Verifying releases

Every sgl release is built by the Release workflow in .github/workflows/release.yml, from a v* tag, on GitHub-hosted runners. Each GitHub release carries, for every platform archive (sgl-<version>-<os>-<arch>.tar.gz, or .zip for Windows):

File	What it is
`<archive>.sig`	A keyless cosign signature.
`<archive>.cert`	The signing certificate, issued by Sigstore to the release workflow.
`<archive>.sbom.cdx.json`, `<archive>.sbom.spdx.json`	Software bills of materials (CycloneDX and SPDX), generated by syft.
`checksums-sha256.txt`	SHA-256 digests of every archive.

Inside each archive, SHA256SUMS lists the digest of the sgl binary, and THIRD-PARTY-NOTICES.txt holds the licences of every dependency compiled in.

Download the archive, checksum file, signature and certificate from the selected release into one directory. The examples below use the filename form for v0.0.0-alpha.1 on linux/amd64; substitute an actually published tag and your platform. You need sha256sum, cosign and the GitHub CLI for these checks.

1. Check the digest

sha256sum --check --ignore-missing checksums-sha256.txt

2. Check the signature

The certificate must name the release workflow of this repository, at the tag you downloaded, and Sigstore must have issued it to GitHub Actions:

cosign verify-blob \
  --certificate sgl-0.0.0-alpha.1-linux-amd64.tar.gz.cert \
  --signature sgl-0.0.0-alpha.1-linux-amd64.tar.gz.sig \
  --certificate-identity "https://github.com/piko-sh/seagull/.github/workflows/release.yml@refs/tags/v0.0.0-alpha.1" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  sgl-0.0.0-alpha.1-linux-amd64.tar.gz

Verified OK means the archive is byte-for-byte what the workflow signed.

3. Check the build provenance

The workflow also records a SLSA build provenance attestation for every archive. With the GitHub CLI:

gh attestation verify sgl-0.0.0-alpha.1-linux-amd64.tar.gz --repo piko-sh/seagull

This confirms which commit, workflow and runner produced the archive.

4. Check the binary

After unpacking:

sha256sum --check SHA256SUMS
./sgl version

sgl version prints the version the binary was built as; it must match the tag.

Installing with Go

go install seagull.sh/seagull/cmd/[email protected] and go get -tool build from source. The Go checksum database (sum.golang.org) verifies the module contents against the first download anyone made, so a tag cannot be changed after release without the mismatch being reported.