v0.6.0
🔐 Verifying the artifacts
All release artifacts (executables and packages for every OS) are included in the signed checksums.txt file.
How to verify:
- Download
checksums.txt,checksums.txt.sig, andchecksums.txt.pemfrom the release. - Run this command:
cosign verify-blob \
--cert checksums.txt.pem \
--signature checksums.txt.sig \
--certificate-identity "https://github.com/CPToolset/xcsp-launcher/.github/workflows/release.yml@refs/heads/main" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
checksums.txtIf the output is Verified OK, you can then validate the integrity of the downloaded files:
sha256sum --ignore-missing -c checksums.txt