Releases: charmbracelet/crush
nightly
Verifying the artifacts
First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:
wget 'https://github.com/charmbracelet/crush/releases/download//checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download//checksums.txt.sigstore.json'Then, verify it using cosign:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--bundle 'checksums.txt.sigstore.json' \
./checksums.txtIf the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:
sha256sum --ignore-missing -c checksums.txtDone! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.
v0.55.0
Builtin "Crush config" skill + an experimental thing
We have a couple new feats on this release. Let's check them out!
Built-in "Crush config" skill
Starting on this release, Crush has the concept "built-in skills". Those are skill built in Crush, so you don't need to manually copy them to your machine or project.
For now we have a single one: "Crush config". Crush can now configure itself, so if you don't want to manually edit your crush.json config, you can just ask Crush itself to do it for you. You can ask it to add a custom providers, add a MCP, add a LSP, change a setting, etc.
Disable skill
We also added the ability to disable skills, no matter if built-in, global or project skill. Just add this to your crush.json:
{
"$schema": "https://charm.land/crush.json",
"options": {
"disabled_skills": ["crush-config"]
}
}Experimental server-client architecture
If you run Crush with CRUSH_CLIENT_SERVER=1, it'll now run via a brand new server-client architecture.
Keep in mind, though, this is VERY experimental! There are known bugs when using Crush in this mode. We'll be polishing it with time and only make it the default once it's stable.
Happy Easter!
Charm β¨
Changelog
New!
- 0f2e2f0: feat(server): initial implementation of Crush RPC server/client (@aymanbagabas)
- 2832d52: feat(skills): builtin skills + skill disabling + crush-config builtin (#2466) (@meowgorithm)
- 9a63da5: feat: add AppWorkspace implementation of Workspace interface gated behind CRUSH_CLIENT_SERVER env var (@aymanbagabas)
- 248d8b9: feat: add generated swagger docs and serve them in the server (@aymanbagabas)
- 6dcaab1: feat: add swagger api docs generation (@aymanbagabas)
- 1b37d55: feat: send server client version info (@aymanbagabas)
Fixed
- eb7ed4f: fix(client): add ListWorkspaces method to retrieve all workspaces from the server (@aymanbagabas)
- e410d7a: fix(server): encode sessions in proto format (@aymanbagabas)
- bc383d9: fix(server): log to stderr if it's a terminal (@aymanbagabas)
- 344eb32: fix: ensure proper resource cleanup and add retry logic for workspace creation (@aymanbagabas)
- 65974bb: fix: setup logging in server and client commands (@aymanbagabas)
- 2182fc4: fix: update UI tests to use test workspace (@aymanbagabas)
Other stuff
- 40c426a: chore: add a workaround for slog calls in config.Load leaking to stderr (@aymanbagabas)
- 7572ce1: chore: auto-update files (@charmcli)
- de04fc2: chore: auto-update files (@charmcli)
- ed71633: ci(lint): fix yet another lint issue (@andreynering)
- 33863b1: refactor(server): move agent, session, permission, and event logic to backend package (@aymanbagabas)
- 206aecf: refactor: centralize user config path in a single func
home.Config()(#2542) (@andreynering) - e44211d: refactor: migrate run and login commands to use client API instead of direct app access (@aymanbagabas)
- e3df84e: refactor: modernize (#2548) (@BrunoKrugel)
- 64f6cdf: refactor: rename Permissions.SkipRequests to Overrides().SkipPermissionRequests (@aymanbagabas)
- 7bb3a7b: refactor: simplify LSP diagnostic counts retrieval (@aymanbagabas)
- 72251dd: refactor: update client methods to return proto types (@aymanbagabas)
- e70c8ba: refactor: use client and server for workspace access and management (@aymanbagabas)
Verifying the artifacts
First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:
wget 'https://github.com/charmbracelet/crush/releases/download/v0.55.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.55.0/checksums.txt.sigstore.json'Then, verify it using cosign:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--bundle 'checksums.txt.sigstore.json' \
./checksums.txtIf the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:
sha256sum --ignore-missing -c checksums.txtDone! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.
v0.54.0
Small feats + more
We have a good number of fixes and enhacements in this release. Note how many contributors helped with this release! It's exciting to see the Crush community grow. π
Better init prompt
@Amolith made some nice improvements on the prompt to generate a AGENTS.md file for new projects.
