Prep release v0.3.0

- CHANGELOG.md: promote Unreleased to 0.3.0 with today's date and
  a full summary of the signing, SBOM, attestation, installer,
  docs, and Go-cleanup changes shipping in this release.
- README.md and docs/install.sh: bump the version pinning
  examples from v0.1.6 / v0.2.0 to v0.3.0.
- CONTRIBUTING.md: update the release process examples to reference
  v0.3.0 instead of v0.2.0.
- docs/install.test.sh intentionally still pins TEST_VERSION to
  v0.2.0 to exercise the installer's legacy-release soft-skip
  path (v0.2.0 predates cosign signing).

Author: grempe

CHANGELOG.md

@@ -7,6 +7,74 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0] — 2026-04-15
+
+### Added
+- Cosign keyless signing of every release's `checksums.txt`, published
+  as `checksums.txt.sigstore` (Sigstore bundle format). Signing identity
+  is the release workflow, the OIDC issuer is GitHub Actions, and the
+  signing event is logged to the public Rekor transparency log.
+- Per-archive SPDX JSON Software Bill of Materials (SBOM) generated by
+  syft and attached to each GitHub Release.
+- SLSA build-provenance attestation for `checksums.txt` via
+  `actions/attest-build-provenance`, queryable with
+  `gh attestation verify`.
+- `docs/install.sh` now performs best-effort Cosign signature
+  verification of `checksums.txt` when `cosign` is on `PATH`, and
+  refuses to install when `TRUESTAMP_REQUIRE_COSIGN=1` is set and
+  verification fails or the bundle is missing.
+- `--help` / `-h` flag on `docs/install.sh` so
+  `curl … | sh -s -- --help` prints the env-var reference.
+- `docs/install.test.sh` end-to-end installer smoke test, wired into
+  CI alongside shellcheck.
+- `govulncheck` step in CI catches Go stdlib and dependency
+  vulnerabilities on every push.
+- `SECURITY.md`, `CONTRIBUTING.md`, and `CODE_OF_CONDUCT.md`.
+- README sections for verifying a download, pinning a specific
+  version, config-file permissions, and exit codes.
+- Package-level godoc on every `internal/*` package.
+- `cmd/timestamp_test.go` table-driven tests for the new
+  `--timestamp` ISO 8601 validator.
+- `cosign`, `shellcheck`, and `syft` to `.tool-versions` so
+  `mise install` bootstraps every tool the repo uses.
+- `-buildvcs=true` build flag so `go version -m` on the released
+  binary reports the source commit.
+
+### Changed
+- Homebrew cask updates now land via a pull request to
+  `truestamp/homebrew-tap` instead of a direct push to `main`,
+  reducing the blast radius of the publish token.
+- `--timestamp` values are validated locally and normalised to UTC
+  RFC 3339 before being sent to the API, rejecting bad inputs with a
+  clear local error.
+- Every `uses:` reference in the GitHub Actions workflows is pinned to
+  a full commit SHA with a version comment for Dependabot.
+- `cmd/verify.go` no longer calls `os.Exit`; failures propagate as
+  errors. A silent-mode sentinel keeps `verify --silent` exit-code 1
+  without producing any output.
+- Duplicate file-picker and table-style helpers in `cmd/` consolidated
+  into `internal/ui` (`PickFile`, `LabelValueStyleFunc`).
+- HTTP calls now accept a `context.Context` end to end, plumbed from
+  each Cobra `cmd.Context()`.
+- Contributor-facing content moved out of `README.md` into
+  `CONTRIBUTING.md`; the README is now focused on install and use.
+
+### Fixed
+- Removed an unreachable init-time `panic` in `internal/proof/binary.go`
+  that could only fire for an impossible CBOR option combination.
+- Replaced the `":pick"` / `":prompt"` flag sentinels with NUL-byte
+  values so that a filename like `:pick` can never collide with the
+  picker trigger.
+
+### Security
+- All release artifacts now have a cryptographically verifiable chain
+  of custody: signed Sigstore bundle → `checksums.txt` SHA-256 →
+  platform archives. Tampering anywhere in that chain is detected.
+- The `HOMEBREW_TAP_GITHUB_TOKEN` PAT is expected to be fine-grained,
+  scoped to `truestamp/homebrew-tap` only, with
+  `Contents: Read and write` + `Pull requests: Read and write`. The
+  previous classic-PAT guidance has been corrected.
+
 ## [0.2.0] — 2026-04-15
 
 ### Added
@@ -55,6 +123,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   v0.1.0 is the first release of a standalone Go codebase; the two share
   nothing beyond the repository name.
 
