Download tobby 0.5.2

Supply-chain verification
Every artifact below carries SLSA Build L3 provenance generated by the
slsa-github-generator trusted builder, a cosign-signed CycloneDX SBOM,
and reproducible-build guarantees. Full guide:
docs/release-verification.md.

Verify a binary against its SLSA provenance
slsa-verifier verify-artifact tobby-linux-amd64 \
--provenance-path tobby.intoto.jsonl \
--source-uri github.com/tobby-fetch/tobby-fetch \
--source-tag v0.5.2

Linux packages (offline install)
tobby_0.5.2_linux_<arch>.deb|rpm|apk wrap the same
reproducible binary (installed to /usr/bin/tobby, no install
scripts) and are covered by the same SLSA provenance and
SHA256SUMS. Verify with slsa-verifier as above, then install
with no repository or network access:
dpkg -i tobby_0.5.2_linux_amd64.deb # Debian/Ubuntu
rpm -i tobby_0.5.2_linux_amd64.rpm # RHEL/SUSE/Fedora
apk add --allow-untrusted tobby_0.5.2_linux_amd64.apk # Alpine
The packages carry no package-manager signature — trust comes
from the SLSA provenance and checksum verification performed
before installation (hence --allow-untrusted on apk).

Verify a signed SBOM
cosign verify-blob \
--new-bundle-format \
--bundle tobby-linux-amd64.cdx.json.bundle \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/tobby-fetch/tobby-fetch/' \
tobby-linux-amd64.cdx.json

Container image
ghcr.io/tobby-fetch/tobby-fetch:v0.5.2 — digest sha256:8532e930d60aa06cf88be38c0b74977a925256f89ce9c80a220f5ca1608b9994 (multi-arch amd64/arm64,
Wolfi-based, no shell, runs as uid 65532).
slsa-verifier verify-image ghcr.io/tobby-fetch/tobby-fetch@sha256:8532e930d60aa06cf88be38c0b74977a925256f89ce9c80a220f5ca1608b9994 \
--source-uri github.com/tobby-fetch/tobby-fetch \
--source-tag v0.5.2
cosign verify ghcr.io/tobby-fetch/tobby-fetch@sha256:8532e930d60aa06cf88be38c0b74977a925256f89ce9c80a220f5ca1608b9994 \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/tobby-fetch/tobby-fetch/'

Helm chart
oci://ghcr.io/tobby-fetch/charts/tobby version 0.5.2 — digest sha256:4a298e70bbd85c1d8f3edd614dbd753c1421d3e1ecc8df61353a4cc9694a9e92.
It deploys the image above by default.
cosign verify ghcr.io/tobby-fetch/charts/tobby@sha256:4a298e70bbd85c1d8f3edd614dbd753c1421d3e1ecc8df61353a4cc9694a9e92 \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/tobby-fetch/tobby-fetch/'
helm install tobby oci://ghcr.io/tobby-fetch/charts/tobby --version 0.5.2 \
--namespace tobby --create-namespace --set config.mode=passthrough

Independent rebuild (air-gapped verification)
The binaries and Linux packages are bit-reproducible. Rebuild
them from the tag and compare against SHA256SUMS — no online
infrastructure required:
git clone https://github.com/tobby-fetch/tobby-fetch && cd tobby-fetch
git checkout v0.5.2
SOURCE_DATE_EPOCH=$(git log -1 --format=%ct) sh tools/release-build.sh \
"v0.5.2" "$(git rev-parse HEAD)" \
"$(date -u -d "@$(git log -1 --format=%ct)" +%Y-%m-%dT%H:%M:%SZ)" dist
# optional — reproduces the .deb/.rpm/.apk too; needs nfpm at the
# NFPM_VERSION pinned in .github/workflows/release.yml
SOURCE_DATE_EPOCH=$(git log -1 --format=%ct) sh tools/package-build.sh \
"v0.5.2" dist dist
(cd dist && sha256sum --ignore-missing -c /path/to/downloaded/SHA256SUMS)