Verify Skill Doctor release binaries with Cosign and SHA-256

Release binaries are built in isolated CI, hashed into SHA256SUMS.txt and signed with keyless Sigstore Cosign (GitHub OIDC). Download SHA256SUMS.txt, SHA256SUMS.txt.bundle and your binary from the release page, then:

Verify the checksum signature

cosign verify-blob \
  --bundle SHA256SUMS.txt.bundle \
  --certificate-identity-regexp '^https://github\.com/KalarisLabs/Skill-Doctor/\.github/workflows/release\.yml@refs/tags/v.*$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  SHA256SUMS.txt

This proves SHA256SUMS.txt was produced by Skill Doctor’s release workflow on a version tag.

Verify the binary digest

sha256sum -c SHA256SUMS.txt --ignore-missing

Inspect the SBOM (optional)

List every bundled component and its license from the CycloneDX SBOM:

jq -r '.components[] | "\(.name) \(.version) (\(.licenses[0].license.id // "unknown"))"' skill-doctor.cdx.json

Report a vulnerability

Report security issues privately through GitHub Security Advisories or email security@kalarislabs.com.

⌘I

Get started

Guides

Reference

Verify Skill Doctor release binaries with Cosign and SHA-256

Report a vulnerability

​Report a vulnerability

Report a vulnerability