Start with the exact release bytes
A release is an exact set, not a download page. PliegoRS publishes deterministic platform archives, a deterministic source archive, SHA-256 checksums, a signed manifest, offline verifiers, and bounded reproduction instructions. Missing and extra files are failures.
node verify-release-bundle.mjs --dir .Separate continuity from hosted identity
- Ed25519
- Project-controlled continuity signature over the exact primary release set
- Sigstore
- Keyless GitHub OIDC evidence for attestations and golden-matrix output
- SHA-256
- Content identity checked before any installer or runner executes
Inspect SBOM and provenance
Every promoted candidate carries a normalized CycloneDX SBOM and an in-toto Statement using the SLSA provenance v1 predicate. The offline verifier binds both documents to the exact release manifest and rejects substitution, drift, missing subjects, and extra package files.
Promote only release evidence
- 01
Candidate
Build the signed bytes twice and exercise the signed runner on eight clean hosted environments.
- 02
Registry
Publish the exact crate graph from the same clean revision, then exercise WSL2 against those registry packages.
- 03
Draft
Rebuild the same revision, require one release-manifest digest across nine environments, and create a reviewable draft.
- 04
Release
Publish only after the exact-set, attestation, matrix, and operator review gates agree.