Verify a Candle release

Every Candle CLI release on https://github.com/candledottv/agentic/releases is built and signed by that repository’s release.yaml workflow. Nothing else signs releases; there is no long-lived key to steal. Three checks, in increasing strength.

1. Checksum

curl -fsSLO https://github.com/candledottv/agentic/releases/download/cli-v0.7.0/SHA256SUMS
curl -fsSLO https://github.com/candledottv/agentic/releases/download/cli-v0.7.0/candle-darwin-arm64
grep candle-darwin-arm64 SHA256SUMS | shasum -a 256 -c

2. Provenance with the GitHub CLI

gh attestation verify candle-darwin-arm64 --repo candledottv/agentic \
  --signer-workflow candledottv/agentic/.github/workflows/release.yaml

3. The signature with cosign

curl -fsSLO https://github.com/candledottv/agentic/releases/download/cli-v0.7.0/candle-darwin-arm64.sigstore.json
cosign verify-blob --new-bundle-format --bundle candle-darwin-arm64.sigstore.json \
  --certificate-identity-regexp '^https://github.com/candledottv/agentic/\.github/workflows/release\.yaml@refs/tags/cli-v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  candle-darwin-arm64

A signature proves the file was built by that workflow, from the commit the provenance names, for that tag. candle update runs check 3 in process before it replaces the binary; the installer runs it when cosign or gh is available and always runs check 1.

--new-bundle-format says “expect a Sigstore bundle”, which is what Candle releases from 0.6.1 onward are signed as. Cosign also reads an older bundle format of its own, so leaving the flag off would quietly accept a shape that candle verify cannot read. It needs cosign 2.2 or newer. The one release signed the old way, cli-v0.6.0, verifies with cosign and gh but not with candle verify; run check 1 or check 2 on it instead.

No cosign or gh to install? If any working candle binary is already on the machine (an older release, one installed via Homebrew, or one built from source), it carries the same trusted root compiled in and can run the same check on its own, no network call and nothing else installed:

curl -fsSLO https://github.com/candledottv/agentic/releases/download/cli-v0.7.0/latest.json
candle verify candle-darwin-arm64 --bundle candle-darwin-arm64.sigstore.json

latest.json sits beside the other assets in every release, so downloading it alongside the bundle is what lets candle verify resolve the expected identity on its own; pass --identity instead if you would rather not fetch it. This is the same call candle update makes in process before it replaces itself.

The installer script itself

curl -fsSL https://candle.tv/install.sh | bash is the friendly line. The same script is a signed asset of every release, so you can fetch it pinned to a tag and check it before running it:

curl -fsSLO https://github.com/candledottv/agentic/releases/download/cli-v0.7.0/install.sh
curl -fsSLO https://github.com/candledottv/agentic/releases/download/cli-v0.7.0/install.sh.sigstore.json
cosign verify-blob --new-bundle-format --bundle install.sh.sigstore.json \
  --certificate-identity-regexp '^https://github.com/candledottv/agentic/\.github/workflows/release\.yaml@refs/tags/cli-v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  install.sh
bash install.sh

or from the source tree at the tag: curl -fsSL https://raw.githubusercontent.com/candledottv/agentic/cli-v0.7.0/install.sh. The script’s SHA-256 for each release is the install.sh line of that release’s SHA256SUMS.

By default the script refuses to install without a verifier (cosign, or a logged-in gh); CANDLE_INSTALL_ALLOW_UNSIGNED=1 installs on the checksum alone and prints the command to verify afterwards.

The transparency log

Every signature is recorded in Sigstore’s public log (Rekor). To list the entries for a release, take the SHA-256 of its SHA256SUMS from the release page and run rekor-cli search --sha <sha256>; a release has exactly one.