Reference Verifying a release

Docs Reference

Verifying a release

The release workflow signs checksums.txt with cosign keyless signing, pinned to that workflow's identity. Verify it before you trust a binary you downloaded by hand.

On this page

With cosignLink to this section

cosign verify-blob \
  --certificate checksums.txt.pem --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github\.com/constle/constle/\.github/workflows/release\.yaml@refs/tags/v' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  checksums.txt
sha256sum --check --ignore-missing checksums.txt

The two

--certificate-* flags are not optional Keyless signing has no fixed public key. Without pinning the identity, cosign will report Verified OK for a file signed by anyone. Pinning to constle/constle's release workflow is what turns the signature into proof it came from there.

ProvenanceLink to this section

gh attestation verify constle_<version>_linux_amd64.tar.gz --repo constle/constle

What the installer doesLink to this section

curl -fsSL https://constle.dev/install | sh (and iwr -useb https://constle.dev/install.ps1 | iex on Windows) fetches checksums.txt for the release it is installing and refuses to unpack an archive whose SHA-256 does not match. When cosign is on your PATH it checks the signature over checksums.txt first, pinned exactly as above, and aborts if that fails. Without cosign it says so on the terminal and enforces the checksum alone.

Downloading an archive by hand from the releases page skips all of this: verify it yourself as above.

Making the signature mandatoryLink to this section

CONSTLE_REQUIRE_SIGNATURE=1 makes the installer refuse any install whose signature it cannot verify.

Check that the release is signed first

The README currently says both that every release ships a signed checksums.txt and that no release publishes a signature yet, so that this setting refuses every install. Before relying on it, check that the release you want lists checksums.txt.sig and checksums.txt.pem among its assets.

The installer URLs are redirects to scripts/install and scripts/install.ps1 on the Constle repository's main branch. Reporting a way around the installer's checks is in scope for a security report.

Something wrong or unclear? Open an issue. The specifications on these pages are copies of spec/ in constle/constle.