Custom Git ignore file support
If you happen to have a custom global ignore file for Git (core.excludesfile), Crush will now respect that when listing files. Thanks @mavaa for implementing this!
Skills on crush session
crush session show and crush session last commands will now show a header with the all skills used by the session.
LSP Auto-Start setting
Setting options.auto_lsp to false on your config was supposed to prevent LSP servers from booting automatically, unless you had manually configured them. There was a bug with this setting, but @BrunoKrugel helped us by fixing it.
UI fix for non-image models
@huaiyuWangh contributed with this fix. If the model you're using doesn't support images, Crush will now hide the help items in the bottom with the keybinding to attach images.
No more .crush/.gitignore on your git diff
We recently changed the content of this file to not ignore .crush/skills/* by default, but a small annoying side-effect made that file itself visible by Git. We're now also ignoring the .crush/.gitignore file itself again.
Keep crushing!
Charm π
Changelog
New!
Fixed
- cda2719: fix(commands): add timeout context for MCP prompt retrieval (#2517) (@iceymoss)
- 664aae7: fix(csync): use pointer receiver for JSONSchemaAlias (#2521) (@huaiyuWangh)
- 8e743cb: fix(event): prevent panic on non-string telemetry keys (#2502) (@iceymoss)
- 3412194: fix(ls): respect git's
core.excludesfileconfig if set (#2314) (@mavaa) - 0e640a1: fix(lsp): respect lsp auto start config (#2487) (@BrunoKrugel)
- 5cf6e5a: fix(taskfile): fix syntax error on task
run:onboarding(@andreynering) - f416931: fix: conditionally show image keybindings based on model support (#2522) (@huaiyuWangh)
- 42c8bcc: fix: do not commit
.crush/.gitignore(#2531) (@andreynering) - 73c2a9d: fix: skip non-existent command dirs instead of creating them (#2534) (@majiayu000)
Other stuff
- 2bcc97b: chore(lint): fix some small lint warnings (#2488) (@BrunoKrugel)
- 8b30fad: chore: auto-update files (@charmcli)
- b68823b: feat(cli/session): show skill metadata (#2541) (@meowgorithm)
- d161cbc: feat(init-cmd): mention progressive disclosure (#1786) (@Amolith)
- 97c9f4b: refactor(ui): replace hardcoded cursor offset with style-based calculation (#2530) (@huaiyuWangh)
Verifying the artifacts
First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:
wget 'https://github.com/charmbracelet/crush/releases/download/v0.54.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.54.0/checksums.txt.sigstore.json'Then, verify it using cosign:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--bundle 'checksums.txt.sigstore.json' \
./checksums.txtIf the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:
sha256sum --ignore-missing -c checksums.txtDone! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.
v0.53.0
GLM-5.1 + Mr. Big Prompt
Hey all! Friday is here and we have a few fun goodies for Β« Le Week-End Β». Read on!
β‘οΈ GLM-5.1
Z.ai's GLM-5.1 was released just today as part of their coding plan, and it's available in Crush now. GLM-5.1 is a hot, new open source model that claims to come close to Opus 4.6. Enjoy and let us know what you think!
π¬ A Bigger Prompt
When we first released Crush, three lines for prompting felt great. Now it feels really tiny! Fear not: in this release we made the prompt input area dynamically grow up to 15 rows in height as needed.
π₯ Hot Fixes
- Diffs: in some scenarios, the diff for a changed file weren't behavior correctly and looked like the whole file was changed. Not anymore.
- Tools calls: if user canceled the session (with esc+esc) in the middle of a tool call, that could result in a broken session, making impossible to send new prompts. Fixed!
