v0.0.4

---

Verifying this release

Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.

# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github\.com/[Kk]nograph/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Your download is really what the checksum file names. Substitute the
#    archive you actually downloaded. Written this way because macOS has no
#    sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.0.4_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -

# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.0.4_linux_amd64.tar.gz \
  --repo knograph/kno \
  --signer-workflow knograph/kno/.github/workflows/release.yml

Both identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.

Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.

Checksums (SHA-256)

fab4b9ffb2ee84bf75073812fe0d46d69249391f1e6c777e51b629ea05437140  kno_0.0.4_darwin_amd64.tar.gz
3c7fa13aa7e49812d5e524b2828259c55008693896026566dece98a167d79c67  kno_0.0.4_darwin_amd64.tar.gz.sbom.json
bcd4547ebf0e18736af6a7da8cdbff56fbeb76a133a29e9e564a52c37b33abaf  kno_0.0.4_darwin_arm64.tar.gz
09a4ce7e394d44b3af5e57bc6de564fe85adc6b84a74dd0355c25409ff626cfc  kno_0.0.4_darwin_arm64.tar.gz.sbom.json
aececd1f4de2cb4c9a3036ec7cae2596d90746ffe752c93a2dc91927e1ad73af  kno_0.0.4_linux_amd64.tar.gz
cb2205504d42fed80f9f98197a98d2215088d32b8cdb291b655d833dcd4ff195  kno_0.0.4_linux_amd64.tar.gz.sbom.json
4f9e75d24dd57acd06ec3986b255dc0d01006f9b62e8539b1bd937b535147bf1  kno_0.0.4_linux_arm64.tar.gz
63175340ba151bfb7c03b1b3a61e41cd66ec4a93af0fd6ec94832ace99e12499  kno_0.0.4_linux_arm64.tar.gz.sbom.json
9df6ce686e15b5ef44eb75437f8e0a400abb34778b21ad3e03c0c9e273ded287  kno_0.0.4_windows_amd64.zip
40573756ddca1b9c314c7127e320c4fc61dc03efd6007638f0085d8167ed542e  kno_0.0.4_windows_amd64.zip.sbom.json
20ea58991809861c67bf509c666b715218c37a177f91f2a8b9f36afe6406af60  kno_0.0.4_windows_arm64.zip
cbafc3cb4da463b8b8b05f2bd9c1384c82cd17d3f10b7279b014a7db5273b107  kno_0.0.4_windows_arm64.zip.sbom.json