diff --git a/INSTALL.md b/INSTALL.md new file mode 100644 index 0000000..e5b4284 --- /dev/null +++ b/INSTALL.md @@ -0,0 +1,39 @@ +# Install Witness manually and verify + +> [!NOTE] +> Please use release v0.7.0 or higher, as prior releases were created to +> test the release workflow. + +This repository provides pre-built binaries that are signed and published using +[GoReleaser]. The signature for these binaries are generated using [Sigstore], +using the release workflow's identity. Make sure you have [cosign] installed on +your system, then you will be able to securely download and verify the gittuf +release: + +## Unix-like operating systems + +```sh +# Modify these values as necessary. +# One of: amd64, arm64 +ARCH=amd64 +# One of: linux, darwin, freebsd +OS=linux +# See https://github.com/in-toto/witness/releases for the latest version +VERSION=0.6.0 +cd $(mktemp -d) + +curl -LO https://github.com/in-toto/witness/releases/download/v${VERSION}/witness_${VERSION}_${OS}_${ARCH} +curl -LO https://github.com/in-toto/witness/releases/download/v${VERSION}/witness_${VERSION}_${OS}_${ARCH}.sig +curl -LO https://github.com/in-toto/witness/releases/download/v${VERSION}/witness_${VERSION}_${OS}_${ARCH}.pem + +cosign verify-blob \ + --certificate witness_${VERSION}_${OS}_${ARCH}.pem \ + --signature witness_${VERSION}_${OS}_${ARCH}.sig \ + --certificate-identity https://github.com/in-toto/witness/.github/workflows/release.yml@refs/tags/v${VERSION} \ + --certificate-oidc-issuer https://token.actions.githubusercontent.com \ + witness_${VERSION}_${OS}_${ARCH} + +sudo install witness_${VERSION}_${OS}_${ARCH} /usr/local/bin/witness +cd - +witness version +``` diff --git a/README.md b/README.md index 70d3c8c..80d2755 100644 --- a/README.md +++ b/README.md @@ -49,6 +49,8 @@ latest release: bash <(curl -s https://raw.githubusercontent.com/in-toto/witness/main/install-witness.sh) ``` +If you want install it manually and verify its integrity follow the instructions in the [INSTALL.md](./INSTALL.md). + ### Tutorials Check out our Tutorials: