Repolode
Submit
jdx

jdx/packslip

A signed release manifest that lets installers and package managers verify and pick the right binary artifact for a host.

View on GitHubWebsite
Stars
198
Forks
5
Open issues
1
Last commit
yesterday

What is it?

A packslip is a signed release manifest for software shipped as archives, installers, or executables. A release publishes a single file, packslip.sigstore.json, beside its artifacts. Installers, package managers, and mirrors verify this bundle against the project's signer, then learn which artifact fits the host, where the executables sit inside it, and the digest the download must match. This removes the need to guess from file names or trust a checksum file served next to the binary.

The project includes a GitHub Action that signs a statement of artifact digests, platforms, and executable paths using the workflow's identity, so no long-lived signing key is required. It also provides a CLI with commands to publish, verify, and install releases. packslip install fetches a tool's signed release, installs the complete archive, and places the declared commands in a bin directory without running downloaded code. The format is stated to be stable at version 1.

Key features

  • 01Publishes a signed bundle that maps artifacts to platforms and executable paths.
  • 02Verifies release artifacts against digests in the bundle using packslip verify.
  • 03Installs tools from GitHub or domain projects with packslip install, without running downloaded code.
  • 04Runs in GitHub Actions using the workflow identity, with no long-lived signing key.
  • 05Format is declared stable at version 1.

Use cases

  • Publishing a CLI tool so users can install it verifiably instead of piping a script to a shell.
  • Building an installer or package manager that needs to pick the correct binary for each platform.
  • Letting mirrors or internal tools check that downloaded release artifacts are authentic.
  • Adding signed release verification to a project's existing tag-triggered CI release job.

Quick start

  1. 1

    Install packslip from the install guide

  2. 2

    Install a tool from its signed release

    packslip install github.com/jdx/hk

Things to know

  • The CLI has no upgrade, list, or uninstall command.
  • Installing packslip itself requires following the separate install guide, which the README does not give as a single command.

Topics

#supply-chain-security#release-engineering#code-signing#sigstore#github-actions#binary-distribution#installer#rust

FAQ

What is packslip?
A signed release manifest that lets installers and package managers verify and pick the right binary artifact for a host. A packslip is a signed release manifest for software shipped as archives, installers, or executables. A release publishes a single file, packslip.sigstore.json, beside its artifacts. Installers, package managers, and mirrors verify this bundle against the project's signer, then learn which artifact fits the host, where the executables sit inside it, and the digest the download must match. This removes the need to guess from file names or trust a checksum file served next to the binary.
Is packslip free to use? What license does it have?
packslip is open source under the MIT license. Check the license terms before using it in commercial products.
Is packslip still maintained?
Actively maintained. The last commit to packslip was on Nov 6, 2026.
What can I use packslip for?
Publishing a CLI tool so users can install it verifiably instead of piping a script to a shell. Building an installer or package manager that needs to pick the correct binary for each platform. Letting mirrors or internal tools check that downloaded release artifacts are authentic. Adding signed release verification to a project's existing tag-triggered CI release job.
How do I install packslip?
Install packslip from the install guide Install a tool from its signed release: packslip install github.com/jdx/hk
Where can I get packslip?
The source code and installation instructions are on GitHub: https://github.com/jdx/packslip

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects