This release includes a fix for CVE-2021-41087. You can find the security advisory here: https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-vrxp-mg9f-hwf3

Other changes include:

• A CLI courtesy of the BoxBoat team
• Certificate support in in-toto metadata
• Updated PAE function to match DSSE v1
• Updated type to indicate provenance matches SLSA spec
• Fix to make Metadata field in Provenance optional to match the specification

This release supports Go 1.16 and 1.17.

Shout out to our contributors (in no particular order): Parth Patel (@pxp928), Dan Lorenc (@dlorenc), Brandon Mitchell (@sudo-bmitch), Mikhail Swift (@mikhailswift), Furkan Türkal (@Dentrax), Batuhan Apaydın (@developer-guy), Christian Rebischke (@shibumi), Santiago Torres-Arias (@SantiagoTorres).