Documentation

Choose a path based on whether you publish software, install it, or build an integration. For the relationship between configuration, signing, and discovery, read How packslip fits a release .

Try packslip

Getting started creates and verifies a small local release. It needs no CI account or connection to the signing services once the CLI is installed.

Publish software

Follow these guides in the order your release needs them:

1. Artifact configuration : describe platforms, executable paths, and variants, using flags or a TOML manifest.
2. Resources and host requirements : describe additional files and what the host must provide.
3. Release recipes : adapt a Rust, Go, monorepo, or desktop layout.
4. Publish with GitHub Actions : sign and upload the bundle from your release job.
5. Manage release lists : publish discovery metadata, withdraw versions, and recommend a default release.

Install software or build a consumer

• Using packslip with mise shows artifact installation, completions, skills, and trust continuity in a consumer.
• Verify a release explains trusted identities, file verification, and the additional policy an installer must enforce.
• Consumer rules define the complete contract. A successful CLI verification alone does not implement that contract.

Reference

• CLI reference : every command, argument, and flag.
• Specification : release statements, signing, discovery, version selection, and consumer requirements.
• JSON schemas: release statement and release list . These describe the decoded in-toto statements, not the enclosing sigstore bundles.
• Contributing : build the project and edit the documentation.

Terms used in these docs