Repository navigation
iOS 1.9.1 (15)
The ad-hoc build 1.9.1 (15) was produced by
this workflow run from commit
534c87b.
| Commit | 534c87bd6f40885d92fc2f2e05b59280d19ec351 |
| Marketing version | 1.9.1 |
| iOS build number | 15 |
| EAS build | 301a49f0-792d-4a0a-baa4-0e05f107e112 |
| Ad-hoc IPA, SHA-256 | e353712fae05c674889cab5d496eb3119dad90295bf2829debaaa271c96c5fca |
| JS bundle, SHA-256 | 55efae3770fe07c6985f06236ad0ce9831581371f7d92ebdebb2f8195aa4b979 |
| Built at | 2026-09-03T21:30:39Z |
Verifying this release
Both artifacts carry a Sigstore attestation signed by
GitHub's identity for this workflow — not by the maintainer. A release published by
hand cannot carry one:
gh attestation verify main.jsbundle --repo oogxdd/coderoamer
The IPA is signed for the iPhones included in the EAS-managed ad-hoc provisioning
profile. Open the linked EAS build page on an eligible iPhone and tap Install.
main.jsbundle is the JavaScript extracted from that exact IPA, so it can be read and
compared against the source at 534c87b.
What this does not prove
This is provenance, not a reproducible build. You are trusting GitHub and Expo — but not
the maintainer's laptop. Nothing here lets you verify the copy after installation: iOS
gives you no way to extract and hash it. What you can check is that the published IPA
came from this public commit through this public workflow run.