Skip to content

0.1.1 - 2026-10-01

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Sep 17:10
Immutable release. Only release title and notes can be modified.
v0.1.1
50b306d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Notes

Security

  • rustls 0.23.45 fixes RUSTSEC-2026-0285 (TLS 1.3 handshake messages were
    accepted across encryption level boundaries), which affected every HTTPS
    connection kurama makes.

Added

  • Each release archive's build provenance ships as
    kurama-<target>.sigstore.json next to it, so
    gh attestation verify <archive> --repo ynishimura/kurama --bundle <file>
    checks a download without asking GitHub.

Changed

  • kurama data embeds DuckDB 1.5.5 (was 1.5.3), with its matching httpfs
    extension for S3 reads.

Install kurama 0.1.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/ynishimura/kurama/releases/download/v0.1.1/kurama-installer.sh | sh

Install prebuilt binaries via Homebrew

brew install ynishimura/tap/kurama

Download kurama 0.1.1

File Platform Checksum
kurama-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
kurama-x86_64-apple-darwin.tar.xz Intel macOS checksum
kurama-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
kurama-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo ynishimura/kurama

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> --repo ynishimura/kurama
Assets 21
Loading