v0.7.2

Changelog

Bug fixes

• e0148ca: fix(http): times out on large repositories (#428) (@aymanbagabas)
• 6dc3c59: fix: lint issues (@aymanbagabas)

Dependency updates

• 49f34dd: feat(deps): bump github.com/charmbracelet/log from 0.2.5 to 0.3.0 (#424) (@dependabot[bot])
• e6713ba: feat(deps): bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 (#423) (@dependabot[bot])
• ccb46a4: feat(deps): bump github.com/golang-jwt/jwt/v5 from 5.0.0 to 5.1.0 (#422) (@dependabot[bot])
• 40423e8: feat(deps): bump github.com/gorilla/handlers from 1.5.1 to 1.5.2 (#419) (@dependabot[bot])
• fabeb84: feat(deps): bump github.com/gorilla/mux from 1.8.0 to 1.8.1 (#417) (@dependabot[bot])
• b5fa038: feat(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 (#418) (@dependabot[bot])
• 71d2cd0: feat(deps): bump golang.org/x/crypto from 0.14.0 to 0.15.0 (#425) (@dependabot[bot])
• d5e81ad: feat(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (#420) (@dependabot[bot])
• 1383d18: feat(deps): bump modernc.org/sqlite from 1.26.0 to 1.27.0 (#416) (@dependabot[bot])

---

Verifying the artifacts

First, download the checksums.txt file, for example, with wget:

wget 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.2/checksums.txt'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.2/checksums.txt.pem' \
  --signature 'https://github.com/charmbracelet/soft-serve/releases/download/v0.7.2/checksums.txt.sig' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.