Skip to content

v0.1.2

Choose a tag to compare

View all tags
@devarispbrown devarispbrown released this 31 Aug 17:46
v0.1.2
3bafe13
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.1.2 (2026-08-31)

Features

  • kno demo — the whole loop in one command, for free (#144) (6317b9a)

Bug Fixes

  • ci: the release commit signs itself, and the DCO check stops failing correct trailers (#142) (63cfa20)

Documentation

  • adapters: package godoc names only the adapters that exist (#141) (dec47a8)
  • evaluation best practices in the README, and the deep evaluation-design guide (#137) (bfb85c7)
  • Phase-0 plans for the next body of work, all adversarially reviewed (#140) (648effb)
  • the quickstart tape shows the intervals it claims (#143) (1c6403f)
  • the README quickstart Case matches the recorded tape (#139) (20c7dfe)

Verifying this release

Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.

# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github\.com/uknoAI/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Your download is really what the checksum file names. Substitute the
#    archive you actually downloaded. Written this way because macOS has no
#    sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.1.2_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -

# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.1.2_linux_amd64.tar.gz \
  --repo uknoAI/kno \
  --signer-workflow uknoAI/kno/.github/workflows/release.yml

Both identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.

Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.

Checksums (SHA-256)

c3553dcf0b18271da67622f35a607d88f5f80726e4b78e79d6e8b0102289bb4c  kno_0.1.2_darwin_amd64.tar.gz
dc77284b840bfdc493224472df1b09507c18cd3d4cb82a74008d4309207f5497  kno_0.1.2_darwin_amd64.tar.gz.sbom.json
4f05cec1b5bc0e8ba6bc6f6945be09a46567c4059ea2ea7f64273e14335dc33c  kno_0.1.2_darwin_arm64.tar.gz
f2c5507a87809d2e82d39978e67740abefdb98c0be6b0da70cab04066af3be98  kno_0.1.2_darwin_arm64.tar.gz.sbom.json
c2c72ba6a11b2ec91cf10c23b250ec6b609e1d7b474b6e95e3733a24a5ca00b7  kno_0.1.2_linux_amd64.tar.gz
24055fd6485c02abbcd7ddb0f60acac2f92063e61c9552504010962716796fec  kno_0.1.2_linux_amd64.tar.gz.sbom.json
ce189c541d0622f78c903c63264a7ae62b48e1b83056239ec2d33d93238f5515  kno_0.1.2_linux_arm64.tar.gz
c2ac256493cce9b4ba097b9c845fb27469c21d11ad9997718973dc816fc308f4  kno_0.1.2_linux_arm64.tar.gz.sbom.json
c98fdff62f30e9a01461ac6e37acf59883a2b699e118534ee7dd6e053f84b76a  kno_0.1.2_windows_amd64.zip
c39097f06eee92bb310a3997eed4a292143d772f630445130fe0c8918ec235fc  kno_0.1.2_windows_amd64.zip.sbom.json
7f927cae0c09bb288e4b8bd04c8c9d84eab775e6c4d2e5cf675e1dd172268f32  kno_0.1.2_windows_arm64.zip
b81edb49aea03aba964302bd132df3cbe18aebac9a58a21248d89e593aebf978  kno_0.1.2_windows_arm64.zip.sbom.json
Assets 16
Loading