Verify the avar binary

Availability. The standalone avar binary is not currently publicly distributed, and there is no public release page, checksum file, build attestation or signature bundle to check today. The steps below are the planned procedure for a future release; they cannot be run yet. To verify a receipt today, use the in-browser verifier or the @avar-standard/verify library on public npm (a library, not a command-line tool).

What a release is planned to contain

Native tarballs: avar-vX.Y.Z-<platform>.tar.gz for darwin-arm64, darwin-x64, linux-x64, linux-arm64, plus a readable source bundle.
SHA256SUMS — one line per artifact.
release-manifest.json — machine-readable index with sha, size, platform, and verification commands.
*.cosign.bundle — Sigstore bundle for each artifact.
GitHub build-provenance attestation (SLSA v1) recorded against every artifact via actions/attest-build-provenance.

1. SHA-256 checksums

The fastest integrity check. Download the artifact and SHA256SUMS from the same release page.

# Linux / macOS
sha256sum -c SHA256SUMS --ignore-missing
# ->  avar-vX.Y.Z-linux-x64.tar.gz: OK

2. GitHub build provenance

Cryptographic proof the binary was built by the release workflow on Aarmatix/avar — not handed over by a maintainer. Requires the GitHub CLI.

gh attestation verify avar-vX.Y.Z-linux-x64.tar.gz \
  --repo Aarmatix/avar
# ->  Loaded 1 attestation
# ->  ✓ Verification succeeded!

The attestation records the exact commit SHA, workflow file, runner image, and Bun / Node versions used to build the artifact. Machine-readable index lives in release-manifest.json.

3. Sigstore keyless (cosign)

A second, independent verification path that doesn't rely on GitHub tooling. Signatures anchor to Sigstore's public transparency log. Requires cosign.

cosign verify-blob avar-vX.Y.Z-linux-x64.tar.gz \
  --bundle avar-vX.Y.Z-linux-x64.tar.gz.cosign.bundle \
  --certificate-identity-regexp \
      '<published-release-workflow-identity>' \
  --certificate-oidc-issuer \
      https://token.actions.githubusercontent.com
# ->  Verified OK

The certificate identity binds the signature to our exact workflow file. Any signer with a different identity — even from another Aarmatix repo — fails verification.

What's not yet signed

We do not yet ship Apple-notarized or Windows Authenticode binaries. That means macOS Gatekeeper shows a warning on first launch. No signed, publicly downloadable Windows CLI release is currently available. Both are on the roadmap. Checksums and signatures show an artifact matches what was published and signed; they do not by themselves establish who the signer is without separately trusted identity material.

Verifying a receipt instead of a binary? /verify →