Skip to content

dcg v0.7.5 — authenticated local DSR release

Latest
Latest

Choose a tag to compare

View all tags
@Dicklesworthstone Dicklesworthstone released this 28 Jul 21:29
v0.7.5
3685646

Authenticated Windows release

This release was built natively on Windows from commit 36856463a6e4745b00c1a64e36ef7955fd7e4145 using DSR because the GitHub Actions release jobs were unavailable.

  • Windows x86_64 installer ZIP SHA256: 56146822a94e45410cc15cfba4d55a409ba7284ed0b048ff2e8bc8c613f50d57
  • Embedded dcg.exe SHA256: 40b33a37d51d212f11fcd47e1f6cb184b88232487f1ef6b463b8ae9da7029b14
  • Minisign key ID: 69B3955C8D2E62A8
  • Cosign public-key DER SHA256: 0e6947743daf39d6413cb25f6c96601427e38885f3a756e9f98f37d66e6df7a4
  • Signed SLSA v1 provenance and the DSR native build manifest are included.

The v0.7.5 installers understand both this pinned local-release cosign key and the existing GitHub Actions OIDC identity. They also reject cosign versions affected by CVE-2026-22703.

Verify the Windows archive

minisign -Vm dcg-x86_64-pc-windows-msvc.zip -x dcg-x86_64-pc-windows-msvc.zip.minisig -P RWSoYi6NXJWzaRs1mJmOwwXrZfPWcq6MXnQlNMLBYKzlIQTLwuVQG6uO
cosign verify-blob --key dcg-cosign-release.pub --bundle dcg-x86_64-pc-windows-msvc.zip.sigstore.json dcg-x86_64-pc-windows-msvc.zip

The exact published ZIP was installed and self-tested successfully on a native Windows Surface Book with mandatory SHA256 and minisign verification plus cosign verification enabled.

Assets 37
Loading