Skip to main content
Observal release artifacts have GitHub keyless Sigstore provenance attestations. Release tags created after this policy was introduced are signed separately with gitsign. These checks prove different things:
  • Artifact verification binds a downloaded file and its SHA-256 digest to the Observal release workflow.
  • Tag verification binds a Git tag to the same GitHub Actions workflow identity.
Historical tags may be unsigned. Never treat an artifact checksum alone as proof of origin.

Download the release

For a release produced by the release-branch pipeline, replace v1.14.0 and release/1.14 below with the exact version and minor line you want to verify:

Check the downloaded bytes

The release includes checksums.txt:
On macOS, use shasum -a 256 --check checksums.txt.

Verify artifact provenance

Install the GitHub CLI and verify each artifact you intend to run:
Use the downloaded server archive or another CLI binary in place of observal-linux-x64. A successful result verifies the artifact digest, Sigstore certificate chain, source repository, and release workflow identity. GitHub keyless signing uses short-lived credentials issued to the workflow. Observal has no long-lived release private key stored on GitHub Releases or another download site.

Verify a release tag

Install gitsign, clone the repository, and fetch the tag:
The expected Fulcio certificate identity is the release workflow on the exact matching refs/heads/release/X.Y branch. The expected OIDC issuer is GitHub Actions. Verification also checks the signature’s transparency-log evidence. A signed tag does not replace artifact provenance verification. Verify both when establishing the source commit and the exact downloaded bytes matters. Historical releases made before the release-branch migration used refs/heads/main as their signing identity. Verify those historical artifacts against that original identity explicitly. The new publishing workflow never falls back to the historical identity or accepts an unsigned tag.