- Session titles: the prompt to generate a title for a session was further enhanced to avoid generating in the wrong language if the chosen small model wasn't too smart.
- Cleanup: we're now ensuring we clean temporary files created when you press ctrl+e (opens external editor to write prompt).
Enjoy your weekend!
Charm β¨
Changelog
New!
- a81a652: feat(ui): variable height prompt input field (#2468) (@meowgorithm)
Fixed
- 4a3df1e: fix(dialog): use valid key binding name for OAuth success state (#2491) (@huaiyuWangh)
- e7a4146: fix(diffview): use
udiff.Linesand notudiff.Strings(@andreynering) - 4501438: fix(ui): always clean up external editor temp file (#2503) (@iceymoss)
- 2928dcb: fix: append error tool message when tool call is cancelled (#2492) (@fuleinist)
- dd7b58d: fix: enhance session title prompt to fix language issue (#2497) (@andreynering)
Docs
- da39f6f: docs(readme): add q&a section and note about clipboard support (#2509) (@andreynering)
Other stuff
- 65b9ea5: chore(taskfile): add one more file to dependencies (@andreynering)
- 6efc370: chore: update catwalk (@andreynering)
Verifying the artifacts
First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:
wget 'https://github.com/charmbracelet/crush/releases/download/v0.53.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.53.0/checksums.txt.sigstore.json'Then, verify it using cosign:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--bundle 'checksums.txt.sigstore.json' \
./checksums.txtIf the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:
sha256sum --ignore-missing -c checksums.txtDone! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.
v0.52.0
Project skills + more
Hey! It's Wednesday already (time flies), and we're here bringing you a few good nice enhancements. Stay with us!
Project skills
We just added support for local skills. This means that you can easily share skills with your team mates or contributors inside the repository by just committing them.
Crush will look for the following projects paths:
.agents/skills.crush/skills.claude/skills.cursor/skills
Another related enhancement is that Windows users will also be able to put global skills on ~/.config/crush/skills or ~/.config/agents/skills, which is a little bit easier to manage to having them on ~\AppData\Local\crush\skills\.
Check out the complete docs here.
Non-English prompts
We improved our system prompts to enforce that the model should respond to message and generate session titles according to your prompt language. For example, if you're talking to the model in Portuguese π΅πΉ π§π·, you'll want it to respond in Portuguese.
Better file picker order
You know that you can easily pick files fro the text area by typing @, right? @huaiyuWangh made a great contribution on significantly improving the sorting based on your filter. This is a very signiifcant UX improvement for bug repos.
Talking about @huaiyuWangh, he also fixed the "Open file picker" option in the command pallette (ctrl+p).
Allow apps to detect Crush
Starting on this release, Crush will set these ENVs when running Bash commands via the Bash tool. The intention is to allow programs to detect that they are being ran by Crush.
CRUSH=1AGENT=crushAI_AGENT=crush
The AGENT and AI_AGENT ENVs are kinda a unofficial new standard, so a few tools already look for them.
That's all for today.
Enjoy the release and keep Crushing!
The Charm Team β¨
Changelog
New!
