# Verify release downloads

Check CLI and desktop downloads against their SHA-256 hashes and authenticate the signed checksum files.

Source: https://debark.dev/docs/trust/release-downloads

---
The [download page](/download) shows the SHA-256 hash of each published CLI and desktop
asset, with links to signed checksum files. Always use files from the **same release**.

| Product | Checksum file              | Signature                      | Certificate                    |
| ------- | -------------------------- | ------------------------------ | ------------------------------ |
| CLI     | `debark_checksums.txt`     | `debark_checksums.txt.sig`     | `debark_checksums.txt.pem`     |
| Desktop | `debark-gui_checksums.txt` | `debark-gui_checksums.txt.sig` | `debark-gui_checksums.txt.pem` |

These signatures authenticate Debark's release workflow. They are separate from the
[operator keys](/docs/trust/signing) you create to sign your own package bundles.

## 1. Download the archive and verification files

This example pins CLI **v0.1.1 for Linux amd64**. Change the version and architecture
to match your chosen [release](https://github.com/inferops/debark/releases). Use a clean
directory so the checksum results are easy to review:

```bash
version=0.1.1
archive="debark_${version}_linux_amd64.tar.gz"
base="https://github.com/inferops/debark/releases/download/v${version}"
for file in "$archive" debark_checksums.txt debark_checksums.txt.sig debark_checksums.txt.pem; do
  curl -fSL "$base/$file" -o "$file" || break
done
```

Stop if a file fails to download. On Windows, download the ZIP and the three verification
files from the [CLI section](/download#cli) into one directory instead.

## 2. Authenticate the checksum file

Install [Cosign](https://docs.sigstore.dev/cosign/system_config/installation/) on the online
computer. Check the certificate against the **exact repository, release workflow, and tag**:

```bash
cosign verify-blob debark_checksums.txt \
  --signature debark_checksums.txt.sig \
  --certificate debark_checksums.txt.pem \
  --certificate-identity "https://github.com/inferops/debark/.github/workflows/release.yml@refs/tags/v${version}" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
```

Continue only if verification succeeds. Do not skip an identity, issuer, or signature failure.
These commands were verified with Cosign 3.1.3 against both products in v0.1.1. Cosign
prints deprecation notices for the detached signature and certificate flags used by these
releases; the successful result is `Verified OK`.
The [release notes](https://github.com/inferops/debark/releases) and
[release guide](https://github.com/inferops/debark/blob/main/gui/docs/release.md#6-signing-and-provenance)
describe the published signing format. Perform this check online before transferring files.

For the desktop app, replace all three `debark_checksums.txt` filenames with their
`debark-gui_checksums.txt` equivalents. The workflow identity is the same for both products.

In PowerShell, use the same Cosign arguments on one line, replacing `${version}` with
the selected version, such as `0.1.1`.

## 3. Check the downloaded file

On Linux, using the `archive` variable from step 1, require a matching checksum entry
and check exactly that archive:

```bash
awk -v name="$archive" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' \
  debark_checksums.txt > selected-checksum.txt &&
sha256sum -c selected-checksum.txt
```

Expect the named archive followed by `OK`. A missing entry or a mismatch is a failure;
do not extract or install it. To check a `.deb`, `.rpm`, or desktop archive, set `archive`
to that exact filename and choose the matching product's checksum file.

On Windows, compute the SHA-256 in PowerShell:

```powershell
Get-FileHash .\debark_0.1.1_windows_amd64.zip -Algorithm SHA256
```

Compare the entire hash with the entry for that exact filename in the authenticated
`debark_checksums.txt`. Uppercase versus lowercase hexadecimal does not matter.
The download cards also provide copyable hashes for a quick integrity check.

## What the installer checks

The [Linux CLI installer](/install.sh) checks the archive against its published SHA-256
before extracting the executable. It does **not** run Cosign or authenticate the checksum
file's signature. The manual process above adds publisher authentication.

A checksum fetched beside a download detects corruption or mismatched files. It does not
independently protect against a compromised download source. A verified release signature
still does not establish that software is free of vulnerabilities.

## SBOMs and provenance

Archive cards link to their SPDX JSON SBOMs. The GUI SBOM describes its Go modules;
system GTK and WebKitGTK libraries are resolved by apt and are listed in the `.deb`
runtime dependencies. Check the actual release assets for any attached provenance;
workflow configuration alone is not evidence that provenance was published.

<NextSteps
  items={[
    {
      title: 'Install the CLI',
      href: '/docs/get-started/installation',
      description: 'Install the verified binary on each machine.',
    },
    {
      title: 'Use the desktop app',
      href: '/docs/get-started/desktop',
      description: 'Install the GUI and its CLI companion.',
    },
    {
      title: 'Sign a bundle',
      href: '/docs/trust/signing',
      description: 'Create your own operator signing key.',
    },
  ]}
/>