Verify: cosign verify-blob --bundle checksums.txt.sigstore.json --certificate-identity-regexp 'https://github.com/ows4444/cli-acline/' --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt, then sha256sum -c checksums.txt --ignore-missing. Build provenance: gh attestation verify <file> --repo ows4444/cli-acline.