Agent WranglersDistribution
Publish checksums, signatures and build provenance with every release, so users and package managers can prove the file came from your build.
- Required 1
- Recommended 1
Required
Publish a checksum and a signature with every download
DEV-18For every release file people download, publish a SHA-256 checksum file and a signature over it, both made in CI. Install scripts and update commands verify both and stop on any mismatch.
Recommended
Pin the checksum in every package manager manifest
DEV-19Generate each package manager manifest, such as a Homebrew formula or a winget manifest, in the release job. Each one names the download by its fixed release URL and its SHA-256.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/developer-tools/distribution">Agent Wranglers developer tools, SDKs and CLIs playbook</a>. In code you write, add a comment next to it with the same link.