v0.1.0

---

Verifying this release

Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.

# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github\.com/[Kk]nograph/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Your download is really what the checksum file names. Substitute the
#    archive you actually downloaded. Written this way because macOS has no
#    sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.1.0_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -

# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.1.0_linux_amd64.tar.gz \
  --repo knograph/kno \
  --signer-workflow knograph/kno/.github/workflows/release.yml

Both identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.

Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.

Checksums (SHA-256)

02b71fe984b6c2c16e08162f054cc15d88d2587f5720fc49bd04674613a0a236  kno_0.1.0_darwin_amd64.tar.gz
f5f76a131afa083e03b4cde661962ce3dc7e6bbd6914a2b59a42265e74cabb56  kno_0.1.0_darwin_amd64.tar.gz.sbom.json
45b1824bf866a66002c6b661e10d0e6845187b314706865e9a6143a5b225d84a  kno_0.1.0_darwin_arm64.tar.gz
458e53c10d41cc871a50ea0f36ef3262364e47c13fd32659b33b6cb7821d59d1  kno_0.1.0_darwin_arm64.tar.gz.sbom.json
ac66fcfe632953acc6ef7a384ffda54f4a0effc6abc8ab4c260337e8b81b588a  kno_0.1.0_linux_amd64.tar.gz
b27f38d8715a3fd3e4aeb4b05f456f5349228e8020c2f1e0c62b6c0e0cd565da  kno_0.1.0_linux_amd64.tar.gz.sbom.json
67d0614fb3e0410b6377d810ad63e9855642fe00ec7dadc8e5609d27edafd57b  kno_0.1.0_linux_arm64.tar.gz
20d3b7314c409eac60adb45faea624d4e1013547c51531b318f8cd9d1d6dcfd4  kno_0.1.0_linux_arm64.tar.gz.sbom.json
01846149a17407981f46655cb92d07952ed35e273dfe3264ae5305988c6d7f48  kno_0.1.0_windows_amd64.zip
2d97f3d910365bb44538f1ec22c2e541f091ae59dd288f1e1e1517d68494c299  kno_0.1.0_windows_amd64.zip.sbom.json
71ec07875ff40faf2d6e28c2608e14d1e2fa79e2c9057165ea308da506cda99e  kno_0.1.0_windows_arm64.zip
e9dfdf2f3a727b14def6c8bab48c6138617d5bb76001693f4de1dc39345e5e1c  kno_0.1.0_windows_arm64.zip.sbom.json