release-verify

Verify Datarim GitHub Release artefacts via SHA-256, cosign, and SLSA L2 provenance.

11|1|Updated Apr 10, 2026

Search Tags:#supply chain security #github releases #slsa provenance #sigstore cosign #sbom verification #cryptographic integrity

Ready to run

npx skills add https://github.com/Arcanada-one/datarim --skill release-verify-arcanada-one

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: release-verify
Source: https://github.com/Arcanada-one/datarim/tree/main/skills/release-verify
Command: npx skills add https://github.com/Arcanada-one/datarim --skill release-verify-arcanada-one

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents supply-chain attacks by ensuring every downloaded Datarim release artefact is integrity-checked and cryptographically verified before installation.

Core Features & Use Cases

Multi-layer release verification: Validates SHA-256 checksums, verifies Sigstore/cosign signatures for the tarball and SBOM, and checks SLSA L2 build provenance.
Consumer-side, release-tarball focused: Targets the official GitHub Release download flow (not git checkouts), so operators and agents can safely validate before deploying.
Operational guidance with guardrails: Provides clear prerequisites, a deterministic 5-step verification recipe, and troubleshooting for common verification failures.

Quick Start

Load the release-verify skill and run its verification recipe for your chosen tag before installing any tarball from the Datarim GitHub Release.

Frequently Asked Questions about release-verify

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify Datarim GitHub release tarballs before installation?▼

Verify Datarim release tarballs by checking SHA-256 checksums, running cosign verify-blob with workflow identity binding, and validating SLSA L2 provenance via gh attestation verify. This multi-layer cryptographic verification prevents supply-chain attacks before you install or deploy downloaded artefacts.

What is SLSA L2 provenance verification for release artefacts?▼

SLSA L2 provenance verification checks the cryptographically signed build metadata of release artefacts. It ensures the tarball was built through a trusted, tamper-resistant workflow using gh attestation verify, confirming the artefact's origin and integrity before deployment.

How do I use cosign verify-blob to check supply chain security?▼

Use cosign verify-blob to cryptographically validate the tarball and SBOM signatures using the exact release workflow identity binding. This confirms the artefact was signed by the expected Datarim GitHub Release workflow, preventing unauthorized modifications.

Do I need to verify SBOM signatures separately from the release tarball?▼

Yes, you must verify SBOM signatures separately using cosign. The verification process validates both the release tarball and its accompanying SBOM, ensuring complete supply chain integrity before you proceed with installation or automated updates.

What should I do when GitHub release checksum verification fails?▼

If checksum verification fails, do not install the artefact. The skill provides troubleshooting guidance for common verification failures, helping you identify whether the issue is a corrupted download, a signature mismatch, or a provenance error.

Can I use this verification process for automated agent deployment workflows?▼

Yes, the verification recipe targets automated updates and agent/operator workflows that download release tarballs for deployment. It provides a deterministic 5-step process with operational guardrails to safely validate artefacts before automated installation.