Skip to content

v0.1.6

Choose a tag to compare

View all tags
@devarispbrown devarispbrown released this 01 Sep 08:01
v0.1.6
1b33409
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.1.6 (2026-09-01)

Bug Fixes

  • export: a tuning set carries an assistant turn to train on (#183) (5cf4ab2)
  • stats: a sample with no spread no longer reports certainty (#182) (9e88389)

Documentation

  • fold the hand-written changelog into v0.1.5 (#180) (76fb335)

Verifying this release

Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.

# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github\.com/uknoAI/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Your download is really what the checksum file names. Substitute the
#    archive you actually downloaded. Written this way because macOS has no
#    sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.1.6_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -

# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.1.6_linux_amd64.tar.gz \
  --repo uknoAI/kno \
  --signer-workflow uknoAI/kno/.github/workflows/release.yml

Both identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.

Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.

Checksums (SHA-256)

4e54d2b0ce5418db536aaaaa48cc2b926f908aca1e03e948f9a7fed0e3a51997  kno_0.1.6_darwin_amd64.tar.gz
9a4871db7cf8843f660d5be8f853ccb6ff6c083596f6bb6b12aacadc2d5a310c  kno_0.1.6_darwin_amd64.tar.gz.sbom.json
1938030c14e38934da12b965a71166177eb7f76bbc23cb982720609a1348d5ec  kno_0.1.6_darwin_arm64.tar.gz
eb1a276b0cb0cbf1b1a27ef02c103745c8e8400b41decaef1d91ef455541a022  kno_0.1.6_darwin_arm64.tar.gz.sbom.json
0dc81124997489b21f07ba24e7b437b7d39a0816570fae8873d4fb8962e16a3b  kno_0.1.6_linux_amd64.tar.gz
fcb1cd5d9c0e654a3907f5a5966231b5169fa8d309eb4b1918d149192ef0438c  kno_0.1.6_linux_amd64.tar.gz.sbom.json
0b19739947e04242aa2419632f9da7380d61f610d677aebd7b4e219e6f6c1cc2  kno_0.1.6_linux_arm64.tar.gz
4a861c7ced8f55739643bc89eda3e55e898e765bdc0dc9725ad1efb2ef59e484  kno_0.1.6_linux_arm64.tar.gz.sbom.json
71acf1ba11ed11dd801c6cb35922a9819584bf64b5fe0734e588d44f8e3e4759  kno_0.1.6_windows_amd64.zip
4ac2e0acbc6a7496f4ddf28588acbed970bbafeb0dd0ceb2f0524896a5f5d334  kno_0.1.6_windows_amd64.zip.sbom.json
a1e6d041437a6f38fc30788914f570b55762f669dec284eee294d96ff7b8eb82  kno_0.1.6_windows_arm64.zip
b47efdf3df9fe32659de485bb95a4c541cf839b55ada116ad57ecc160d6df5d2  kno_0.1.6_windows_arm64.zip.sbom.json
Assets 16
Loading