Verifying Releases

Every jackin❯ release publishes signed artifacts alongside the binaries. This page explains what is available and how to use it.

What you need to do

Nothing. When jackin❯ downloads jackin-capsule for the first time (or after clearing the cache), it automatically verifies a signed manifest before accepting and caching the binary. Subsequent launches reuse the already-verified cached binary. The verification is silent and transparent — you only notice it if something is wrong (in which case the launch aborts with an error message).

The verification tools described below are for operators who want to audit a download themselves, integrate jackin❯ into a supply chain policy, or confirm the integrity of any release asset manually.

What is published per release

Each release includes the following assets for every binary archive (CLI/capsule .tar.gz and the macOS usage menu-bar .zip use the same sidecar layout):

Asset	Purpose
`<name>.tar.gz` or `<name>.zip`	The binary / app archive
`<name>.…sha256`	SHA256 digest of the archive (suffix `.tar.gz.sha256` or `.zip.sha256`)
`<name>.…bundle`	Cosign keyless signature bundle
`<name>.…sbom.json`	CycloneDX SBOM (software bill of materials)

The capsule binary additionally has a signed manifest:

Asset	Purpose
`capsule-manifest.json`	Version + per-architecture SHA256 digests
`capsule-manifest.json.bundle`	Cosign keyless signature bundle for the manifest

Verify with SLSA provenance (GitHub Attestations)

Requires gh CLI (already installed if you used Homebrew to install jackin❯).

gh attestation verify <file> --repo jackin-project/jackin

This checks that the file was produced by a jackin❯ GitHub Actions run and is linked to the source commit. No extra tools required.

Verify everything with one local gate

From a checkout of this repository, download an archive and its sidecars, then run:

cargo xtask release-verify <file>.tar.gz
# or, for the usage menu-bar app:
cargo xtask release-verify jackin-desktop-<VERSION>-aarch64-apple-darwin.zip

The gate checks the archive against the sibling .sha256 sidecar, verifies the .bundle with the same cosign identity and issuer policy shown below, verifies the GitHub artifact attestation for jackin-project/jackin, and parses the .sbom.json sidecar. Extension-agnostic: any archive path with those three siblings works.

For example:

gh release download jackin-dev-v0.1.13 \
  --repo jackin-project/jackin \
  --pattern 'jackin-dev-0.1.13-aarch64-unknown-linux-gnu.tar.gz*' \
  --dir /tmp/jackin-release-check

cargo xtask release-verify \
  /tmp/jackin-release-check/jackin-dev-0.1.13-aarch64-unknown-linux-gnu.tar.gz

The command fails closed. If the archive content changes after the .sha256 file is published, the digest mismatch aborts verification before signature or provenance checks run.

Verify with cosign bundle

Requires cosign installed locally (brew install cosign or mise install cosign).

cosign verify-blob \
  --bundle <file>.bundle \
  --certificate-identity-regexp 'https://github.com/jackin-project/jackin/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  <file>

This verifies the keyless OIDC signature, confirms the certificate was issued to a jackin❯ GitHub Actions workflow, and checks the Sigstore transparency log entry.

To verify the capsule manifest specifically:

cosign verify-blob \
  --bundle capsule-manifest.json.bundle \
  --certificate-identity-regexp 'https://github.com/jackin-project/jackin/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  capsule-manifest.json

Inspect the SBOM

The .sbom.json files are CycloneDX JSON documents listing the binary's file-level and ELF-level dependencies.

# Inspect raw content
jq . <file>.sbom.json

# Validate with cyclonedx-cli (.NET tool, install separately)
cyclonedx validate --input-file <file>.sbom.json

Download release assets

All assets are available at https://github.com/jackin-project/jackin/releases. Preview builds are published to the preview rolling tag; stable releases use versioned v<version> tags.