---
title: "Verify a release"
description: "Check a MainSDK release before you install it: checksums, Sigstore signatures, SLSA provenance and the SBOM, with one command."
section: "guides"
status: "Planned for 0.5"
spec: "public-beta"
canonical: "https://mainsdk.dev/docs/guides/verify-a-release"
updated: "2026-10-28"
---

# Verify a release

> Check a MainSDK release before you install it: checksums, Sigstore signatures, SLSA provenance and the SBOM, with one command.

Status: Planned for 0.5 · Canonical: https://mainsdk.dev/docs/guides/verify-a-release · Updated: 2026-10-28

Every MainSDK release candidate ships with checksums, a Sigstore signature per package, SLSA build provenance and a CycloneDX SBOM. Check them before you install.

## Check a downloaded release

Download the release assets into a folder, then run the verifier from a clone of the repository:

```bash
python3 tools/verify_release.py ./release --require-cosign --commit <the release commit>
```

It checks that:

- every package matches its line in `SHA256SUMS`
- every package has a Sigstore bundle that signs the same digest (and, with [cosign](https://docs.sigstore.dev/) installed, that the signature verifies)
- the provenance names every package and the commit the release was built from
- the SBOM is a CycloneDX document

It exits 0 when all pass and 1 naming each file that fails. Without cosign it still checks the structure and says so; `--require-cosign` turns that gap into a failure.

## What publishing needs

No package is published until the owner approves its name in `.github/release-approvals.yaml`. Until then the release workflow runs a dry run only and says that publishing is blocked pending owner approval.