v0.1.0

Initial version 🎉

Install the CLI

To install the CLI, run:

VERSION=v0.1.0

# change accordingly to your OS/arch
OS=linux # or darwin
ARCH=amd64 # or arm64

curl -Lo kueuleuleu "https://github.com/norbjd/kueueleuleu/releases/download/$VERSION/kueueleuleu-$OS-$ARCH"
chmod u+x kueuleuleu

To verify the provenance (TL;DR: ensure the binary was built from the tag source code and was not tampered), use slsa-verifier:

curl -Lo kueueleuleu.intoto.jsonl "https://github.com/norbjd/kueueleuleu/releases/download/$VERSION/kueueleuleu-$OS-$ARCH.intoto.jsonl"

slsa-verifier verify-artifact kueuleuleu \
  --provenance-path kueueleuleu.intoto.jsonl \
  --source-uri github.com/norbjd/kueueleuleu \
  --source-tag $VERSION

It should display: PASSED: Verified SLSA provenance.

Use the library

To use the library, just go get it:

VERSION=v0.1.0

go get github.com/norbjd/kueueleuleu@$VERSION