Skip to main content

GitHub Releases

Every stable release on the releases page ships:

  • Archives — datamitsu_<version>_<os>_<arch>.tar.gz (Linux, macOS) and .zip (Windows) for amd64 and arm64
  • Linux packages — .deb, .rpm, and .apk
  • checksums.txt — SHA-256 of every asset, plus checksums.txt.sigstore.json, its keyless cosign signature
  • SBOMs — one per archive
  • datamitsu_parsers_<version>.wasm — the parser module, downloaded by the CLI on demand and verified against the SHA-256 the config pins (the value checksums.txt records). This asset is one of two channels: the same module is also published as an OCI artifact at ghcr.io/datamitsu/datamitsu-parsers, which a config can pin instead — see Output Parsers
  • datamitsu-<version>.vsix — the VS Code extension for manual installs

Verify the release manifest​

Obtain the SHA-256 values for the checksum manifest and its Sigstore bundle from an independently authenticated release announcement or mirror manifest. If either value is unavailable, stop: do not download or process that artifact. Verify both files before asking Cosign to authenticate the manifest:

VERSION=0.2.1
CHECKSUMS_SHA256="<trusted-sha256-for-checksums.txt>"
SIGSTORE_BUNDLE_SHA256="<trusted-sha256-for-checksums.txt.sigstore.json>"
curl --fail --location --remote-name \
  "https://github.com/datamitsu/datamitsu/releases/download/v${VERSION}/checksums.txt"
curl --fail --location --remote-name \
  "https://github.com/datamitsu/datamitsu/releases/download/v${VERSION}/checksums.txt.sigstore.json"
printf '%s  %s\n' "$CHECKSUMS_SHA256" checksums.txt | sha256sum --check -
printf '%s  %s\n' "$SIGSTORE_BUNDLE_SHA256" checksums.txt.sigstore.json | sha256sum --check -
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/datamitsu/datamitsu/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

Binary archive​

Select the asset and extract its expected SHA-256 from the authenticated manifest before downloading it. Verify the bytes before extraction:

ASSET="datamitsu_${VERSION}_linux_amd64.tar.gz"
EXPECTED_SHA256=$(awk -v asset="$ASSET" '$2 == asset { print $1 }' checksums.txt)
test "${#EXPECTED_SHA256}" -eq 64

curl --fail --location --remote-name \
  "https://github.com/datamitsu/datamitsu/releases/download/v${VERSION}/${ASSET}"
printf '%s  %s\n' "$EXPECTED_SHA256" "$ASSET" | sha256sum --check -
tar -xzf "$ASSET"
sudo install -m 0755 datamitsu /usr/local/bin/datamitsu

Linux packages​

Download the selected package only after obtaining its SHA-256 from the verified manifest above, and run the same sha256sum --check - step before installing it:

# Debian / Ubuntu
sudo dpkg -i datamitsu_${VERSION}_linux_amd64.deb

# Fedora / RHEL
sudo rpm -i datamitsu_${VERSION}_linux_amd64.rpm

# Alpine
sudo apk add --allow-untrusted datamitsu_${VERSION}_linux_amd64.apk

Unstable prereleases​

Unstable builds are dispatched by hand (Actions > Release) and the GitHub prerelease is an opt-in checkbox on that form, off by default. When it is ticked, the prerelease carries the archives, checksums.txt with its cosign bundle, the .wasm parser module built from that commit, and parsers-oci.json — the registry pin (ref, digest, sha256) for that same module, which every unstable build publishes to ghcr.io/datamitsu/datamitsu-parsers-unstable. These builds exist for testing something that has not shipped yet; install one only for that.

Verify provenance​

Release artifacts also carry GitHub build provenance attestations:

gh attestation verify datamitsu_${VERSION}_linux_amd64.tar.gz --repo datamitsu/datamitsu

See Supply Chain Security for the full verification model.