Authoritative project documentation

Verify an ApiaryLens Release

Download an artifact from the matching release page, verify its SHA-256 against the release manifest, and then verify the repository attestation:

Get-FileHash .\apiarylens-0.1.0-preview.1-compose-a21796d1cb07.tar.gz -Algorithm SHA256
gh attestation verify .\apiarylens-0.1.0-preview.1-compose-a21796d1cb07.tar.gz `
  --repo ApiaryLens/apiarylens `
  --signer-workflow ApiaryLens/apiarylens/.github/workflows/release-signing.yml

On Linux or macOS, use sha256sum for the first step. Apply the same attestation command to the Cloudflare and Compose archives, SBOM, license report, and provenance statement.

For later offline verification, download the attestation and trusted root while online:

gh attestation download <artifact> --repo ApiaryLens/apiarylens
gh attestation trusted-root > trusted_root.jsonl

Then use gh attestation verify <artifact> --bundle <downloaded.jsonl> --custom-trusted-root trusted_root.jsonl on the disconnected system. Verification must name the official repository and signer workflow; trusting only a checksum or an attestation from an arbitrary fork is insufficient.