v0.0.2

---

Verifying this release

Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.

# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github\.com/knograph/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Your download is really what the checksum file names. Substitute the
#    archive you actually downloaded. Written this way because macOS has no
#    sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.0.2_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -

# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.0.2_linux_amd64.tar.gz \
  --repo knograph/kno \
  --signer-workflow knograph/kno/.github/workflows/release.yml

Both identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.

Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.

Checksums (SHA-256)

c6efb31ae0b23693429a14748c6daa9434d50efdd07407db0eee140f1d02862d  kno_0.0.2_darwin_amd64.tar.gz
0eaa7a5d2eed928490e4bdf36acf2dbda1738877e2ffe49120965bd9091e738a  kno_0.0.2_darwin_amd64.tar.gz.sbom.json
4a7dddce724b415de5c9c58ad875e3fcfc0092d5097efe501ec343915dec7ce8  kno_0.0.2_darwin_arm64.tar.gz
1c6a404ad55322253d03d0068cc052aae60ab0323b07c90f90951421acd11c77  kno_0.0.2_darwin_arm64.tar.gz.sbom.json
eace68f456b5c81dfb624085cee4111bba930c7151670680e61c34f898095c37  kno_0.0.2_linux_amd64.tar.gz
fabf4ac1d34720b3f87cb5ee42a50d4a92e0e73cda5d1a470247a5ff502fa989  kno_0.0.2_linux_amd64.tar.gz.sbom.json
5623496738458522ad73a4437c6b674b2e9304b5068c14e1ef8196bb29bae8e0  kno_0.0.2_linux_arm64.tar.gz
bc35412d1fca4ec8a2ed8084b8670ccdeca53a982d38928203bd28c2271f8719  kno_0.0.2_linux_arm64.tar.gz.sbom.json
22181f534169b15d5a57b900a10b9b8900c1ceb64309e9fb779ca5eb2660e2e0  kno_0.0.2_windows_amd64.zip
7145b407837026a314afde9565937bb02300ef7d5e053268a40949a8f97bbf54  kno_0.0.2_windows_amd64.zip.sbom.json
c8b62ebd3998a1483f428c811e407a23f5e17e009ac904c91fab7a20a361b326  kno_0.0.2_windows_arm64.zip
96f151c373553a886beb15e54027ede9b2afb396d81f9f5d15f63bb68f4ab3db  kno_0.0.2_windows_arm64.zip.sbom.json