Verify a release
Check a MainSDK release before you install it: checksums, Sigstore signatures, SLSA provenance and the SBOM, with one command.
Status Status is where the work is: Planned (in a milestone, not started), Building (tickets in progress), Preview (usable, may change), then the stability it ships at.
Stability The promise an interface ships with.
- Stable Follows semantic versioning; breaking changes need a new major, 12 months of overlap and a codemod.
- Beta Usable in production; may change before it becomes stable.
- Experimental May change or go away; needs an explicit opt-in in main.yaml.
Every MainSDK release candidate ships with checksums, a Sigstore signature per package, SLSA build provenance and a CycloneDX SBOM. Check them before you install.
Check a downloaded release
Download the release assets into a folder, then run the verifier from a clone of the repository:
python3 tools/verify_release.py ./release --require-cosign --commit <the release commit>It checks that:
- every package matches its line in
SHA256SUMS - every package has a Sigstore bundle that signs the same digest (and, with cosign installed, that the signature verifies)
- the provenance names every package and the commit the release was built from
- the SBOM is a CycloneDX document
It exits 0 when all pass and 1 naming each file that fails. Without cosign it still checks the structure and says so; --require-cosign turns that gap into a failure.
What publishing needs
No package is published until the owner approves its name in .github/release-approvals.yaml. Until then the release workflow runs a dry run only and says that publishing is blocked pending owner approval.
Was this page helpful?