clipscrub v0.3.0-build.10
Verify what you downloaded
Two artifacts, two different checks.
The clipscrub CLI attached below was built in this run, from this repo, at v0.3.0-build.10. It carries a build provenance attestation, so you can check it against the source yourself:
gh release download v0.3.0-build.10 --repo tugboatcoding/clipscrub-core --pattern clipscrub-macos-universal.tar.gz
gh attestation verify clipscrub-macos-universal.tar.gz --repo tugboatcoding/clipscrub-core
tar -xzf clipscrub-macos-universal.tar.gz
Keep the extracted ClipscrubKit_ClipscrubKit.bundle beside the binary. It holds the ruleset and name list, and the tool cannot start without it.
The ClipScrub app disk image from clipscrub.com holds a closed-source app, built and Developer ID signed on a maintainer machine, so it cannot be attested here. It carries a published checksum instead:
shasum -a 256 ClipScrub.dmg
The disk image that was live when this tag was cut hashed to:
ClipScrub.dmg version=0.3.0 build=10 sha256=b93e4fb10e596d24c044f766ba7c7d686cf6c22853a8f2761379215a8de10d03
If you downloaded ClipScrub since then, that is a newer disk image and a different hash. Check it against the newest release: https://github.com/tugboatcoding/clipscrub-core/releases/latest