v0.1.5

0.1.5 (2026-09-01)

Features

• judge calibrate — a judge is measured before it is trusted (#177) (bd2cc17)

Bug Fixes

• release: fold the changelog correctly, and stop it racing the tag (#174) (9112255)
• validate: a resumed run restores the tokens it spent (#172) (14291c8)

Documentation

• plans: amend redundancy detection with F5 and the moved cookbook (#173) (159d6e1)

Build & Dependencies

• release: notify kno-www when a release ships (#176) (01ebc01)

---

Verifying this release

Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.

# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github\.com/uknoAI/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Your download is really what the checksum file names. Substitute the
#    archive you actually downloaded. Written this way because macOS has no
#    sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.1.5_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -

# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.1.5_linux_amd64.tar.gz \
  --repo uknoAI/kno \
  --signer-workflow uknoAI/kno/.github/workflows/release.yml

Both identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.

Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.

Checksums (SHA-256)

a02a4ba1ecd8efac146c14244b3ac5ea9c880681ecf99cd042ee8d8413fb166a  kno_0.1.5_darwin_amd64.tar.gz
305dc74cb777bd6132d0e12b7abf81a47d073e1393dc7645271635c7de69ac84  kno_0.1.5_darwin_amd64.tar.gz.sbom.json
02fb6bf297e35fc98cebe56a43cc71f8a1609602a5f3eabb36ca7fb19c6f4507  kno_0.1.5_darwin_arm64.tar.gz
9c94becc93b5b4bfaa0b5ca0a617e80fda8cce52500afb858fbd34eb586cab7b  kno_0.1.5_darwin_arm64.tar.gz.sbom.json
0b9492eacb519ea49e2d28202118d993151b8be4e857fe764a9263163e7f9d09  kno_0.1.5_linux_amd64.tar.gz
4cb7feb72f3fc0ab464c7bc8bdebed213a06d7cbe51c7eef3b72ae6f57e847fe  kno_0.1.5_linux_amd64.tar.gz.sbom.json
87607895643550635d4e71185ea49c76e4bd09a7a3f16ebba397b5f13095446f  kno_0.1.5_linux_arm64.tar.gz
429f07e187e407e9a6471b61c51ef590ad899255adce1a399ce19141a481110c  kno_0.1.5_linux_arm64.tar.gz.sbom.json
45f2d6f12e1512b2f2b8246a1696cc63716c6ff404fbeb9b443cb4a3f05ea9d3  kno_0.1.5_windows_amd64.zip
500a147a6e1d4bdf744f26ce080b3ec55b883dcb4a5f4f1f0ff96e3ee47b6320  kno_0.1.5_windows_amd64.zip.sbom.json
cbf3d95dff3f908505f696ac02bff7f5634453a6248a5e063fa33c9273e7ed7a  kno_0.1.5_windows_arm64.zip
8f9fc236002878f18f8cf5d9263ea52c3ecae1281a4937a54c2482f8367631c0  kno_0.1.5_windows_arm64.zip.sbom.json