Releases: uknoAI/kno
Release list
v0.1.1
0.1.1 (2026-08-31)
Features
- Bedrock and Vertex agent adapters — partner clouds priced (#128) (360cabc)
- Braintrust Evals adapter — fourth core.Evals source (#124) (638e3d2)
- Hugging Face adapters — Evals and Pool (#125) (ebd4d4a)
Documentation
Build & Dependencies
Verifying this release
Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.
# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
--certificate checksums.txt.pem \
--signature checksums.txt.sig \
--certificate-identity-regexp '^https://github\.com/uknoAI/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2. Your download is really what the checksum file names. Substitute the
# archive you actually downloaded. Written this way because macOS has no
# sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.1.1_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -
# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.1.1_linux_amd64.tar.gz \
--repo uknoAI/kno \
--signer-workflow uknoAI/kno/.github/workflows/release.ymlBoth identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.
Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.
Checksums (SHA-256)
3bfa04bcc34b872edbedf2cc83317e8d35cb32dbf931c4bd2bd458db45e15795 kno_0.1.1_darwin_amd64.tar.gz
de13ae519543e75069971b1c9d26cb000b5a27822ca2706b5489f4deef98fb5c kno_0.1.1_darwin_amd64.tar.gz.sbom.json
2011a1e532beda6932195c240fa41b252bba7a26f745a4ccbac3c2b2fcb28633 kno_0.1.1_darwin_arm64.tar.gz
33dabeef8e62c4c4da5427732d1f064484fdb25bd86d7126ae33efac1e3cf0fc kno_0.1.1_darwin_arm64.tar.gz.sbom.json
3f6df988a354ee749f31d393aa762d960f95ffb5a38e4de585698fd4a984dc79 kno_0.1.1_linux_amd64.tar.gz
5bd22f6e3bc4299d94761b59e01950fd565000246bbd3567b4454410d7fc5fb8 kno_0.1.1_linux_amd64.tar.gz.sbom.json
bdc224f6547572258a6e34ea3514ea74daf6e88a4fe142aa376e9710870320a3 kno_0.1.1_linux_arm64.tar.gz
fa959799709699fc0d4e35a601b639b02b1c105e5070278b19832a1c0058ac20 kno_0.1.1_linux_arm64.tar.gz.sbom.json
4b43e1e76d9951254b16fb301483df09c1bba5ce906d4058d6e8e9bbbc2711bc kno_0.1.1_windows_amd64.zip
37dafe9d404d0457d9f605763f76474a54d80a28e2dcbd3b01f6c0cd6e3b9046 kno_0.1.1_windows_amd64.zip.sbom.json
90bfda2b0d0774e58ab3b872f084739c568f3bc051c62ef36ffcaead208d9786 kno_0.1.1_windows_arm64.zip
ef5b8a964f7acb191191d398b850a358af2dbd612dbb39f9dc1ecc783675f227 kno_0.1.1_windows_arm64.zip.sbom.json
v0.1.0
Verifying this release
Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.
# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
--certificate checksums.txt.pem \
--signature checksums.txt.sig \
--certificate-identity-regexp '^https://github\.com/[Kk]nograph/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2. Your download is really what the checksum file names. Substitute the
# archive you actually downloaded. Written this way because macOS has no
# sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.1.0_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -
# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.1.0_linux_amd64.tar.gz \
--repo knograph/kno \
--signer-workflow knograph/kno/.github/workflows/release.ymlBoth identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.
Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.