- 0f5df9b: feat(bash): set
CRUSH=1,AGENT=crushandAI_AGENT=crush(#2484) (@andreynering) - 0fcf79b: feat(ui): improve file completion ranking algorithm (@huaiyuWangh)
- f67fa35: feat(ui): prioritize filename-based completion ranking (@huaiyuWangh)
- cd5c937: feat: load project skills automatically from
.crush/skillsand more (@andreynering)
Fixed
- d89120c: fix(hyper): ensure it's possible to override with
HYPER_URL(@andreynering) - ffc7a9d: fix(log): don't conflate body drain errors with HTTP errors (@meowgorithm)
- 697fad9: fix: complete file picker dialog action (#2483) (@huaiyuWangh)
- db043c3: fix: on windows, also load skills from
$HOME/.config/crush/skills(@andreynering) - 06cf63f: fix: session titles should keep the same spoken language (@andreynering)
Docs
- 0e3d472: docs(readme): update skill docs with updates and new paths (@andreynering)
- 09da90a: docs(ui): add comprehensive comments to completion ranking algorithm (@huaiyuWangh)
Other stuff
- 6920cf1: chore(lint): modernize interfaces in the db package (@meowgorithm)
- 1a0b638: chore: update generated
.crush/.gitignoreto not ignore skills (@andreynering) - 2325de7: fix(system-prompt): tell the model to respond in the prompt spoken language (@andreynering)
Verifying the artifacts
First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:
wget 'https://github.com/charmbracelet/crush/releases/download/v0.52.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.52.0/checksums.txt.sigstore.json'Then, verify it using cosign:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--bundle 'checksums.txt.sigstore.json' \
./checksums.txtIf the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:
sha256sum --ignore-missing -c checksums.txtDone! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.
v0.51.3
Little patch
A couple small bugs were fixed in this release.
Long pasted content
We improved the detection of long text pasted into the prompt. Crush will add the content as a file attachment if the content is 3+ lines long, but that wasn't accounting for long single line texts (like a big un-indented JSON). This is now addressed.
Fetching big web pages
The model tried to fetch a web page that is long enough, it could not have enough context window to handle all that. We reduced the max file size to something more resoanable. The models will still see the content, but truncated.
SQLite
Also, the SQLite driver was updated to a new version that is faster, in particular on boot time, so Crush startup should be a little bit faster.
Tiny fix
And not less important, @faelis removed a duplicated help in the bottom.
See ya π
Charm
Changelog
Fixed
- 96f51ca: fix(tui): remove duplicate ctrl+g help binding in FullHelp (#2465) (@faelis)
- 0c6fb42: fix: improve long text detection to account for long text in a single line (#2442) (@andreynering)
- dfc57d4: fix: reduce max read size from 5mb to 1mb for view and fetch tools (#2447) (@andreynering)
Other stuff
- c771cf1: chore: update
google.golang.org/grpcwith security fix (#2464) (@andreynering) - 91bec12: chore: update ncruces/go-sqlite3 to v0.33.0 (#2461) (@andreynering)
Verifying the artifacts
First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:
wget 'https://github.com/charmbracelet/crush/releases/download/v0.51.3/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.51.3/checksums.txt.sigstore.json'Then, verify it using cosign:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--bundle 'checksums.txt.sigstore.json' \
./checksums.txtIf the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:
sha256sum --ignore-missing -c checksums.txtDone! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.
v0.51.2
Friday patch
Hello coders. We're bringing you a patch with a couple small but yet meaningful fixes.
Copilot tool calls
GitHub Copilot tool calls were broken when they had no arguments. An example of a a tool that don't require arguments is listing files when in the project root. This has now been fixed.
Ollama tool calls
In a similar manner, Ollama tools can differ a bit compared to OpenAI and other OpenAI-compatible providers. We improved how we handle those so tool calls for Ollama are now working!
Enjoy your weekend and keep crushing!
Charm π
Changelog
Fixed
- a2d4537: fix(fantasy): fix copilot tool calls, fix ollama compatibility (#2444) (@andreynering)
Verifying the artifacts
First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:
wget 'https://github.com/charmbracelet/crush/releases/download/v0.51.2/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.51.2/checksums.txt.sigstore.json'Then, verify it using cosign:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--bundle 'checksums.txt.sigstore.json' \
./checksums.txtIf the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:
sha256sum --ignore-missing -c checksums.txtDone! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.
v0.51.1
Mini Avian fix
Hi! This is a tiny patch to fix the Avian provider. Fly, Robin, fly!
