clipscrub v0.4.0-build.12
Verify what you downloaded
Two artifacts, two different checks.
The clipscrub CLI attached below was built in this run, from this repo, at v0.4.0-build.12. It carries a build provenance attestation, so you can check it against the source yourself:
gh release download v0.4.0-build.12 --repo tugboatcoding/clipscrub-core --pattern clipscrub-macos-universal.tar.gz
gh attestation verify clipscrub-macos-universal.tar.gz --repo tugboatcoding/clipscrub-core
tar -xzf clipscrub-macos-universal.tar.gz
Keep the extracted ClipscrubKit_ClipscrubKit.bundle beside the binary. It holds the ruleset and name list, and the tool cannot start without it.
The ClipScrub app disk image from clipscrub.com holds a closed-source app, built and Developer ID signed on a maintainer machine, so it cannot be attested here. It carries a published checksum instead:
shasum -a 256 ClipScrub.dmg
The disk image that was live when this tag was cut hashed to:
ClipScrub.dmg version=0.4.0 build=12 sha256=2bae0be3be31d0e416b4dba610a965cedd1b639ceec9cf112bffd7b2a8c57767
If you downloaded ClipScrub since then, that is a newer disk image and a different hash. Check it against the newest release: https://github.com/tugboatcoding/clipscrub-core/releases/latest