Verify Your Download

This page gives every verification command a stranger needs to confirm they received unmodified SigmaShake binaries — without trusting our word and without reading our source code.

We promise published-artifact integrity: what we ship matches what you get. We do not promise reproducible builds (you cannot recompile and expect a bit-identical binary from our source).

Quick summary by channel

Distribution channels. The native ssg CLI installers stream from the download CDN at download.sigmashake.com; Linux containers can also pull the public GHCR image at ghcr.io/sigmashakeinc/ssg. Open-channel publishing (npm, PyPI, Homebrew, apt, Flatpak, winget, AUR, GHCR) was discontinued on 2026-06-17 and reopened on 2026-07-01. Cargo stays blocked, because the CLI is now written in Go and no crate exists. Status checked on 2026-10-12: the npm (@sigmashake/ssg) latest tag, the PyPI (sigmashake) release and the Homebrew tap formula were all at 1.1.8, while the download CDN served 1.1.9. A package-manager channel can lag the CDN by one release. No live check of the winget manifest or the apt repository was made for this page (the paths tried on apt.sigmashake.com returned HTTP 404). Check the version with the channel's own tool before you rely on it. Sections §1–§5 give the verification commands for each channel.

Channel	Verification method
npm	`npm info @sigmashake/ssg dist.integrity`
PyPI	JSON API + `sha256sum`
Homebrew	Formula `sha256` field checked by `brew` at install
winget	`InstallerSha256` field checked by winget at install
apt	GPG-signed `InRelease` + `SHA256` in `Packages`
Download CDN — CLI	`checksums.sha256` on the download CDN (see §11)
Docker / GHCR — CLI	OCI index digest + per-platform manifests (see §12)
Download CDN — Fleet	`.sha256` sidecar + `fleet/latest.json` + `Digest`/`x-sigmashake-sha256` response headers (after deploy)
Download CDN — Linux Desktop (Wails/Go)	`.sha256` sidecar + `stable-linux-x64-update.json` + `Digest`/`x-sigmashake-sha256` response headers (after deploy)
Download CDN — macOS Desktop (Swift/Sparkle)	`.sha256` sidecar + `desktop/swift/latest.json` + `Digest`/`x-sigmashake-sha256` response headers (after deploy)
Download CDN — Windows Desktop (C#/.NET)	`sha256` field in `desktop/windows/latest.json` + `.sha256` sidecar
Supply-chain canary	Endpoints live; manifest rows pending first publish cycle (see §13)

1. npm

Channel status (2026-10-12). @sigmashake/ssg on npm is an open channel again (reopened 2026-07-01). The npm latest tag was 1.1.8 on 2026-10-12, one release behind the download CDN (1.1.9). The example output below is dated 2026-06-10.

The npm registry embeds a SHA-512 SRI digest in every package record.

# Query the registry directly — no download needed
npm info @sigmashake/ssg dist.integrity dist.tarball

Live output (verified 2026-06-10):

dist.integrity = 'sha512-zgw0eKebf4wdQMxifmgDbpH5ACDJKumabLpkBqJtVohbM1+AX0PVmZtNZcyzV9edsr9cdPBU2AiZ0V8nShYvPw=='
dist.tarball   = 'https://registry.npmjs.org/@sigmashake/ssg/-/ssg-0.29.155.tgz'

To verify a tarball you already have on disk:

# Download and check
npm pack @sigmashake/ssg
# npm prints the computed SHA-1 (legacy) and warns if the hash deviates.
# For SHA-512 SRI comparison, pipe the tarball through openssl:
curl -sL "$(npm info @sigmashake/ssg dist.tarball)" | \
  openssl dgst -sha512 -binary | openssl base64 -A
# Compare with the value of dist.integrity (strip the "sha512-" prefix).

2. PyPI

Channel status (2026-10-12). sigmashake on PyPI is an open channel again (reopened 2026-07-01). The PyPI release was 1.1.8 on 2026-10-12, one release behind the download CDN (1.1.9). The example output below is dated 2026-06-10.

PyPI stores per-file SHA-256 digests in its JSON API.

