Skip to main content
Ghostable release pipelines now publish integrity artifacts for each release channel:
  • SHA256SUMS for published binaries/packages
  • Software bill of materials (SBOM)
  • Signed provenance attestations
Use these artifacts before promoting a release into production.

​
CLI Verification

For CLI releases, release assets include:
  • the published package tarball (*.tgz)
  • SHA256SUMS
  • cli-sbom.cdx.json

​
1. Verify SHA256 checksum

shasum -a 256 -c SHA256SUMS

​
2. Review SBOM

cat cli-sbom.cdx.json | jq '.metadata.component.name, .metadata.component.version'

​
3. Verify provenance attestation

If you’re using GitHub attestation verification: 
gh attestation verify *.tgz --repo ghostable-dev/cli

​
Desktop Verification

For desktop releases, verify:
  • the downloaded DMG (Ghostable-*.dmg)
  • SHA256SUMS
  • desktop-sbom.spdx.json

​
1. Verify SHA256 checksum

shasum -a 256 -c SHA256SUMS

​
2. Verify notarization and signing (macOS)

spctl -a -vv Ghostable-*.dmg
codesign -dv --verbose=4 /Applications/Ghostable.app

​
3. Verify provenance attestation

Desktop provenance attestations are generated in CI for Ghostable’s internal supply-chain controls. Because the desktop source repository is private, external users typically rely on:
  • SHA256SUMS validation
  • macOS notarization/signing verification (spctl + codesign)

​
Server Verification

For the Ghostable server/API service, release assets include:
  • the release archive (ghostable-*.tar.gz)
  • SHA256SUMS
  • ghostable-sbom.spdx.json

​
1. Verify SHA256 checksum

shasum -a 256 -c SHA256SUMS

​
2. Review SBOM

cat ghostable-sbom.spdx.json | jq '.name, .version'

​
3. Verify provenance attestation

gh attestation verify ghostable-*.tar.gz --repo ghostable-dev/ghostable

​
Operational Guidance

  • Store release artifacts and attestations in your internal artifact registry.
  • Gate production rollout on successful checksum + attestation verification.
  • Keep SBOM snapshots with change tickets for audit evidence.

​
Notes for private desktop/server channels

  • When a release channel is private (for example desktop), publish a short checksum and SBOM digest summary in customer-facing docs so you can still verify integrity through a trusted internal channel.