One signed manifest per release.

For vendors on GitHub

Add the action to the job that publishes your release, after the artifacts exist.

permissions:
  contents: write
  id-token: write
  attestations: write

steps:
  - uses: jdx/packslip@v1
    with:
      artifacts: dist/*.tar.xz dist/*.zip
      bin: mytool

That is the whole integration. The action attests build provenance for every artifact, writes and signs the packslip with the job's identity, links the provenance from it, verifies what it wrote, and uploads packslip.sigstore.json to the release. The project name defaults to github.com/<owner>/<repo> and the version to the tag.

Everywhere else

The same binary runs anywhere. Inside any CI with an OIDC token it signs keylessly. Otherwise generate a key once, keep the secret half in your secret store, and publish release.pub so consumers can pin it. The signature is still logged to Rekor.

cargo install packslip

packslip keygen -o release.key
packslip create \
  --project mytool.example.com \
  --version "$VERSION" \
  --key release.key \
  --out dist \
  --url-base "https://dl.example.com/mytool/$VERSION" \
  --bin mytool \
  dist/*.tar.xz

packslip releases --project mytool.example.com \
  --sequence 42 --valid-for 30d --key release.key \
  --release "https://dl.example.com/mytool/$VERSION/packslip.sigstore.json=dist/packslip.sigstore.json" \
  --out site/.well-known/packslip.json

Platforms are inferred from file names; write path:os/arch[/libc] to override one and @fips-style variants to tell two builds of one platform apart. --bin oxlint=bin/oxlint-x86_64 names an executable differently from its file. Add --provenance URL once per artifact, in order, if you publish build provenance yourself. A monorepo runs the step once per tool with --project github.com/owner/repo/<tool>.

For consumers

Whether you are a package manager, a distribution repository, or a corporate mirror, the same rules apply.

1. Pin the identity once. For a forge project the name is the pin: accept only the forge's issuer and an identity under the repository. For a project on its own domain, pin its public key or identity. Never take a key from the document, and never trust a bundle's key hint.
2. Verify the bundle, then the statement, then the subject digest and size of every artifact you downloaded.
3. Enforce no-downgrade. Refuse a release whose scheme is weaker than the last accepted one, whose signer changed without a human saying so, or that dropped provenance the last release carried. Compare keyless signers by workflow path, not ref.
4. Apply a minimum release age to the log's integration time, so a hijacked release is noticed before unattended installs pick it up.
5. Treat supersedes as the ordering hint for rollback detection. Never parse version strings.
6. Order by the vendor's word, never by parsing. Every project has a release list: GitHub's releases endpoint, or a signed list on the vendor's domain. version_order says whether that list's order or semver ranks releases. Refuse a stale signed list, never select a yanked release, skip prereleases unless asked.
7. Never guess between two artifacts. Select by os, arch, libc, format, and variant; if two still match, stop.

packslip verify packslip.sigstore.json \
  --artifact mise-v2026.9.1-linux-x64.tar.xz --json
{
  "project": "github.com/jdx/mise",
  "version": "2026.9.1",
  "published_at": "2026-09-01T12:00:00Z",
  "scheme": "sigstore-oidc",
  "key_id": "https://github.com/jdx/mise/.github/workflows/release.yml@refs/tags/v2026.9.1",
  "issuer": "https://token.actions.githubusercontent.com",
  "logged_at": "2026-09-01T12:00:41Z",
  "provenance_linked": true,
  "checked_artifacts": ["mise-v2026.9.1-linux-x64.tar.xz"],
  "artifact_count": 6
}

Tighten the pin with --identity-prefix or an exact --identity and --issuer; pin a key with --pubkey. The verifier is also a Rust library, and packslip schema prints the JSON schema for other languages.