# Look up the current version
curl -sS https://pypi.org/pypi/sigmashake/json | \
  python3 -c "import json,sys; print(json.load(sys.stdin)['info']['version'])"

Live output (verified 2026-06-10): 0.29.151

# Get sha256 for a specific version
curl -sS https://pypi.org/pypi/sigmashake/0.29.151/json | \
  python3 -c "
import json, sys
d = json.load(sys.stdin)
for u in d['urls']:
    print(u['filename'])
    print('  sha256:', u['digests']['sha256'])
    print('  url:   ', u['url'])
"

Live output (verified 2026-06-10):

sigmashake-0.29.151-py3-none-any.whl
  sha256: acb2fd8273648a20bf80d9636ee5bda8c7ffb0e67a0dba910794a81dfeaeb60b
  url:    https://files.pythonhosted.org/packages/.../sigmashake-0.29.151-py3-none-any.whl

To verify a wheel you have already downloaded:

sha256sum sigmashake-0.29.151-py3-none-any.whl
# Must match the sha256 above exactly.

3. Homebrew (macOS)

Channel status (2026-10-12). The sigmashakeinc/tap/ssg Homebrew formula is an open channel again (reopened 2026-07-01). The formula in the tap was at 1.1.8 on 2026-10-12, one release behind the download CDN (1.1.9).

The Homebrew formula in sigmashakeinc/homebrew-tap embeds a per-platform SHA-256 that Homebrew checks before installing:

brew install sigmashakeinc/tap/ssg
# Homebrew downloads the tarball from the URL in the formula, verifies sha256, and aborts
# on mismatch before touching your system.

To inspect the formula's expected hash before installing:

brew fetch --formula sigmashakeinc/tap/ssg
# Prints the verified sha256 alongside the download URL.

The canonical formula file is at sigmashake-dist/homebrew/ssg.rb in the monorepo. The SHA-256 values in that file and the Homebrew tap MUST agree with the GitHub Release assets. Any divergence is a supply-chain anomaly.

4. winget (Windows)

Channel status (2026-10-12). Publishing to winget was reopened on 2026-07-01. No live check of the SigmaShake.SSG manifest was made for this page. Run winget show SigmaShake.SSG to see the current version. Native Windows installs also stream through download.sigmashake.com via the PowerShell installer at install.sigmashake.com/install.ps1.

The winget manifest (SigmaShake.SSG) carries an InstallerSha256 that winget verifies at install time before execution. The download and install are free. A $5/month subscription unlocks every value surface; subscribe at sigmashake.com/pricing.

winget install SigmaShake.SSG
# winget downloads the zip, computes SHA-256, and refuses to install on mismatch.

To inspect the current manifest hash without installing:

winget show SigmaShake.SSG

The canonical manifest source is sigmashake-dist/winget/SigmaShake.SSG.installer.yaml.

5. apt (Debian / Ubuntu)

Channel status (2026-10-12). Publishing to apt was reopened on 2026-07-01. The paths /InRelease and /dists/stable/InRelease on apt.sigmashake.com returned HTTP 404 on 2026-10-12, so the repository layout is not confirmed for this page. Native Linux installs also stream through download.sigmashake.com via the one-line installer at install.sigmashake.com.

The APT repository at https://apt.sigmashake.com is GPG-signed:

Signing key fingerprint: A6A1FA60DC38EE17CA443389F562E7E136D128FA (RSA-4096, expires 2031-05-25)
Key file: https://apt.sigmashake.com/sigmashake.gpg

Every package index (dists/stable/InRelease) carries an inline GPG signature over a SHA-256 hash of each Packages file. apt verifies the full chain before installing any .deb.

# Fetch and inspect the GPG-signed Release file
curl -sS https://apt.sigmashake.com/dists/stable/InRelease | head -5
# Should start: -----BEGIN PGP SIGNED MESSAGE-----

# Verify the Release file signature offline
curl -sS https://apt.sigmashake.com/sigmashake.gpg | gpg --import
curl -sS https://apt.sigmashake.com/dists/stable/InRelease | gpg --verify

# Inspect SHA-256 of the package
curl -sS "https://apt.sigmashake.com/dists/stable/main/binary-amd64/Packages" | \
  awk '/^Package: ssg/{found=1} found && /^SHA256:/{print; found=0}'

Live output (verified 2026-06-10):

-----BEGIN PGP SIGNED MESSAGE-----
...
SHA256: 1e1489b64ea6f8a464aefce30c67e6d125f8264414b68698053ba640be450f29

6. Download CDN — inline integrity headers

As of the worker change on 2026-06-10 (pending deploy), the download CDN sets two response headers on artifact files whenever a checksum source is available:

Header	Value
`Digest`	`sha-256=<base64(raw-sha256-bytes)>` (RFC 3230)
`x-sigmashake-sha256`	SHA-256 in lowercase hex

The worker resolves the hash through a three-level fallback chain:

Native R2 checksum (set at upload time for new pipeline uploads)
R2 custom metadata sha256 field (set by upload routes when the authenticated caller supplies X-Sha256 or ?sha256= on multipart init)
.sha256 sidecar object (companion file at <key>.sha256, already present for Wails and fleet artifacts)

Headers are not set when none of these sources exist. A missing header means the sidecar path has not been populated yet, not that the artifact is suspect — the primary verification method remains the sidecar and out-of-band checksum files documented in the sections below.

