Skip to content

v1.8.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Sep 00:32
· 2 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.8.0
This tag was signed with the committer’s verified signature.
theMobiusStrip Evan Zheng
GPG key ID: 234FADE54090AA29
Verified
Learn about vigilant mode.
eee48f4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Install

Requires an Apple silicon Mac (M1 or later), macOS 14+. The DMG is arm64-only; Intel Macs are not supported.

  1. Download the .dmg below
  2. Open it and drag Perch to Applications
  3. First launch only — Perch is open-source and ad-hoc signed, not Apple-notarized, so macOS asks once:
    • macOS 14 (Sonoma): right-click Perch.app → Open → click Open
    • macOS 15+ (Sequoia): double-click Perch.app, close the warning, then open System Settings → Privacy & Security, scroll down, and click Open Anyway
  4. Launch Perch, then open Monitoring Setup… from the menu bar.
    Install monitoring for Claude Code and/or Codex, restart each configured agent,
    and confirm Live verification receives a real event.

Verify your download

Download the .dmg, .sha256, and .sha256.asc files into the same folder.

Step 1 — Integrity: the DMG matches the published checksum

cd ~/Downloads
shasum -a 256 --check "Perch-1.8.0-arm64.dmg.sha256"
# expected: Perch-…-arm64.dmg: OK

Step 2 — Maintainer signature: the checksum was signed by Perch's maintainer

curl -fsSL https://github.com/theMobiusStrip.gpg | gpg --import
gpg --verify \
  "Perch-1.8.0-arm64.dmg.sha256.asc" \
  "Perch-1.8.0-arm64.dmg.sha256"
# expected: Good signature from "Evan Zheng …"

A "not certified with a trusted signature" warning is normal unless you have
independently marked the maintainer key as trusted. The signature must still be good.

Step 3 — Build provenance: the DMG came from Perch's release workflow and tag

gh attestation verify "Perch-1.8.0-arm64.dmg" \
  --repo theMobiusStrip/perch \
  --signer-workflow theMobiusStrip/perch/.github/workflows/release.yml \
  --source-ref "refs/tags/v1.8.0"

The provenance check requires the GitHub CLI. It binds the DMG digest to this repository, release workflow, and tag.

Assets 6
Loading