Verify the avar binary

Three independent trust roots. Every release is signed three ways so no single compromised path — not GitHub, not Sigstore, not our tap — can hand you a forged binary undetected.

What ships in each release

  • Native tarballs: avar-vX.Y.Z-<platform>.tar.gz for darwin-arm64, darwin-x64, linux-x64, linux-arm64, plus a readable source bundle.
  • SHA256SUMS — one line per artifact.
  • release-manifest.json — machine-readable index with sha, size, platform, and verification commands.
  • *.cosign.bundle — Sigstore bundle for each artifact.
  • GitHub build-provenance attestation (SLSA v1) recorded against every artifact via actions/attest-build-provenance.

1. SHA-256 checksums

The fastest integrity check. Download the artifact and SHA256SUMS from the same release page.

# Linux / macOS
sha256sum -c SHA256SUMS --ignore-missing
# ->  avar-vX.Y.Z-linux-x64.tar.gz: OK

2. GitHub build provenance

Cryptographic proof the binary was built by our public release workflow on Aarmatix/avar — not handed over by a maintainer. Requires the GitHub CLI.

gh attestation verify avar-vX.Y.Z-linux-x64.tar.gz \
  --repo Aarmatix/avar
# ->  Loaded 1 attestation
# ->  ✓ Verification succeeded!

The attestation records the exact commit SHA, workflow file, runner image, and Bun / Node versions used to build the artifact. Machine-readable index lives in release-manifest.json.

3. Sigstore keyless (cosign)

A second, independent verification path that doesn't rely on GitHub tooling. Signatures anchor to Sigstore's public transparency log. Requires cosign.

cosign verify-blob avar-vX.Y.Z-linux-x64.tar.gz \
  --bundle avar-vX.Y.Z-linux-x64.tar.gz.cosign.bundle \
  --certificate-identity-regexp \
      'https://github.com/Aarmatix/avar/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer \
      https://token.actions.githubusercontent.com
# ->  Verified OK

The certificate identity binds the signature to our exact workflow file. Any signer with a different identity — even from another Aarmatix repo — fails verification.

Homebrew

brew install aarmatix/tap/avar installs the exact same tarball; the formula pins the SHA-256, so the tap gives you path #1 for free. For paths #2 and #3, run the commands above against the artifact Homebrew downloaded into its cache (~/Library/Caches/Homebrew/downloads/ on macOS).

What's not yet signed

We do not yet ship Apple-notarized or Windows Authenticode binaries. That means macOS Gatekeeper shows a warning on first launch and there is no Windows build. Both are on the roadmap; until then, the three verification paths above give you an independent way to check integrity and provenance — they do not remove the OS warning.

Verifying a receipt instead of a binary? /verify →