Releases & verification

What a release contains, how it is built, and how to verify its Sigstore signatures.

Releases are built only by GitHub Actions (.github/workflows/release.yml), from a clean checkout, and signed keylessly with Sigstore: there is no long-lived signing key to leak. Each signature binds the file to the exact workflow, commit and ref that built it, and is recorded in the public Rekor transparency log.

When a release is made

Trigger	Result
Push a tag `v1.2.3`	Release v1.2.3 (a prerelease if the tag contains `-`, e.g. `v1.2.3-beta.1`)
Push to a branch `release/1.2`	Prerelease v1.2-rc.<run> for every push
Run the workflow by hand	Build and sign only; files are attached to the run

Assets

File	What
`kamoder-<version>-sdcard.tar.gz`	The SD card root: `autorun.sh`, `Factory/`, `anyka_rust/` with stripped binaries
`kamoder-<version>-debug.tar.gz`	Unstripped binaries with line tables, to symbolize a panic
`mtdpatch-armv5`	Static ARM tool used by the autostart kit
`SHA256SUMS`	Checksums of the above
`CHANGELOG.md`	Full changelog up to this release (not signed; informational)
`*.sigstore.json`	One Sigstore bundle per file: signature, certificate and Rekor inclusion proof

Verify with cosign

Install cosign and check the archive against its bundle. The identity must be this repository's release workflow:

cosign verify-blob kamoder-1.2.3-sdcard.tar.gz \
  --bundle kamoder-1.2.3-sdcard.tar.gz.sigstore.json \
  --certificate-identity-regexp '^https://github.com/<owner>/<repo>/\.github/workflows/release\.yml@refs/(tags|heads)/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verified OK means the file is byte-for-byte what that workflow produced. For a tag release you can pin the exact ref instead of the regexp: --certificate-identity https://github.com/<owner>/<repo>/.github/workflows/release.yml@refs/tags/v1.2.3.

To check everything at once, verify SHA256SUMS and then the checksums:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/<owner>/<repo>/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c SHA256SUMS

Verify build provenance

Each archive also has an SLSA build-provenance attestation stored by GitHub. It records the commit, workflow and runner that built it:

gh attestation verify kamoder-1.2.3-sdcard.tar.gz --repo <owner>/<repo>

Changelog

Release notes are generated by git-cliff from Conventional Commits (feat:, fix:, docs:, ci: …), configured in cliff.toml. Release candidates do not split the changelog: a final release lists everything since the previous final release.

git cliff --unreleased --tag v0.2.0   # preview the next release notes
git cliff -o CHANGELOG.md             # full changelog

Cutting a release (maintainers)

git tag -s v1.2.3 -m "Kamoder 1.2.3"
git push origin v1.2.3

Or push a release/1.2.3 branch to publish signed release candidates (v1.2.3-rc.<run>) from every push to it.

The repository needs one variable, CROSSTOOL_SHA256 (Settings → Secrets and variables → Actions → Variables): the SHA-256 of the Anyka toolchain tarball. tools/install-toolchain.sh refuses any other tarball when it is set, and prints the hash it saw when it is not.

Releases & verification

When a release is madeCopy Anchor Link

AssetsCopy Anchor Link

Verify with cosignCopy Anchor Link

Verify build provenanceCopy Anchor Link

ChangelogCopy Anchor Link