Security Release Integrity

Release Integrity

The release-integrity workflow validates published artifacts with:

• individual SHA-256 manifests;
• SHA-512 manifests where present;
• release-wide SHA-256SUMS.txt;
• release-wide SHA512SUMS.txt;
• release-wide SHA3-512SUMS.txt.

Optional release-manifest signatures are supported through:

• Ed25519;
• HWControl GPG.

The workflow verifies generated signatures before publishing them.

Verification principle

A checksum verifies that the downloaded bytes match the published digest. It does not prove who authored those bytes.