clipscrub v0.3.0
Verify what you downloaded
Two artifacts, two different checks.
The clipscrub CLI attached below was built in this run, from this repo, at v0.3.0. It carries a build provenance attestation, so you can check it against the source yourself:
gh release download v0.3.0 --repo tugboatcoding/clipscrub-core --pattern clipscrub-macos-universal.tar.gz
gh attestation verify clipscrub-macos-universal.tar.gz --repo tugboatcoding/clipscrub-core
tar -xzf clipscrub-macos-universal.tar.gz
Keep the extracted ClipscrubKit_ClipscrubKit.bundle beside the binary. It holds the ruleset and name list, and the tool cannot start without it.
The ClipScrub app disk image from clipscrub.com holds a closed-source app, built and Developer ID signed on a maintainer machine, so it cannot be attested here. It carries a published checksum instead:
shasum -a 256 ClipScrub.dmg
The disk image that was live when this tag was cut hashed to:
ClipScrub.dmg version=0.3.0 build=9 sha256=b64f976bc131e261727a1f2e48d593e06234b49cd6878ce73acfccaf5d1e91d3
If you downloaded ClipScrub since then, that is a newer disk image and a different hash. Check it against the newest release: https://github.com/tugboatcoding/clipscrub-core/releases/latest