# Release integrity

> How a release binary is built, checked, and signed before it reaches you.

Source: https://refpoint.dev/docs/guides/release-integrity

A release is one statically linked binary per platform, built and checked in
CI, listed in a signed checksums file.

## The binary

No C library is linked. The binary carries no runtime dependency on the host
that runs it.

## Checks on every commit

| Check | What it catches |
|---|---|
| Vet pass | Suspicious constructs the compiler accepts |
| Security linter | Known insecure patterns in the source |
| Reachability vulnerability scan | Published vulnerabilities in dependency code that is actually reached |
| Dependency, secrets and misconfiguration scan | Vulnerable modules, committed secrets, unsafe configuration |
| Test suite under the race detector | Data races |
| Fuzz pass | Crashes in the variable, waiver and inventory file parsers |

Every tool is pinned to an exact version. An advisory that is accepted rather
than fixed is recorded in the repository with a written reason, so the
exception set stays readable instead of becoming a blanket suppression.

## What a release carries

| Artifact | Purpose |
|---|---|
| One archive per platform | Linux and macOS on amd64 and arm64, Windows on amd64 |
| `checksums.txt` | A SHA-256 for every artifact in the release |
| A software bill of materials per archive | Every module compiled into that binary |
| A keyless signature over `checksums.txt` | One signature covers every artifact the file lists |

Report signing is a separate mechanism, described under
[evidence and attestation](/docs/guides/evidence-and-attestation). The
[installation](/docs/getting-started/installation#verify-what-you-downloaded)
page shows how to verify a download.