Download

To ensure the release you have was actually packaged by us and not a malicious entity, you can verify the signature provided with each release.

We use a tool calledCosignto create signatures, so you will need this tool to verify the releases.

You will also need the public key used to sign the releases.Download it here.

Once you have bothCosign and thepublic key, you can verify a release with the following command:

$ cosign verify-blob /path/to/release --bundle /path/to/release.bundle --key /path/to/cosign.pub

For /path/to/release and /path/to/release.bundle use the paths to the release files you downloaded from the above section.