Download Pipit.

Verify the signature

Download the archive with its .sig and .cert files, then check them against the release workflow's exact identity with Cosign 2.x.

tag='v0.0.0-alpha.8'
archive='pipit-0.0.0-alpha.8-linux-amd64.tar.gz'
cosign verify-blob "$archive" \
  --signature "$archive.sig" \
  --certificate "$archive.cert" \
  --certificate-identity "https://github.com/piko-sh/pipit/.github/workflows/release.yml@refs/tags/$tag" \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

Keep the identity exact rather than a broad pattern. Stop if a file is missing or verification fails.

Check the build provenance

Each archive also has a GitHub build-provenance attestation, separate from its detached signature. Check it with the GitHub CLI.

gh attestation verify "$archive" --repo piko-sh/pipit

Compare checksums

Download checksums-sha256.txt next to your archives and check the ones you have.

sha256sum --check --ignore-missing checksums-sha256.txt

The checksums are not signed. They catch a damaged download; only the signature shows where an archive came from.

Inspect the SBOMs

Each archive has .sbom.cdx.json and .sbom.spdx.json files, each with its own .sig and .cert. Verify them with the same Cosign command, then read the components.

jq -r '.components[].name' "$archive.sbom.cdx.json"

An SBOM lists what is packaged. A valid signature does not mean those components are free of vulnerabilities.