Verify the inline header (Wails example):

# Fetch headers only — does not download the binary
curl -sI https://download.sigmashake.com/desktop/wails/stable-linux-x64-SigmaShakeDesktop.tar.gz \
  | grep -i 'x-sigmashake-sha256\|digest'

Expected output (after deploy):

digest: sha-256=IF+s0aIr8gzLId18nCzDGWI9tAuVl22nmfy2h7jTon...
x-sigmashake-sha256: 205afcd1a22bf20ccb21d7c9c2cc3196523db40b95976da79facb287b8d3a27b

Cross-check with the sidecar:

curl -sS https://download.sigmashake.com/desktop/wails/stable-linux-x64-SigmaShakeDesktop.tar.gz.sha256
# Must match x-sigmashake-sha256 above.

These two sources use different code paths (response header vs. separate R2 object fetch). Agreement between them provides independent confirmation without requiring a full binary download.

7. Download CDN — Fleet

The Fleet CDN channel provides two independent hash sources that must agree:

Source A: .sha256 sidecar file

# Get sha256 for the linux-amd64 tarball
curl -sS https://download.sigmashake.com/fleet/stable/1.0.0/sigmashake-fleet-1.0.0-linux-amd64.tar.gz.sha256

Live output (verified 2026-06-10):

f065b9f61a990cf1035cc7d9d013af59afb9144f55ebf81012af059d870e8996  sigmashake-fleet-1.0.0-linux-amd64.tar.gz

Source B: fleet/latest.json

curl -sS https://download.sigmashake.com/fleet/latest.json | \
  python3 -c "import json,sys; d=json.load(sys.stdin); print(d['artifacts']['linux-amd64-tarball']['sha256'])"

Live output (verified 2026-06-10): f065b9f61a990cf1035cc7d9d013af59afb9144f55ebf81012af059d870e8996

Both sources must agree. After downloading:

sha256sum sigmashake-fleet-1.0.0-linux-amd64.tar.gz
# Must match both sources above.

8. Download CDN — Linux Desktop (Wails/Go)

The Wails update channel publishes a .sha256 sidecar and embeds the same hash in the update manifest:

Source A: .sha256 sidecar

curl -sS https://download.sigmashake.com/desktop/wails/stable-linux-x64-SigmaShakeDesktop.tar.gz.sha256

Live output (verified 2026-06-10):

205afcd1a22bf20ccb21d7c9c2cc3196523db40b95976da79facb287b8d3a27b  stable-linux-x64-SigmaShakeDesktop.tar.gz

Source B: update manifest

curl -sS https://download.sigmashake.com/desktop/wails/stable-linux-x64-update.json | \
  python3 -c "import json,sys; d=json.load(sys.stdin); print('version:', d['version'], '\nhash:', d['hash'])"

Live output (verified 2026-06-10):

version: 0.1.111
hash: 205afcd1a22bf20ccb21d7c9c2cc3196523db40b95976da79facb287b8d3a27b

Both must agree. The hash field is SHA-256 hex of the .tar.gz file.

9. Download CDN — macOS Desktop (Swift/Sparkle)

The native Swift/AppKit macOS desktop ships signed .dmg artifacts through the desktop/swift/ R2 channel. Sparkle polls desktop/swift/appcast.xml for updates; desktop/swift/latest.json is the display pointer read by ssg probe desktop.

