Verifying releases
Prove that the agent and CLI you run were built from the public source.
The agent runs as postgres on your database servers, so you can prove the binary was built from the public repository. Every release carries four independent proofs. You need none of them day to day: the installer and the agent check the first one automatically.
| Proof | What it shows | Checked by |
|---|---|---|
Ed25519 manifest signature (manifest.json.sig) | Rowsafe published this release | The installer and the agent, before installing or updating, with a public key built into them |
| SLSA build provenance (Sigstore) | GitHub Actions built each file from the repository, at this tag, with this workflow | You, with gh or cosign |
| SBOM (SPDX, attested) | Every dependency compiled into the binaries | You, or your vulnerability scanner |
| Reproducible build | The published binaries are exactly what the source produces | You, by rebuilding. CI does it for every release. |
Provenance and SBOM attestations are signed keylessly with Sigstore and recorded in its public transparency log, so they can't be quietly replaced.
Replace 1.2.3 with the version you run (rowsafe-agent version).
Build provenance (quickest)
With the GitHub CLI:
gh release download v1.2.3 -R rowsafe/rowsafe -p 'rowsafe-agent-linux-amd64'
gh attestation verify rowsafe-agent-linux-amd64 --repo rowsafe/rowsafeIt names the workflow (.github/workflows/release.yml), the tag and the commit that built the file.
Checksums
gh release download v1.2.3 -R rowsafe/rowsafe -p SHA256SUMS -p 'rowsafe-*'
gh attestation verify SHA256SUMS --repo rowsafe/rowsafe
sha256sum --check --ignore-missing SHA256SUMSThe Ed25519 manifest signature
The check the agent makes before every update. The public key is published with each release and built into every agent:
curl -fsSLO https://releases.rowsafe.sh/agent/1.2.3/manifest.json
curl -fsSLO https://releases.rowsafe.sh/agent/1.2.3/manifest.json.sig
rowsafe-release verify --public-key <RELEASE_PUBLIC_KEY> manifest.json manifest.json.sigrowsafe-release is in every release, next to the agent and the CLI.
Docker images
Images are signed with cosign (keyless), with provenance and an SBOM:
cosign verify ghcr.io/rowsafe/agent:1.2.3-pg17 \
--certificate-identity-regexp '^https://github.com/rowsafe/rowsafe/\.github/workflows/release\.yml@refs/tags/v' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/rowsafe/agent:1.2.3-pg17 --repo rowsafe/rowsafeFloating tags (pg17, pg17-alpine, clickhouse26.8, docker-control:latest) point to the same signed images as the newest release's exact tags.
Rebuild it yourself
Release builds are reproducible: CGO off, trimmed paths, no VCS stamp or build ID, and the Go toolchain pinned in go.mod.
git clone https://github.com/rowsafe/rowsafe && cd rowsafe
git checkout v1.2.3
make dist VERSION=1.2.3 RELEASE_PUBLIC_KEY=<RELEASE_PUBLIC_KEY>
gh release download v1.2.3 -p SHA256SUMS
(cd dist/1.2.3 && sha256sum --check --ignore-missing ../../SHA256SUMS)Every binary should report OK. The release workflow runs the same comparison on a fresh machine for every tag, and fails the release if a single byte differs.
If a check fails for an official release, don't run the binary, and report it privately.