xx, Charm π
Changelog
Fixed
- ad5368f: fix: update fantasy with a fix for avian (#2438) (@andreynering)
- df094bd: fix(mcp): handle raw/whitespace base64 (@meowgorithm)
- 351e562: fix(mcp/docker): only write config after docker startup succeeds (@meowgorithm)
- 6003105: fix(ui/docker): don't block ui when checking for docker desktop (@meowgorithm)
- 6c61cae: fix(ui/docker): stable sort mcp parameters (@meowgorithm)
Other stuff
- 12dfcdf: docs(mcp/docker): comments (@meowgorithm)
- f6e7a43: fix(mcp/docker): harden tests (@meowgorithm)
- 00cefc9: fix: remove deadcode (@meowgorithm)
Verifying the artifacts
First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:
wget 'https://github.com/charmbracelet/crush/releases/download/v0.51.1/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.51.1/checksums.txt.sigstore.json'Then, verify it using cosign:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--bundle 'checksums.txt.sigstore.json' \
./checksums.txtIf the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:
sha256sum --ignore-missing -c checksums.txtDone! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.
v0.51.0
Crush + Docker MCP π³
We teamed up with Docker to natively integrate the Docker MCP Catalog into Crush andβif we do say so ourselvesβit rocks!
There are also some CLI improvements and bug fixes in this release, too. Letβs get to it!
One MCP to Rule Them All
As we were saying, the big feature in this release is an integration with the Docker MCP Catalog.
During a conversation, Crush and Docker work together to pull in relevant MCPs on demand. Working with Postgres? Building a robot? Going deep on ARM? Crush and Docker will load in the MCP you need, when you need it (and yes, Crush will still ask for permission).
To get started, make sure Docker Desktop is running, then fire up Crush, press ctrl+p, choose βEnable Docker MCP Catalogβ, and get to work.
For more info on this rad feature check out the blog post.
CLI Ergonomics
People love crush run and crush session. What they do not, love, however, is typing. We have a solution for this, behold!
crush run->crush rcrush session->crush s
We also added --session and --continue flags to crush, allowing you to quickly pick resume sessions in both the CLI and the TUI.
crush --continue # continue the last session in the TUI
crush run --continue # continue the last session non-interactivelyFor more see crush βhelp.
These flags are now also available for the interactive mode, so you can just run crush --continue to automatically open the last chat, or crush --session {session-id} to automatically open a specific session.
Anthropic + Vertex Fix
If you work at a big company you probably know all about burning your bossβs tokens freely. This release fixes an authentication issuewith Anthropic via Google Vertex allowing you to resume token burning For more info see charmbracelet/fantasy#157.
Enjoy the release π³
Charm
Changelog
New!
- ddd99cd: feat: add aliases:
crush r->crush run,crush s->crush session(#2424) (@andreynering) - 630ff8c: feat: add support for
--sessionand--continuefor the tui (#2422) (@andreynering) - e0dcaba: feat: docker mcp integration (#2026) (@kujtimiihoxha)
Other stuff
- aa253c5: chore(taskfile): enhance
depstask to work for recent releases (@andreynering) - a3288de: chore: auto-update files (@charmcli)
Verifying the artifacts
First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:
wget 'https://github.com/charmbracelet/crush/releases/download/v0.51.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.51.0/checksums.txt.sigstore.json'Then, verify it using cosign:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--bundle 'checksums.txt.sigstore.json' \
./checksums.txtIf the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:
sha256sum --ignore-missing -c checksums.txtDone! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.
v0.50.1
GPT-5.4 Mini and GPT-5.4 Nano support
This release adds support for the new OpenAI models, GPT-5.4 Mini and Nano, released just today. GPT-5.4 Nano is also the new default small model for OpenAI.
Enjoy! β¨
Charm
Changelog
Other stuff
- 695ced1: chore: add support for gpt 5.4 mini and nano (#2419) (@andreynering)
Verifying the artifacts
First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:
wget 'https://github.com/charmbracelet/crush/releases/download/v0.50.1/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.50.1/checksums.txt.sigstore.json'Then, verify it using cosign:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--bundle 'checksums.txt.sigstore.json' \
./checksums.txtIf the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:
sha256sum --ignore-missing -c checksums.txtDone! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.