Source A: .sha256 sidecar

# Replace <filename> with the actual .dmg filename from latest.json
curl -sS https://download.sigmashake.com/desktop/swift/latest.json | \
  python3 -c "import json,sys; d=json.load(sys.stdin); print('version:', d['version'])"
# Then fetch the sidecar for the named artifact:
curl -sS "https://download.sigmashake.com/desktop/swift/<filename>.sha256"

Source B: Digest / x-sigmashake-sha256 response headers

# Fetch headers only — does not download the binary
curl -sI "https://download.sigmashake.com/desktop/swift/<filename>.dmg" \
  | grep -i 'x-sigmashake-sha256\|digest'

Both sources use the same three-level fallback chain described in §6. After downloading:

# macOS
shasum -a 256 SigmaShakeDesktop-<version>.dmg
# Must match the sidecar value.

Note: Sparkle checks macOS code-signing (Gatekeeper) at mount time. Sparkle updates are EdDSA-signed: the app carries SUPublicEDKey in Info.plist and Sparkle verifies each appcast item's sparkle:edSignature against it before it applies the update (sigmashake-desktop-mac/Package.swift, UpdaterController.swift). 2026-10-11 note: this page earlier said the appcast had no edSignature; that statement is out of date. No live appcast check was made for this page. To check the live feed, fetch desktop/swift/appcast.xml and look for sparkle:edSignature.

10. Download CDN — Windows Desktop (C#/.NET)

The Windows desktop channel embeds a SHA-256 in desktop/windows/latest.json:

curl -sS https://download.sigmashake.com/desktop/windows/latest.json | \
  python3 -c "import json,sys; d=json.load(sys.stdin); print('version:', d['version'], '\nsha256:', d['sha256'])"

Live output (verified 2026-06-10):

version: 0.1.116
sha256: 5410758aed1614d7879299080306d68c2df0c2ee1eff9c431a1030c1d5ac5f92

After downloading the installer, verify before running it:

# PowerShell
(Get-FileHash "SigmaShakeDesktop-Setup-0.1.116.exe" -Algorithm SHA256).Hash.ToLower()
# Must match sha256 above.

11. CLI — download CDN checksums

The CLI binaries are served from the download CDN at download.sigmashake.com. The source repository on GitHub is private, so GitHub Release URLs for the CLI do not work without access. A checksums.sha256 file is published for each version:

# Latest version number
curl -sS https://download.sigmashake.com/cli/latest.json

# Checksum file for the latest version, or for a specific version
curl -sS https://download.sigmashake.com/cli/latest/checksums.sha256
curl -sS https://download.sigmashake.com/cli/1.1.9/checksums.sha256

Example output (ssg 1.1.9, shortened). The file is host-OS gated: hashes for a platform appear when the build host that owns that platform runs.

# ssg 1.1.9 — SHA256 checksums
# Host OS: linux — targets: linux-x64 linux-arm64 darwin-x64 darwin-arm64 win32-x64

# Raw binaries
1a9b1d9b6aad989484f1990d9cb861a6ad6230b1301404f04eb11221b7ac355b  ssg-linux-x64
60c63f7b1b8a31a0108c1175e6ad8df93680943a24b60f88d793d17607977d42  ssg-linux-arm64
19a7b656a0bdbf7d9ad306646937f2cda75f34cdfc8fb72a5f0ff9de6d4031b0  ssg-darwin-x64
2eea2b7c937d3435df46053c2948bc6027c299571a58af5179d2aa3f1273aeee  ssg-darwin-arm64
dfa1787614f1cd108859fc449fc893022d975d890c50c8de190133772c1e39b5  ssg-win32-x64.exe

To verify a downloaded binary:

sha256sum ssg-linux-x64
# Must match the line for ssg-linux-x64 in the checksum file for the same version.

The checksum file and the binary come from the same CDN, so this check finds a damaged download. It does not protect against a CDN compromise. Dated note 2026-10-14: this section replaces earlier text that pointed to GitHub Releases for the CLI checksums.

12. Docker / GHCR

The public Docker image is published as a multi-arch OCI index:

docker buildx imagetools inspect ghcr.io/sigmashakeinc/ssg:1.0.7

Live output (verified 2026-06-28):

Name:      ghcr.io/sigmashakeinc/ssg:1.0.7
MediaType: application/vnd.oci.image.index.v1+json
Digest:    sha256:d41e347e6aa8b00d0d311782c7c1f0d69687f78585b33bdad147505f46534b39

Manifests:
  Platform: linux/amd64
  Platform: linux/arm64

Runtime smoke:

docker run --pull=always --rm ghcr.io/sigmashakeinc/ssg:1.0.7 --version
# 1.0.7

The mutable tags 1.0 and latest currently resolve to the same OCI index digest. Pin 1.0.7 or the digest above for reproducible deployments.

