Verifying a Release Download

Every Accent CMS release attached to a GitHub release ships with material you can use to confirm a downloaded archive is exactly what our CI produced and has not been altered in transit. None of these checks require a license – they apply to any edition (Standard or Pro) on any target.

Verify the SHA-256 checksum

Each release includes a checksums-vX.Y.Z.txt file listing the SHA-256 hash of every published archive. After downloading both the archive and the checksums file into the same directory, verify the archive:

# Linux
sha256sum -c checksums-vX.Y.Z.txt --ignore-missing

# macOS
shasum -a 256 -c checksums-vX.Y.Z.txt --ignore-missing

--ignore-missing checks only the archives you actually downloaded and ignores the other targets listed in the file. A line ending in OK means the hash matches; any other result means the archive does not match what was published – do not run it.

Verify the checksums signature (when present)

When a release also carries a checksums-vX.Y.Z.txt.asc file, the checksums list itself is GPG-signed, so you can detect a tampered checksums file (not just a tampered archive). Import the Accent CMS signing public key once, then verify the detached signature before trusting the checksums:

gpg --verify checksums-vX.Y.Z.txt.asc checksums-vX.Y.Z.txt

A Good signature line confirms the checksums file is authentic; verify the key fingerprint against the one published on the release page. If a release has no .asc file, signed checksums were not produced for that build – fall back to the plain checksum check above.

Audit the embedded dependency list

Native binaries embed a compact software bill of materials (SBOM): the exact dependency tree the binary was compiled from, recorded in a dedicated section of the executable (under 4 kB). You can audit a downloaded binary against the RustSec advisory database without any access to our source tree:

# Scan the embedded SBOM for known vulnerabilities
cargo install cargo-audit       # one-time, provides `cargo audit`
cargo audit bin ./accent

# Or just print the recorded dependency tree
cargo install rust-audit-info
rust-audit-info ./accent

Each edition binary records only the crates actually compiled into it, so a Pro binary and a Standard binary report different trees. The cross-compiled aarch64-unknown-linux-gnu build is the one exception – it does not yet carry an embedded SBOM.

macOS Gatekeeper

On macOS, signed and notarized builds let Gatekeeper confirm the binary’s publisher; first-run verification happens online, since a bare command-line binary cannot have the notarization ticket stapled to it. If macOS quarantines a downloaded binary (“developer cannot be verified”), it has not been notarized – verify it with the checksum above and clear the quarantine attribute yourself only if you trust the source:

xattr -d com.apple.quarantine ./accent

What verification does and does not prove

A matching checksum and a good signature prove the archive is byte-for-byte what our release pipeline published. They do not, on their own, prove which source revision produced it – end-to-end build provenance (SLSA attestation) is a separate, forthcoming layer. Until then, the checksum, signature, and embedded SBOM together let you confirm integrity and audit the dependency set of any binary you run.