Verify a release
Validate Wrightbench installers with checksums, an SPDX SBOM and GitHub attestations.
Each stable GitHub release publishes installers alongside SHA256SUMS and an SPDX JSON software bill of materials.
Verify a SHA-256 digest
Download the installer and SHA256SUMS from the same release. Compute the installer digest and compare it with the matching line in the checksum file.
shasum -a 256 Wrightbench-0.1.0-mac-arm64.dmgInspect the SBOM
The wrightbench-<version>.spdx.json asset describes the packaged application's production dependency inventory in SPDX JSON format.
Check provenance
The release workflow publishes GitHub artifact attestations for its artifacts. Open the release in GitHub to inspect the associated build provenance before installing.