13. Supply-chain canary

The supply-chain canary at canary.sigmashake.com runs every 15 minutes. Each run re-fetches and re-hashes a bounded batch of up to 40 of the stalest recorded artifacts and writes the result to a signed manifest. It is fail-open: a failed run is logged and does not block anything. A single artifact can therefore wait more than 15 minutes for its next check. It currently covers four channels: npm, PyPI, VS Code Marketplace, and download.sigmashake.com (r2-download).

Infrastructure status (verified 2026-06-10)

The canary Worker and its Ed25519 public key are live:

# Liveness probe
curl -sS https://canary.sigmashake.com/healthz
# {"ok":true,"service":"sigmashake-canary"}

The canary manifest currently has zero artifact rows. The post-publish-record.ts pipeline that writes signed rows after each publish has not yet run against the live estate. The verify endpoint and the pubkey endpoint are fully operational; the artifact ledger will populate on the next publish cycle.

Fetch and cache the public key

The Ed25519 SPKI public key authenticates every manifest row. Fetch it once and store it offline:

curl -sS https://canary.sigmashake.com/.well-known/canary-pubkey

Live output (verified 2026-06-10):

{
  "algorithm": "Ed25519",
  "format": "spki-hex",
  "issued_by": "sigmashake-canary",
  "active_public_key_hex": "302a300506032b65700321009df75e2d00cb7af16b90463524b422e5282efcc1cdc1f4e8f59caa935fe1689f",
  "keys": [
    {
      "kid": "canary-39c90dfa47a321fe",
      "public_key_hex": "302a300506032b65700321009df75e2d00cb7af16b90463524b422e5282efcc1cdc1f4e8f59caa935fe1689f",
      "state": "active",
      "activated_at": 1779391872,
      "revoked_at": null
    }
  ]
}

Convert the hex key to a PEM file for offline use:

curl -sS https://canary.sigmashake.com/.well-known/canary-pubkey | python3 -c "
import sys, json, binascii, base64
data = json.load(sys.stdin)
hex_key = data['active_public_key_hex']
der = binascii.unhexlify(hex_key)
b64 = base64.b64encode(der).decode()
print('-----BEGIN PUBLIC KEY-----')
for i in range(0, len(b64), 64):
    print(b64[i:i+64])
print('-----END PUBLIC KEY-----')
" > canary-pubkey.pem

# Confirm openssl recognises it as Ed25519
openssl pkey -pubin -in canary-pubkey.pem -noout -text
# Should print: ED25519 Public-Key:

Live output (verified 2026-06-10): openssl printed ED25519 Public-Key: and the 32-byte public key matching the hex above.

Query a manifest row (once rows exist)

# npm example
curl -sS "https://canary.sigmashake.com/api/v1/verify/npm/%40sigmashake%2Fssg/0.29.155"

# PyPI example
curl -sS "https://canary.sigmashake.com/api/v1/verify/pypi/sigmashake/0.29.151"

# VS Code Marketplace example
curl -sS "https://canary.sigmashake.com/api/v1/verify/vscode-marketplace/sigmashake.sigmashake-ssg/0.1.9"

A populated row returns:

{
  "registry": "npm",
  "package": "@sigmashake/ssg",
  "version": "0.29.155",
  "filename": "ssg-0.29.155.tgz",
  "sha256": "<hex>",
  "byte_size": 12345678,
  "signed_at": 1779391900,
  "signing_kid": "canary-39c90dfa47a321fe",
  "provenance": "publish-time",
  "r2_manifest_key": "artifacts/<id>.json",
  "last_verification": {
    "status": "ok",
    "verified_at": 1781068000,
    "observed_sha256": "<hex>",
    "http_status": 200,
    "duration_ms": 120
  }
}

The /api/v1/verify response contains the recorded hash and the last observed hash from the independent re-verification. If sha256 and last_verification.observed_sha256 agree and status is ok, the artifact had not drifted at its last canary check. The canary checks a bounded batch of up to 40 stalest artifacts per 15-minute run, so the time of that check can be older than 15 minutes.

The row's Ed25519 signature is stored in the database but is not returned by this endpoint (it is embedded in the R2 object at r2_manifest_key). Full offline signature verification requires fetching that object. The operator-side tooling for this is on the provenance roadmap.

