這裡收錄dist從2025年12月15日到目前0.34.0的6個版本，每個版本都連到開發商的官方安裝檔。
| 版本 | 日期 | 大小 | 檔案 |
|---|---|---|---|
| 0.34.0最新版本 | 2026年11月2日 | — | 64位元 ZIP 更新紀錄## Release Notes
This release upgrades the aarch64-apple-darwin runner to macos-14.
• impl @20jasper [feat：default Apple Silicon builds to macos-15](https://github.com/axodotdev/cargo-dist/pull/2555)
## Install cargo-dist 0.34.0
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install axodotdev/tap/cargo-dist
```
### Install prebuilt binaries into your npm project
```sh
npm install @axodotdev/dist@0.34.0
```
## Download cargo-dist 0.34.0
| File | Platform | Checksum |
|--------|----------|----------|
| [cargo-dist-aarch64-apple-darwin.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-aarch64-apple-darwin.tar.xz) | Apple Silicon macOS | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-aarch64-apple-darwin.tar.xz.sha256) |
| [cargo-dist-x86_64-apple-darwin.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-x86_64-apple-darwin.tar.xz) | Intel macOS | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-x86_64-apple-darwin.tar.xz.sha256) |
| [cargo-dist-x86_64-pc-windows-msvc.zip](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-x86_64-pc-windows-msvc.zip.sha256) |
| [cargo-dist-aarch64-unknown-linux-gnu.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-aarch64-unknown-linux-gnu.tar.xz) | ARM64 Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-aarch64-unknown-linux-gnu.tar.xz.sha256) |
| [cargo-dist-x86_64-unknown-linux-gnu.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-x86_64-unknown-linux-gnu.tar.xz) | x64 Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-x86_64-unknown-linux-gnu.tar.xz.sha256) |
| [cargo-dist-aarch64-unknown-linux-musl.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-aarch64-unknown-linux-musl.tar.xz) | ARM64 MUSL Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-aarch64-unknown-linux-musl.tar.xz.sha256) |
| [cargo-dist-x86_64-unknown-linux-musl.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-x86_64-unknown-linux-musl.tar.xz) | x64 MUSL Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.34.0/cargo-dist-x86_64-unknown-linux-musl.tar.xz.sha256) |
## Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify):
```sh
gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist
```
You can also download the attestation from [GitHub](https://github.com/axodotdev/cargo-dist/attestations) and verify against that directly:
```sh
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> --repo axodotdev/cargo-dist
``` |
| 0.33.1 | 2026年10月21日 | — | 64位元 ZIP 更新紀錄## Release Notes
This release updates several dependencies. This includes an update to dependencies containing certificate lists to ensure recently-revoked certificates are no longer trusted.
## Install cargo-dist 0.33.1
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install axodotdev/tap/cargo-dist
```
### Install prebuilt binaries into your npm project
```sh
npm install @axodotdev/dist@0.33.1
```
## Download cargo-dist 0.33.1
| File | Platform | Checksum |
|--------|----------|----------|
| [cargo-dist-aarch64-apple-darwin.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-aarch64-apple-darwin.tar.xz) | Apple Silicon macOS | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-aarch64-apple-darwin.tar.xz.sha256) |
| [cargo-dist-x86_64-apple-darwin.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-x86_64-apple-darwin.tar.xz) | Intel macOS | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-x86_64-apple-darwin.tar.xz.sha256) |
| [cargo-dist-x86_64-pc-windows-msvc.zip](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-x86_64-pc-windows-msvc.zip.sha256) |
| [cargo-dist-aarch64-unknown-linux-gnu.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-aarch64-unknown-linux-gnu.tar.xz) | ARM64 Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-aarch64-unknown-linux-gnu.tar.xz.sha256) |
| [cargo-dist-x86_64-unknown-linux-gnu.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-x86_64-unknown-linux-gnu.tar.xz) | x64 Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-x86_64-unknown-linux-gnu.tar.xz.sha256) |
| [cargo-dist-aarch64-unknown-linux-musl.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-aarch64-unknown-linux-musl.tar.xz) | ARM64 MUSL Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-aarch64-unknown-linux-musl.tar.xz.sha256) |
| [cargo-dist-x86_64-unknown-linux-musl.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-x86_64-unknown-linux-musl.tar.xz) | x64 MUSL Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.1/cargo-dist-x86_64-unknown-linux-musl.tar.xz.sha256) |
## Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify):
```sh
gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist
```
You can also download the attestation from [GitHub](https://github.com/axodotdev/cargo-dist/attestations) and verify against that directly:
```sh
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
``` |
| 0.33.0 | 2026年9月11日 | — | 64位元 ZIP 更新紀錄## Release Notes
This release includes several new features and a change to the shell installers in certain environments.
