Documentation
¶
Overview ¶
relverify checks that a tagged release is what its tag says it is: every published file listed in SHA256SUMS and matching it, every file attested by the repository's own workflow, every Go binary built from the tag's commit with an unmodified tree, and the binary for this machine answering --version with the tag. Every Go binary also has its toolchain reported (--min-go refuses an old one) and is scanned for known vulnerabilities (vuln.go).
relverify go-authn/authnd v0.10.2 relverify --wait 40m go-authn/bridge v0.23.0 # the release is still building
It waits for the tag's workflow runs to finish first, and stops at once when there is nothing to wait for. It exists because the check was a zsh function with awk in it, and on 2026-10-11 that function waited on a release.yml that go-fileshare/fileshare does not have: a 404 every 45 seconds, forever, with nothing printed. A tag nothing builds is an answer, and this says it.
The files go to the user cache directory (relverify/<owner>/<repo>/<tag>), never inside a git work tree: a release is binaries, and a binary inside a checkout is one `git add -A` from being committed.
Exit status: 0 every check passed; 1 a check failed; 2 the release could not be checked at all (no release, no runs, gh failing).
Source Files