Cull Release Verify
Principle
Reconstruct release truth from immutable public evidence. Verification is
read-only by default.
Verify
- Resolve the Cull checkout and select the explicit version or latest public
release.
- Run
npm run release:cull -- state show --version "$VERSION" --json and parse
exactly one JSON envelope.
- Bind the annotated Git tag object and peeled commit to the published release,
authenticated workflow run, provenance, and required asset inventory.
- Download artifacts to an isolated temporary directory. Run Cull's exact
artifact verifier; check updater signature, SHA-256 checksums, DMG contents,
embedded version and architecture, codesign, Gatekeeper, and notarization
staple.
- Compare Homebrew version and SHA-256 with public provenance and require its
promotion evidence.
- Report version, commit, tag object, workflow, asset hashes, release URL, tap
commit, installed-version evidence, launch evidence, and mismatches.
Default to no installation. When the user explicitly requests an install smoke,
use an isolated location and preserve any existing app. Never edit release state,
the GitHub release, tags, the tap, system Applications, or cull.db.
1---2name: cull-release-verify3description: Use when verifying or auditing a Cull release, DMG, updater archive, notarization, Homebrew cask, installed version, launch health, or post-publication distribution state.4---5
6# Cull Release Verify
7
8## Principle
9
10Reconstruct release truth from immutable public evidence. Verification is
11read-only by default.
12
13## Verify
14
151. Resolve the Cull checkout and select the explicit version or latest public
16 release.
172. Run `npm run release:cull -- state show --version "$VERSION" --json` and parse
18 exactly one JSON envelope.
193. Bind the annotated Git tag object and peeled commit to the published release,
20 authenticated workflow run, provenance, and required asset inventory.
214. Download artifacts to an isolated temporary directory. Run Cull's exact
22 artifact verifier; check updater signature, SHA-256 checksums, DMG contents,
23 embedded version and architecture, codesign, Gatekeeper, and notarization
24 staple.
255. Compare Homebrew version and SHA-256 with public provenance and require its
26 promotion evidence.
276. Report version, commit, tag object, workflow, asset hashes, release URL, tap
28 commit, installed-version evidence, launch evidence, and mismatches.
29
30Default to no installation. When the user explicitly requests an install smoke,
31use an isolated location and preserve any existing app. Never edit release state,
32the GitHub release, tags, the tap, system Applications, or `cull.db`.
glebis