releases: verification anchor and pointers

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Codex
2026-08-24 15:55:38 +02:00
co-authored by Claude Fable 5
commit 819c8a469a
+18
View File
@@ -0,0 +1,18 @@
# Attesto releases
Versioned release pages for the Attesto platform. Every asset is copied from
the canonical, KMS-signed download host **https://get.attesto.eu** and is
covered by the attached `*-SHA256SUMS` manifest with its cosign signature
(`*-SHA256SUMS.sig`, public key: https://get.attesto.eu/cosign.pub).
Verify any download:
```
cosign verify-blob --key https://get.attesto.eu/cosign.pub --insecure-ignore-tlog \
--signature attesto-0.5.0-SHA256SUMS.sig attesto-0.5.0-SHA256SUMS
sha256sum -c --ignore-missing attesto-0.5.0-SHA256SUMS
```
Sources and packaging live in the private `attesto-v1` repository
(`ops/get-host/`); the Homebrew tap is
https://git.attesto.eu/attesto/homebrew-attesto.