v0.2.0-rc.4

Get it

Grab your platform's archive below (install + MCP registration) — or take the container image:

docker pull ghcr.io/tobert/kaibo:0.2.0-rc.4

# one-line install into a devcontainer or any image — the binary is fully static
COPY --from=ghcr.io/tobert/kaibo:0.2.0-rc.4 /usr/local/bin/kaibo /usr/local/bin/kaibo

(Pull version tags like 0.2.0-rc.4 — the sha256-* tags on the package page are
cosign signature/attestation artifacts riding alongside the image, not images.)

Verify it

Run these from the folder holding your downloads. Every artifact carries SLSA
build provenance — any downloaded file, one command:

gh attestation verify kaibo-v0.2.0-rc.4-x86_64-unknown-linux-musl.tar.gz -R tobert/kaibo
gh attestation verify oci://ghcr.io/tobert/kaibo:0.2.0-rc.4 -R tobert/kaibo

Or keyless-verify the signed checksum manifest with cosign ≥ 3 (covers every file it lists, works offline):

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/tobert/kaibo/.github/workflows/release.yml@refs/tags/v0.2.0-rc.4" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
sha256sum -c --ignore-missing checksums.txt

---

What's Changed

• feat(release): ghcr container image — multiarch distroless, born signed, built to be COPY'd (plan PR 4) by @tobert in #71

Full Changelog: v0.2.0-rc.3...v0.2.0-rc.4