release-verify

Verify Datarim release tarballs by checking SHA-256 checksums, running cosign verify-blob with workflow identity binding, and validating SLSA L2 provenance via gh attestation verify. This multi-layer cryptographic verification prevents supply-chain attacks before you install or deploy downloaded artefacts.

SLSA L2 provenance verification checks the cryptographically signed build metadata of release artefacts. It ensures the tarball was built through a trusted, tamper-resistant workflow using gh attestation verify, confirming the artefact's origin and integrity before deployment.

Use cosign verify-blob to cryptographically validate the tarball and SBOM signatures using the exact release workflow identity binding. This confirms the artefact was signed by the expected Datarim GitHub Release workflow, preventing unauthorized modifications.

Yes, you must verify SBOM signatures separately using cosign. The verification process validates both the release tarball and its accompanying SBOM, ensuring complete supply chain integrity before you proceed with installation or automated updates.

If checksum verification fails, do not install the artefact. The skill provides troubleshooting guidance for common verification failures, helping you identify whether the issue is a corrupted download, a signature mismatch, or a provenance error.

Yes, the verification recipe targets automated updates and agent/operator workflows that download release tarballs for deployment. It provides a deterministic 5-step process with operational guardrails to safely validate artefacts before automated installation.