Skip to content

v0.1.1

Choose a tag to compare

View all tags
@devarispbrown devarispbrown released this 31 Aug 05:05
v0.1.1
9de5a85
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.1.1 (2026-08-31)

Features

  • Bedrock and Vertex agent adapters — partner clouds priced (#128) (360cabc)
  • Braintrust Evals adapter — fourth core.Evals source (#124) (638e3d2)
  • Hugging Face adapters — Evals and Pool (#125) (ebd4d4a)

Documentation

  • fold the hand-written changelog into v0.1.0 (#131) (c86e28b)

Build & Dependencies

  • deps: Bump github.com/charmbracelet/glamour from 0.9.1 to 1.0.0 (#136) (2514b25)

Verifying this release

Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.

# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github\.com/uknoAI/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Your download is really what the checksum file names. Substitute the
#    archive you actually downloaded. Written this way because macOS has no
#    sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.1.1_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -

# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.1.1_linux_amd64.tar.gz \
  --repo uknoAI/kno \
  --signer-workflow uknoAI/kno/.github/workflows/release.yml

Both identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.

Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.

Checksums (SHA-256)

3bfa04bcc34b872edbedf2cc83317e8d35cb32dbf931c4bd2bd458db45e15795  kno_0.1.1_darwin_amd64.tar.gz
de13ae519543e75069971b1c9d26cb000b5a27822ca2706b5489f4deef98fb5c  kno_0.1.1_darwin_amd64.tar.gz.sbom.json
2011a1e532beda6932195c240fa41b252bba7a26f745a4ccbac3c2b2fcb28633  kno_0.1.1_darwin_arm64.tar.gz
33dabeef8e62c4c4da5427732d1f064484fdb25bd86d7126ae33efac1e3cf0fc  kno_0.1.1_darwin_arm64.tar.gz.sbom.json
3f6df988a354ee749f31d393aa762d960f95ffb5a38e4de585698fd4a984dc79  kno_0.1.1_linux_amd64.tar.gz
5bd22f6e3bc4299d94761b59e01950fd565000246bbd3567b4454410d7fc5fb8  kno_0.1.1_linux_amd64.tar.gz.sbom.json
bdc224f6547572258a6e34ea3514ea74daf6e88a4fe142aa376e9710870320a3  kno_0.1.1_linux_arm64.tar.gz
fa959799709699fc0d4e35a601b639b02b1c105e5070278b19832a1c0058ac20  kno_0.1.1_linux_arm64.tar.gz.sbom.json
4b43e1e76d9951254b16fb301483df09c1bba5ce906d4058d6e8e9bbbc2711bc  kno_0.1.1_windows_amd64.zip
37dafe9d404d0457d9f605763f76474a54d80a28e2dcbd3b01f6c0cd6e3b9046  kno_0.1.1_windows_amd64.zip.sbom.json
90bfda2b0d0774e58ab3b872f084739c568f3bc051c62ef36ffcaead208d9786  kno_0.1.1_windows_arm64.zip
ef5b8a964f7acb191191d398b850a358af2dbd612dbb39f9dc1ecc783675f227  kno_0.1.1_windows_arm64.zip.sbom.json
Assets 16
Loading