Verify what you downloaded
Two artifacts, two different checks.
The clipscrub CLI attached below was built in this run, from this repo, at v0.5.0-build.18. It carries a build provenance attestation, so you can check it against the source yourself:
gh release download v0.5.0-build.18 --repo tugboatcoding/clipscrub-core --pattern clipscrub-macos-universal.tar.gz
gh attestation verify clipscrub-macos-universal.tar.gz --repo tugboatcoding/clipscrub-core
tar -xzf clipscrub-macos-universal.tar.gz
Keep the extracted ClipscrubKit_ClipscrubKit.bundle beside the binary. It holds the ruleset and name list, and the tool cannot start without it.
The ClipScrub app disk image from clipscrub.com carries a published checksum:
shasum -a 256 ClipScrub.dmg
The disk image that was live when this tag was cut hashed to:
ClipScrub.dmg version=0.5.0 build=18 sha256=c0905fbed5037ecb796a93e20087a3b45e26341b6c1cbf6e53dfa80a7c4e5532
If you downloaded ClipScrub since then, that is a newer disk image and a different hash. Check it against the newest release: https://github.com/tugboatcoding/clipscrub-core/releases/latest