Downloads

Download sgl.

Add sgl to your Go module as a tool, so everyone on the project runs the same version. Prebuilt archives for macOS, Linux and Windows are signed with Sigstore and ship with software bills of materials.

Have Go 1.27? Add it as a tool:or install it on your path with go install seagull.sh/seagull/cmd/sgl@latest, or as seagull with go install seagull.sh/seagull/cmd/seagull@latest

Pre-release · Expect breaking changes between releases

Older releases

v0.0.0-alpha.1Pre-release18 Oct 2026
View on GitHub

Commits

Full Changelog: https://github.com/piko-sh/seagull/commits/v0.0.0-alpha.1

Command-line archives

Checksums

Verify a download

Check what you install.

The release workflow signs every archive and SBOM with keyless Sigstore signing, and records GitHub build provenance for each archive. Check a file before you run it.

Verify the signature

Download the archive with its .sig and .cert files, then check them against the release workflow's exact identity with Cosign 2.x.

tag='v0.0.0-alpha.2'
archive='sgl-0.0.0-alpha.2-linux-amd64.tar.gz'
cosign verify-blob "$archive" \
  --signature "$archive.sig" \
  --certificate "$archive.cert" \
  --certificate-identity "https://github.com/piko-sh/seagull/.github/workflows/release.yml@refs/tags/$tag" \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

Keep the identity exact rather than a broad pattern. Stop if a file is missing or verification fails.

Check the build provenance

Each archive also has a GitHub build-provenance attestation, separate from its detached signature. Check it with the GitHub CLI.

gh attestation verify "$archive" --repo piko-sh/seagull

Compare checksums

Download checksums-sha256.txt next to your archives and check the ones you have.

sha256sum --check --ignore-missing checksums-sha256.txt

The checksums are not signed. They catch a damaged download; only the signature shows where an archive came from.

Inspect the SBOMs

Each archive has .sbom.cdx.json and .sbom.spdx.json files, each with its own .sig and .cert. Verify them with the same Cosign command, then read the components.

jq -r '.components[].name' "$archive.sbom.cdx.json"

An SBOM lists what is packaged. A valid signature does not mean those components are free of vulnerabilities.

Use the library

Add Seagull to your Go module

go get seagull.sh/seagull
Use it from Go →
Build from source

Clone and build the CLI

git clone https://github.com/piko-sh/seagull
cd seagull
go build ./cmd/sgl
Installation and first steps →