/
StarGet Started
On this page

Verify a release

Check signatures, checksums and provenance before you install.

Every release has SHA256SUMS, a Sigstore signature of it (SHA256SUMS.sigstore.json), SBOMs (bunzzle.spdx.json, bunzzle.cdx.json) and GitHub build provenance. Signatures are keyless: they prove the files were built by this repository’s release workflow from the tagged commit.

Binaries

cosign verify-blob SHA256SUMS \
  --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/bunzzle/bunzzle/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

Or with the GitHub CLI:

gh attestation verify bunzzle-linux-x64 --repo bunzzle/bunzzle

Container image

cosign verify ghcr.io/bunzzle/bunzzle:v0.2.0 \
  --certificate-identity-regexp '^https://github.com/bunzzle/bunzzle/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/bunzzle/bunzzle:v0.2.0 --repo bunzzle/bunzzle

What’s inside

The SBOMs list every dependency. At runtime that is Bun alone, compiled into the binary: Bunzzle has no runtime dependencies. The image is debian:bookworm-slim plus the binary, both pinned by digest.

esc