1.5.1 - 2026-10-03

Release Notes

Added

• Build attestations on every release artifact. Each binary archive now
  ships with a Sigstore-backed GitHub attestation tying it to
  vericto/vericto-cli, the release workflow and the source commit; verify one
  with gh attestation verify <artifact> --repo vericto/vericto-cli. The Docker
  image gets the same, pushed to GHCR next to it
  (gh attestation verify oci://ghcr.io/vericto/vericto-cli:<tag> --repo vericto/vericto-cli). They were
  wired in but off while the repository was a user-owned private one, where
  GitHub does not offer attestations. SHA-256 checksums still ship alongside, so
  nothing changes for anyone verifying that way.

Install vericto-cli 1.5.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/vericto/vericto-cli/releases/download/v1.5.1/vericto-cli-installer.sh | sh

Install prebuilt binaries into your npm project

npm install @vericto/vericto-cli@1.5.1

Download vericto-cli 1.5.1

File	Platform	Checksum
vericto-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
vericto-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
vericto-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
vericto-cli-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
vericto-cli-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo vericto/vericto-cli

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>