v0.2.2

0.2.2 (2026-09-10)

Bug Fixes

• build: check the changelog fold at merge, not only at creation (#216) (1a842f5)

Documentation

• fold the hand-written changelog into v0.2.1 (#214) (d3df2a9)

Build & Dependencies

• deps: Bump modernc.org/sqlite from 1.57.0 to 1.58.0 (#217) (2d6c0ba)

---

Verifying this release

Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.

# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github\.com/uknoAI/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Your download is really what the checksum file names. Substitute the
#    archive you actually downloaded. Written this way because macOS has no
#    sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.2.2_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -

# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.2.2_linux_amd64.tar.gz \
  --repo uknoAI/kno \
  --signer-workflow uknoAI/kno/.github/workflows/release.yml

Both identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.

Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.

Checksums (SHA-256)

d8a9e3cfdd565a78a51985f8a832df519da5a52ac1066cbf5beff79ac64c1877  kno_0.2.2_darwin_amd64.tar.gz
3d2c394f6da15cfb8a7069b143140c02a97fc18aa6f43d1d3e82fc6170a8b7e5  kno_0.2.2_darwin_amd64.tar.gz.sbom.json
c76875edf3795bd244885d90d8a1433045dd488959892cbf10774c803522fff3  kno_0.2.2_darwin_arm64.tar.gz
f4dc7212247d6d236de67c5932174776cea27f2136f958ec8c70791af11b41e4  kno_0.2.2_darwin_arm64.tar.gz.sbom.json
195166275be9b87aad0cfcb1df48b805f12ee01cf847f4b35b9b499147431f2f  kno_0.2.2_linux_amd64.tar.gz
a6c89169aa86e3063e22fa826cda80226f2838d862f13dc56bdbefefa43f2fb5  kno_0.2.2_linux_amd64.tar.gz.sbom.json
91094316e2c1f4a26c794533a5fdaa71af02bd98462d86b805a855d3cce97517  kno_0.2.2_linux_arm64.tar.gz
c22ce3f3a79b20500e4eca267ba17e4315a4e68e80a850a74d7a911076441e39  kno_0.2.2_linux_arm64.tar.gz.sbom.json
ef20148aacf3b049eb7f6e3fe9f2d4ec8bdcdbd7e105fba07c7a2f788cd7955f  kno_0.2.2_windows_amd64.zip
3c6b3965662736e35d1f09a9a3c25f6443ba294f5265aae9b29510e856c7be9d  kno_0.2.2_windows_amd64.zip.sbom.json
493bf3caef6161bfa8ea9b3915e86f54efc8f6ec200a957554dfdc2157e94ef9  kno_0.2.2_windows_arm64.zip
364b22580bcf848679f843c310defde7468ab393c150b7ddf91242d706af7528  kno_0.2.2_windows_arm64.zip.sbom.json