v0.0.3

---

Verifying this release

Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.

# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github\.com/[Kk]nograph/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Your download is really what the checksum file names. Substitute the
#    archive you actually downloaded. Written this way because macOS has no
#    sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.0.3_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -

# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.0.3_linux_amd64.tar.gz \
  --repo knograph/kno \
  --signer-workflow knograph/kno/.github/workflows/release.yml

Both identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.

Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.

Checksums (SHA-256)

57b0083a58451623c5e42e27e4ba61c67dc0c28a6b70612995f671ddcfc6c852  kno_0.0.3_darwin_amd64.tar.gz
6a29e558e4d232bf3d8a98bcc9b70d5dcd9c0b4ad6ae7154e6f16045c7403835  kno_0.0.3_darwin_amd64.tar.gz.sbom.json
112950807ab62a3e088b55f7defd15eef59d5d66ee9292c0cf9eff0c8fac5b0c  kno_0.0.3_darwin_arm64.tar.gz
862340e3f3514f59b0216aa0f54a2613e01fd767c375d5addc857f0cdb60d28f  kno_0.0.3_darwin_arm64.tar.gz.sbom.json
c7197661c7e7bd2d007e446437aad31e5d8d382209c3ffe4b6e546aa7f6735d7  kno_0.0.3_linux_amd64.tar.gz
f110768805d270f026629d74ec1f2b1338d3c79149b84b4b5cc1308d25ba73b0  kno_0.0.3_linux_amd64.tar.gz.sbom.json
0a2b2007d6499b10625e881ae41e6ff622d4b3ff0debed773ed23048c1f7b251  kno_0.0.3_linux_arm64.tar.gz
b198d587ac9548bb3cbb507f34e6207ad5b098ac7e05d07f6873b9a0ac8a4a22  kno_0.0.3_linux_arm64.tar.gz.sbom.json
d07e2ebe058705db8c4e2a5c96a29f14738e28b575b2d31272c6a15f973eb6df  kno_0.0.3_windows_amd64.zip
d3406156854be001272bc64cf08272feec8bdf534ae1b5761a4216ff1a0bddc2  kno_0.0.3_windows_amd64.zip.sbom.json
dfeb42a0fbd3a33f61598fa95a7b7ce715eef5696bf0cfa90d47faf2961390c8  kno_0.0.3_windows_arm64.zip
6fe35e9e7df08d0fc7f9e08a1f3d1f2d26dfd37436239d4c2e36a3122975a034  kno_0.0.3_windows_arm64.zip.sbom.json