Verify release downloads

The download page shows the SHA-256 hash of each published CLI and desktop asset, with links to signed checksum files. Always use files from the same release.

Product	Checksum file	Signature	Certificate
CLI	debark_checksums.txt	debark_checksums.txt.sig	debark_checksums.txt.pem
Desktop	debark-gui_checksums.txt	debark-gui_checksums.txt.sig	debark-gui_checksums.txt.pem

These signatures authenticate Debark’s release workflow. They are separate from the operator keys you create to sign your own package bundles.

1. Download the archive and verification files

This example pins CLI v0.1.1 for Linux amd64. Change the version and architecture to match your chosen release. Use a clean directory so the checksum results are easy to review:

version=0.1.1
archive="debark_${version}_linux_amd64.tar.gz"
base="https://github.com/inferops/debark/releases/download/v${version}"
for file in "$archive" debark_checksums.txt debark_checksums.txt.sig debark_checksums.txt.pem; do
  curl -fSL "$base/$file" -o "$file" || break
done

Stop if a file fails to download. On Windows, download the ZIP and the three verification files from the CLI section into one directory instead.

2. Authenticate the checksum file

Install Cosign on the online computer. Check the certificate against the exact repository, release workflow, and tag:

cosign verify-blob debark_checksums.txt \
  --signature debark_checksums.txt.sig \
  --certificate debark_checksums.txt.pem \
  --certificate-identity "https://github.com/inferops/debark/.github/workflows/release.yml@refs/tags/v${version}" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Continue only if verification succeeds. Do not skip an identity, issuer, or signature failure. These commands were verified with Cosign 3.1.3 against both products in v0.1.1. Cosign prints deprecation notices for the detached signature and certificate flags used by these releases; the successful result is Verified OK. The release notes and release guide describe the published signing format. Perform this check online before transferring files.

For the desktop app, replace all three debark_checksums.txt filenames with their debark-gui_checksums.txt equivalents. The workflow identity is the same for both products.

In PowerShell, use the same Cosign arguments on one line, replacing ${version} with the selected version, such as 0.1.1.

3. Check the downloaded file

On Linux, using the archive variable from step 1, require a matching checksum entry and check exactly that archive:

awk -v name="$archive" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' \
  debark_checksums.txt > selected-checksum.txt &&
sha256sum -c selected-checksum.txt

Expect the named archive followed by OK. A missing entry or a mismatch is a failure; do not extract or install it. To check a .deb, .rpm, or desktop archive, set archive to that exact filename and choose the matching product’s checksum file.

On Windows, compute the SHA-256 in PowerShell:

Get-FileHash .\debark_0.1.1_windows_amd64.zip -Algorithm SHA256

Compare the entire hash with the entry for that exact filename in the authenticated debark_checksums.txt. Uppercase versus lowercase hexadecimal does not matter. The download cards also provide copyable hashes for a quick integrity check.

What the installer checks

The Linux CLI installer checks the archive against its published SHA-256 before extracting the executable. It does not run Cosign or authenticate the checksum file’s signature. The manual process above adds publisher authentication.

A checksum fetched beside a download detects corruption or mismatched files. It does not independently protect against a compromised download source. A verified release signature still does not establish that software is free of vulnerabilities.

SBOMs and provenance

Archive cards link to their SPDX JSON SBOMs. The GUI SBOM describes its Go modules; system GTK and WebKitGTK libraries are resolved by apt and are listed in the .deb runtime dependencies. Check the actual release assets for any attached provenance; workflow configuration alone is not evidence that provenance was published.