Checksums (SHA-256)
02b71fe984b6c2c16e08162f054cc15d88d2587f5720fc49bd04674613a0a236 kno_0.1.0_darwin_amd64.tar.gz
f5f76a131afa083e03b4cde661962ce3dc7e6bbd6914a2b59a42265e74cabb56 kno_0.1.0_darwin_amd64.tar.gz.sbom.json
45b1824bf866a66002c6b661e10d0e6845187b314706865e9a6143a5b225d84a kno_0.1.0_darwin_arm64.tar.gz
458e53c10d41cc871a50ea0f36ef3262364e47c13fd32659b33b6cb7821d59d1 kno_0.1.0_darwin_arm64.tar.gz.sbom.json
ac66fcfe632953acc6ef7a384ffda54f4a0effc6abc8ab4c260337e8b81b588a kno_0.1.0_linux_amd64.tar.gz
b27f38d8715a3fd3e4aeb4b05f456f5349228e8020c2f1e0c62b6c0e0cd565da kno_0.1.0_linux_amd64.tar.gz.sbom.json
67d0614fb3e0410b6377d810ad63e9855642fe00ec7dadc8e5609d27edafd57b kno_0.1.0_linux_arm64.tar.gz
20d3b7314c409eac60adb45faea624d4e1013547c51531b318f8cd9d1d6dcfd4 kno_0.1.0_linux_arm64.tar.gz.sbom.json
01846149a17407981f46655cb92d07952ed35e273dfe3264ae5305988c6d7f48 kno_0.1.0_windows_amd64.zip
2d97f3d910365bb44538f1ec22c2e541f091ae59dd288f1e1e1517d68494c299 kno_0.1.0_windows_amd64.zip.sbom.json
71ec07875ff40faf2d6e28c2608e14d1e2fa79e2c9057165ea308da506cda99e kno_0.1.0_windows_arm64.zip
e9dfdf2f3a727b14def6c8bab48c6138617d5bb76001693f4de1dc39345e5e1c kno_0.1.0_windows_arm64.zip.sbom.json
v0.0.4
Verifying this release
Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.
# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
--certificate checksums.txt.pem \
--signature checksums.txt.sig \
--certificate-identity-regexp '^https://github\.com/[Kk]nograph/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2. Your download is really what the checksum file names. Substitute the
# archive you actually downloaded. Written this way because macOS has no
# sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.0.4_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -
# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.0.4_linux_amd64.tar.gz \
--repo knograph/kno \
--signer-workflow knograph/kno/.github/workflows/release.ymlBoth identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.
Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.
Checksums (SHA-256)
fab4b9ffb2ee84bf75073812fe0d46d69249391f1e6c777e51b629ea05437140 kno_0.0.4_darwin_amd64.tar.gz
3c7fa13aa7e49812d5e524b2828259c55008693896026566dece98a167d79c67 kno_0.0.4_darwin_amd64.tar.gz.sbom.json
bcd4547ebf0e18736af6a7da8cdbff56fbeb76a133a29e9e564a52c37b33abaf kno_0.0.4_darwin_arm64.tar.gz
09a4ce7e394d44b3af5e57bc6de564fe85adc6b84a74dd0355c25409ff626cfc kno_0.0.4_darwin_arm64.tar.gz.sbom.json
aececd1f4de2cb4c9a3036ec7cae2596d90746ffe752c93a2dc91927e1ad73af kno_0.0.4_linux_amd64.tar.gz
cb2205504d42fed80f9f98197a98d2215088d32b8cdb291b655d833dcd4ff195 kno_0.0.4_linux_amd64.tar.gz.sbom.json
4f9e75d24dd57acd06ec3986b255dc0d01006f9b62e8539b1bd937b535147bf1 kno_0.0.4_linux_arm64.tar.gz
63175340ba151bfb7c03b1b3a61e41cd66ec4a93af0fd6ec94832ace99e12499 kno_0.0.4_linux_arm64.tar.gz.sbom.json
9df6ce686e15b5ef44eb75437f8e0a400abb34778b21ad3e03c0c9e273ded287 kno_0.0.4_windows_amd64.zip
40573756ddca1b9c314c7127e320c4fc61dc03efd6007638f0085d8167ed542e kno_0.0.4_windows_amd64.zip.sbom.json
20ea58991809861c67bf509c666b715218c37a177f91f2a8b9f36afe6406af60 kno_0.0.4_windows_arm64.zip
cbafc3cb4da463b8b8b05f2bd9c1384c82cd17d3f10b7279b014a7db5273b107 kno_0.0.4_windows_arm64.zip.sbom.json
v0.0.3
Verifying this release
Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.
# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
--certificate checksums.txt.pem \
--signature checksums.txt.sig \
--certificate-identity-regexp '^https://github\.com/[Kk]nograph/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2. Your download is really what the checksum file names. Substitute the
# archive you actually downloaded. Written this way because macOS has no
# sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.0.3_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -
# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.0.3_linux_amd64.tar.gz \
--repo knograph/kno \
--signer-workflow knograph/kno/.github/workflows/release.ymlBoth identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.
Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.
