v2.0.0

Release notes are in CHANGELOG.md — read the
Needs action section before upgrading.

Verifying what you downloaded

Signature first, then checksum — that order is the point. The signature is
what makes checksums.txt worth trusting; a checksum read out of an
unverified file only proves the archive and the checksum arrived together.

checksums.txt is signed with cosign
keyless signing, so there is no public key to trust — the signature is tied
to this repository, this workflow and this tag:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.bundle \
  --certificate-identity-regexp '^https://github\.com/Warewave-Technology/postern/\.github/workflows/release\.yml@refs/tags/v2.0.0$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Needs cosign v3 or later — that is the version this signature is produced
with, and the bundle format is its default. Only once it prints
Verified OK does the checksum mean anything:

sha256sum -c checksums.txt --ignore-missing

To see which dependency versions a binary was built with — the question
that matters when an advisory lands:

go version -m ./postern