-glitch in #21
• Badges that are earned: pinned supply chain, reproducible build, zero CodeQL alerts by @thearchitect0x-glitch in #22

Full Changelog: https://github.com/thearchitect0x-glitch/crimp/commits/v0.1.0