Checksums (SHA-256)
57b0083a58451623c5e42e27e4ba61c67dc0c28a6b70612995f671ddcfc6c852 kno_0.0.3_darwin_amd64.tar.gz
6a29e558e4d232bf3d8a98bcc9b70d5dcd9c0b4ad6ae7154e6f16045c7403835 kno_0.0.3_darwin_amd64.tar.gz.sbom.json
112950807ab62a3e088b55f7defd15eef59d5d66ee9292c0cf9eff0c8fac5b0c kno_0.0.3_darwin_arm64.tar.gz
862340e3f3514f59b0216aa0f54a2613e01fd767c375d5addc857f0cdb60d28f kno_0.0.3_darwin_arm64.tar.gz.sbom.json
c7197661c7e7bd2d007e446437aad31e5d8d382209c3ffe4b6e546aa7f6735d7 kno_0.0.3_linux_amd64.tar.gz
f110768805d270f026629d74ec1f2b1338d3c79149b84b4b5cc1308d25ba73b0 kno_0.0.3_linux_amd64.tar.gz.sbom.json
0a2b2007d6499b10625e881ae41e6ff622d4b3ff0debed773ed23048c1f7b251 kno_0.0.3_linux_arm64.tar.gz
b198d587ac9548bb3cbb507f34e6207ad5b098ac7e05d07f6873b9a0ac8a4a22 kno_0.0.3_linux_arm64.tar.gz.sbom.json
d07e2ebe058705db8c4e2a5c96a29f14738e28b575b2d31272c6a15f973eb6df kno_0.0.3_windows_amd64.zip
d3406156854be001272bc64cf08272feec8bdf534ae1b5761a4216ff1a0bddc2 kno_0.0.3_windows_amd64.zip.sbom.json
dfeb42a0fbd3a33f61598fa95a7b7ce715eef5696bf0cfa90d47faf2961390c8 kno_0.0.3_windows_arm64.zip
6fe35e9e7df08d0fc7f9e08a1f3d1f2d26dfd37436239d4c2e36a3122975a034 kno_0.0.3_windows_arm64.zip.sbom.json
v0.0.2
Verifying this release
Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.
# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
--certificate checksums.txt.pem \
--signature checksums.txt.sig \
--certificate-identity-regexp '^https://github\.com/knograph/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2. Your download is really what the checksum file names. Substitute the
# archive you actually downloaded. Written this way because macOS has no
# sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.0.2_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -
# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.0.2_linux_amd64.tar.gz \
--repo knograph/kno \
--signer-workflow knograph/kno/.github/workflows/release.ymlBoth identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.
Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.
Checksums (SHA-256)
c6efb31ae0b23693429a14748c6daa9434d50efdd07407db0eee140f1d02862d kno_0.0.2_darwin_amd64.tar.gz
0eaa7a5d2eed928490e4bdf36acf2dbda1738877e2ffe49120965bd9091e738a kno_0.0.2_darwin_amd64.tar.gz.sbom.json
4a7dddce724b415de5c9c58ad875e3fcfc0092d5097efe501ec343915dec7ce8 kno_0.0.2_darwin_arm64.tar.gz
1c6a404ad55322253d03d0068cc052aae60ab0323b07c90f90951421acd11c77 kno_0.0.2_darwin_arm64.tar.gz.sbom.json
eace68f456b5c81dfb624085cee4111bba930c7151670680e61c34f898095c37 kno_0.0.2_linux_amd64.tar.gz
fabf4ac1d34720b3f87cb5ee42a50d4a92e0e73cda5d1a470247a5ff502fa989 kno_0.0.2_linux_amd64.tar.gz.sbom.json
5623496738458522ad73a4437c6b674b2e9304b5068c14e1ef8196bb29bae8e0 kno_0.0.2_linux_arm64.tar.gz
bc35412d1fca4ec8a2ed8084b8670ccdeca53a982d38928203bd28c2271f8719 kno_0.0.2_linux_arm64.tar.gz.sbom.json
22181f534169b15d5a57b900a10b9b8900c1ceb64309e9fb779ca5eb2660e2e0 kno_0.0.2_windows_amd64.zip
7145b407837026a314afde9565937bb02300ef7d5e053268a40949a8f97bbf54 kno_0.0.2_windows_amd64.zip.sbom.json
c8b62ebd3998a1483f428c811e407a23f5e17e009ac904c91fab7a20a361b326 kno_0.0.2_windows_arm64.zip
96f151c373553a886beb15e54027ede9b2afb396d81f9f5d15f63bb68f4ab3db kno_0.0.2_windows_arm64.zip.sbom.json