Verify artifact signatures
All release artifacts are signed with Sigstore Cosign (keyless).
Each artifact has a matching .sigstore.json bundle that proves it was built by this repository's GitHub Actions workflow.
# Install cosign: https://docs.sigstore.dev/cosign/system_config/installation/
cosign verify-blob <ARTIFACT_FILE> \
--bundle <ARTIFACT_FILE>.sigstore.json \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp "github.com/derek-rein/exr-converter"macOS note
These builds use an ad-hoc code signature. On first launch, right-click the app and select Open, or run:
xattr -cr "/Applications/EXR Converter.app"Full Changelog: v0.2.1...v0.2.2