-[Unreleased]: https://github.com/truestamp/truestamp-cli/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/truestamp/truestamp-cli/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/truestamp/truestamp-cli/releases/tag/v0.3.0
 [0.2.0]: https://github.com/truestamp/truestamp-cli/releases/tag/v0.2.0
 [0.1.0]: https://github.com/truestamp/truestamp-cli/releases/tag/v0.1.0

CONTRIBUTING.md

@@ -84,7 +84,7 @@ Move entries from `## [Unreleased]` into a new section for the version you're ab
 ```md
 ## [Unreleased]
 
-## [0.2.0] — 2026-04-20
+## [0.3.0] — 2026-04-20
 
 ### Added
 - ...
@@ -95,7 +95,7 @@ Move entries from `## [Unreleased]` into a new section for the version you're ab
 This repo is a jj colocated workspace. Commit the CHANGELOG edit as a normal change and advance `main`:
 
 ```sh
-jj describe -m "Prep release v0.2.0"
+jj describe -m "Prep release v0.3.0"
 jj bookmark move main --to @
 jj git push --bookmark main
 ```
@@ -105,8 +105,8 @@ jj git push --bookmark main
 jj does not create annotated tags itself — use the git CLI in the same working copy (the jj repo is colocated with `.git/`):
 
 ```sh
-git tag -a v0.2.0 -m "v0.2.0 - one-line summary of the headline change"
-git push origin v0.2.0
+git tag -a v0.3.0 -m "v0.3.0 - one-line summary of the headline change"
+git push origin v0.3.0
 ```
 
 The tag must point at the exact commit that `main` now holds, and must start with `v` so GoReleaser's trigger (`push: tags: ['v*']`) fires.
@@ -118,7 +118,7 @@ run_id=$(gh run list --workflow=release.yml --limit 1 --json databaseId -q '.[].
 gh run watch "$run_id" --exit-status
 
 # Verify artifacts landed.
-gh release view v0.2.0 --json tagName,assets -q '{tag: .tagName, assets: (.assets | length)}'
+gh release view v0.3.0 --json tagName,assets -q '{tag: .tagName, assets: (.assets | length)}'
 
 # Confirm the tap cask updated.
 gh api repos/truestamp/homebrew-tap/contents/Casks/truestamp-cli.rb -q '.content' | base64 -d | head
@@ -138,13 +138,13 @@ xattr -cr "$(brew --caskroom)/truestamp-cli"   # macOS Gatekeeper, first run onl
 truestamp version
 
 # Go install.
-go install github.com/truestamp/truestamp-cli/cmd/truestamp@v0.2.0
+go install github.com/truestamp/truestamp-cli/cmd/truestamp@v0.3.0
 truestamp version
 
 # Direct tarball.
 os=$(uname -s | tr A-Z a-z)
 arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
-curl -sSL "https://github.com/truestamp/truestamp-cli/releases/download/v0.2.0/truestamp-cli_0.2.0_${os}_${arch}.tar.gz" | tar -xz
+curl -sSL "https://github.com/truestamp/truestamp-cli/releases/download/v0.3.0/truestamp-cli_0.3.0_${os}_${arch}.tar.gz" | tar -xz
 ./truestamp version
 ```
 
@@ -153,13 +153,13 @@ curl -sSL "https://github.com/truestamp/truestamp-cli/releases/download/v0.2.0/t
 GoReleaser is mostly idempotent, but a partial failure (for example a tap push rejected) leaves the GitHub Release in place while the tap cask is out of date. To redo cleanly:
 
 ```sh
-gh release delete v0.2.0 -y
-git push origin :refs/tags/v0.2.0
-git tag -d v0.2.0
+gh release delete v0.3.0 -y
+git push origin :refs/tags/v0.3.0
+git tag -d v0.3.0
 
 # Fix the problem in a new commit, push to main, then retag from the fixed commit.
-git tag -a v0.2.0 -m "v0.2.0 - ..."
-git push origin v0.2.0
+git tag -a v0.3.0 -m "v0.3.0 - ..."
+git push origin v0.3.0
 ```
 
 Do **not** re-tag a version that has already propagated to `proxy.golang.org` — the proxy caches tagged module versions forever. Bump the patch version (`v0.2.1`) instead.

README.md

@@ -22,7 +22,7 @@ The script detects your OS/architecture (darwin/linux × amd64/arm64), resolves
 Pin a specific version:
 
 ```sh
-curl -fsSL https://get.truestamp.com/install.sh | TRUESTAMP_VERSION=v0.1.6 sh
+curl -fsSL https://get.truestamp.com/install.sh | TRUESTAMP_VERSION=v0.3.0 sh
 ```
 
 Install to a custom directory:

docs/install.sh

@@ -8,7 +8,7 @@
 #   curl -fsSL https://get.truestamp.com/install.sh | sh
 #
 # Environment variables (all optional):
-#   TRUESTAMP_VERSION         Tag to install, e.g. v0.2.0. Defaults to latest.
+#   TRUESTAMP_VERSION         Tag to install, e.g. v0.3.0. Defaults to latest.
 #   TRUESTAMP_INSTALL_DIR     Install target dir. Defaults to /usr/local/bin
 #                             or ~/.local/bin.
 #   TRUESTAMP_SKIP_CHECKSUM   Set to 1 to skip SHA-256 verification. Debug only.
@@ -53,7 +53,7 @@ Usage:
     curl -fsSL https://get.truestamp.com/install.sh | sh -s -- --help
 
 Environment variables (all optional):
-    TRUESTAMP_VERSION         Tag to install, e.g. v0.2.0. Defaults to latest.
+    TRUESTAMP_VERSION         Tag to install, e.g. v0.3.0. Defaults to latest.
     TRUESTAMP_INSTALL_DIR     Install target dir. Defaults to /usr/local/bin
                               or ~/.local/bin.
     TRUESTAMP_SKIP_CHECKSUM   Set to 1 to skip SHA-256 verification. Debug only.