Release Verification
Release archives are accompanied by SHA-256 checksums. Published release workflows can also provide keyless signature bundles tied to the official source repository and release workflow identity.
Verification Sequence
1. Download the release archive, checksum file, and available signature bundle from the same release. 2. Verify the checksum before extracting or executing the archive. 3. Verify the signature against the expected repository workflow identity and trusted OIDC issuer. 4. Confirm the embedded version matches the intended release. 5. Retain verification evidence with the deployment or security review record.
A valid signature establishes artifact provenance for the stated workflow. It does not replace review of release notes, compatibility, configuration, or the authority granted to the tool.