Release integrity
How a release binary is built, checked, and signed before it reaches you.
On this page
A release is one statically linked binary per platform, built and checked in CI, listed in a signed checksums file.
The binary
No C library is linked. The binary carries no runtime dependency on the host that runs it.
Checks on every commit
| Check | What it catches |
|---|---|
| Vet pass | Suspicious constructs the compiler accepts |
| Security linter | Known insecure patterns in the source |
| Reachability vulnerability scan | Published vulnerabilities in dependency code that is actually reached |
| Dependency, secrets and misconfiguration scan | Vulnerable modules, committed secrets, unsafe configuration |
| Test suite under the race detector | Data races |
| Fuzz pass | Crashes in the variable, waiver and inventory file parsers |
Every tool is pinned to an exact version. An advisory that is accepted rather than fixed is recorded in the repository with a written reason, so the exception set stays readable instead of becoming a blanket suppression.
What a release carries
| Artifact | Purpose |
|---|---|
| One archive per platform | Linux and macOS on amd64 and arm64, Windows on amd64 |
checksums.txt |
A SHA-256 for every artifact in the release |
| A software bill of materials per archive | Every module compiled into that binary |
A keyless signature over checksums.txt |
One signature covers every artifact the file lists |
Report signing is a separate mechanism, described under evidence and attestation. The installation page shows how to verify a download.