Skip to content

Verifying Releases

Jump to bottom
Ratomir Jovanovic edited this page Oct 28, 2026 · 7 revisions

Verifying releases

Every release carries SHA256SUMS, a CycloneDX SBOM (pandaward.cdx.json) and signed build provenance and SBOM attestations. The binaries are reproducible: rebuilding the tag with the Go version from go.mod gives byte-identical files.

Quick check with the GitHub CLI:

gh release download v0.2.0 -R ratomirjovanovic/pandaward
sha256sum -c SHA256SUMS
gh attestation verify pandaward-linux-amd64 -R ratomirjovanovic/pandaward

The plugin branches (plugin, plugin-windows) contain the same binaries with a bin/SHA256SUMS. On macOS and Linux the plugin's launcher checks the binary against that file before every run and refuses a mismatch.

The full procedure, including the SBOM attestation and a local rebuild, is in docs/VERIFYING.md.

Pandaward is AGPL-3.0-only. Not a certification or signed penetration test. Report a vulnerability.

Home

Getting started

Using

Reference

Clone this wiki locally