Canary coverage (as of 2026-06-10)

Channels monitored (each run re-fetches and re-hashes up to 40 of the stalest artifacts):

npm (@sigmashake/ssg)
PyPI (sigmashake)
VS Code Marketplace (sigmashake.sigmashake-ssg)
download.sigmashake.com (r2-download)

Channels NOT yet canary-monitored: Homebrew, winget, apt, Flatpak, Docker / GHCR, the three desktop update feeds (Wails stable-*-update.json, Sparkle appcast.xml, Windows latest.json). GHCR is public but not yet on the canary. Extending coverage to these channels is tracked on the provenance roadmap.

Hourly Merkle anchoring

Every hour the canary computes a Merkle root over all manifest rows and anchors it to the hub transparency log (hub.sigmashake.com). The manifest_roots D1 table records each root alongside a chain link (prev_root_hash). Re-writing a past row silently requires compromising both the canary D1 database and the hub transparency log simultaneously.

Current status: roots are written and anchored. The rows themselves carry signature = "unsigned" and signing_kid = "pending" until the operator-side root-signing tooling (Priority 1 of the provenance roadmap) is wired in. A signed root means even a full canary-plus-R2 compromise cannot rewrite history without detection.

Limitations and honest gaps

The following verification mechanisms are not yet available:

Gap	Impact
Canary manifest currently empty	The `/api/v1/verify` endpoint works but returns 404 until `post-publish-record.ts` has run for at least one publish cycle
RFC-3230 `Digest` + `x-sigmashake-sha256` HTTP headers	As of the worker change on 2026-06-10 (pending deploy), these headers fire whenever a checksum source is available: the worker resolves sha256 from native R2 checksums, then R2 custom metadata, then a `.sha256` sidecar object. Wails (Linux), Swift (macOS), Windows, and fleet artifacts already have sidecars in place, so these channels will serve integrity headers immediately after deploy. Legacy Tauri artifacts and Voice artifacts without a sidecar continue to serve no header rather than a wrong header. The frozen `desktop/electrobun/` R2 channel is no longer published to; existing objects there may or may not have sidecars.
Canary Merkle roots are unsigned	Roots are anchored to the hub but carry `signature = "unsigned"` pending operator-side signing tooling
CLI `checksums.sha256` (download CDN)	Host-OS gated: a platform's hashes appear only when the build host that owns that platform runs, so a checksum file can lack some platforms. The 1.1.9 sample in section 11 lists linux, darwin and win32 hashes. No check of the current file was made for this page (2026-10-13). Look for your platform's line before you rely on the file. The CLI is not served from GitHub Releases.
macOS Sparkle `edSignature` not live-checked	Sparkle updates are EdDSA-signed (`SUPublicEDKey` in `Info.plist`, armed 2026-06-01). No live appcast check was made for this page (2026-10-11); fetch `appcast.xml` and look for `sparkle:edSignature` to confirm
Homebrew and winget hashes are not live-queryable	The SHA-256 values are in the formula / manifest source files and in the downloaded tarballs; there is no separate public hash endpoint
No reproducible-build claim	We promise the published artifact matches what you download; we do not promise that recompiling from source produces a bit-identical binary

Provenance questions or discrepancies: [email protected]

Quick summary by channel​

1. npm​

2. PyPI​

3. Homebrew (macOS)​

4. winget (Windows)​

5. apt (Debian / Ubuntu)​

6. Download CDN — inline integrity headers​

7. Download CDN — Fleet​

8. Download CDN — Linux Desktop (Wails/Go)​

9. Download CDN — macOS Desktop (Swift/Sparkle)​

10. Download CDN — Windows Desktop (C#/.NET)​

11. CLI — download CDN checksums​

12. Docker / GHCR​

13. Supply-chain canary​

Infrastructure status (verified 2026-06-10)​

Fetch and cache the public key​

Query a manifest row (once rows exist)​

Canary coverage (as of 2026-06-10)​

Hourly Merkle anchoring​

Limitations and honest gaps​

Quick summary by channel

1. npm

2. PyPI

3. Homebrew (macOS)

4. winget (Windows)

5. apt (Debian / Ubuntu)

6. Download CDN — inline integrity headers

7. Download CDN — Fleet

8. Download CDN — Linux Desktop (Wails/Go)

9. Download CDN — macOS Desktop (Swift/Sparkle)

10. Download CDN — Windows Desktop (C#/.NET)

11. CLI — download CDN checksums

12. Docker / GHCR

13. Supply-chain canary

Infrastructure status (verified 2026-06-10)

Fetch and cache the public key

Query a manifest row (once rows exist)

Canary coverage (as of 2026-06-10)

Hourly Merkle anchoring

Limitations and honest gaps