From 819c8a469afb45b9010745bdd8a487cae6637641 Mon Sep 17 00:00:00 2001
From: Codex <jerome@rotz.host>
Date: Mon, 24 Aug 2026 15:55:38 +0200
Subject: [PATCH] releases: verification anchor and pointers

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 README.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 README.md

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..7a8eb96
--- /dev/null
+++ b/README.md
@@ -0,0 +1,18 @@
+# Attesto releases
+
+Versioned release pages for the Attesto platform. Every asset is copied from
+the canonical, KMS-signed download host **https://get.attesto.eu** and is
+covered by the attached `*-SHA256SUMS` manifest with its cosign signature
+(`*-SHA256SUMS.sig`, public key: https://get.attesto.eu/cosign.pub).
+
+Verify any download:
+
+```
+cosign verify-blob --key https://get.attesto.eu/cosign.pub --insecure-ignore-tlog \
+  --signature attesto-0.5.0-SHA256SUMS.sig attesto-0.5.0-SHA256SUMS
+sha256sum -c --ignore-missing attesto-0.5.0-SHA256SUMS
+```
+
+Sources and packaging live in the private `attesto-v1` repository
+(`ops/get-host/`); the Homebrew tap is
+https://git.attesto.eu/attesto/homebrew-attesto.