Same-origin-sha256 (tier 4) against SHASUMS256.txt — no GitHub attestations upstream. A PGP signature over the checksum file also ships (SHASUMS256.txt.sig) but pkgwatch has no minisign/GPG verifier yet; revisit once tier 1 lands. Tracks the glibc x86_64 Linux build. Confirmed working end to end: check -> fetch -> verify against the real repo (v2.1.276 at time of writing). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| claude-code.toml | ||
| scaleway-cli.toml | ||
| uv.toml | ||