## Azure Artifact Signing for Windows binaries and installers
We now include support for codesigning Windows binaries and installers using [Azure Artifact Signing](https://azure.microsoft.com/en-us/products/artifact-signing). For more information, see [the docs](https://axodotdev.github.io/cargo-dist/book/supplychain-security/signing/windows.html#azure-artifact-signing-quickstart).
This currently only supports x86_64 Windows targets, and doesn't support aarch64 Windows targets or non-Windows targets.
• impl @blyedev [Add Azure signing support and improve workflow for releases](https://github.com/axodotdev/cargo-dist/pull/2396)
## Shell installers now place `env` helper alongside receipts for flat installs
In previous versions of dist, we would place the `env` helper scripts which add your program to the user's `PATH` alongside the binary when using a "flat" install layout. ("Flat" layouts consist of only a single directory, as opposed to the default "hierarchical" layout that places binaries in a "bin" subdirectory.) Beginning with dist 0.33.0, we instead place the `env` script in the app-specific config path alongside the install receipt. By default, this is `~/.config/$APP_NAME`. If users had installed a previous version of your app, newer versions of the installer will migrate old `env` files to the new location in addition to updating the user's dotfiles.
-impl @Gankra [Install env scripts in receipts dir instead of bin dir](https://github.com/axodotdev/cargo-dist/pull/2423)
## Fixes
• impl @ntBre [Include `--repo` in both `gh attestation` commands](https://github.com/axodotdev/cargo-dist/pull/2498)
## Install cargo-dist 0.33.0
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.33.0/cargo-dist-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.33.0/cargo-dist-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install axodotdev/tap/cargo-dist
```
### Install prebuilt binaries into your npm project
```sh
npm install @axodotdev/dist@0.33.0
```
## Download cargo-dist 0.33.0
| File | Platform | Checksum |
|--------|----------|----------|
| [cargo-dist-aarch64-apple-darwin.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.0/cargo-dist-aarch64-apple-darwin.tar.xz) | Apple Silicon macOS | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.0/cargo-dist-aarch64-apple-darwin.tar.xz.sha256) |
| [cargo-dist-x86_64-apple-darwin.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.0/cargo-dist-x86_64-apple-darwin.tar.xz) | Intel macOS | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.0/cargo-dist-x86_64-apple-darwin.tar.xz.sha256) |
| [cargo-dist-x86_64-pc-windows-msvc.zip](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.0/cargo-dist-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.0/cargo-dist-x86_64-pc-windows-msvc.zip.sha256) |
| [cargo-dist-aarch64-unknown-linux-gnu.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.0/cargo-dist-aarch64-unknown-linux-gnu.tar.xz) | ARM64 Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.0/cargo-dist-aarch64-unknown-linux-gnu.tar.xz.sha256) |
| [cargo-dist-x86_64-unknown-linux-gnu.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.0/cargo-dist-x86_64-unknown-linux-gnu.tar.xz) | x64 Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.33.0/cargo-dist-x86_64-unknown-linux-gnu.tar.xz.sha256) |
| [cargo-dist-aarch64-unknown-linux-musl |
| 0.32.0 | 2026年5月22日 | — | 64位元 ZIP 更新紀錄## Release Notes
This release contains several bugfixes and an update to the npm installer to reduce its dependencies. It also updates the default versions of all GitHub actions.
## npm installer
The npm installer now relies on builtin node modules in place of the external axios and rimraf libraries. In order to support this, we've raised the minimum supported node version to [14.14](https://nodejs.org/en/blog/release/v14.14.0).
• impl @rafaeelaudibert [chore(npm)：replace axios with native node:http/node:https](https://github.com/axodotdev/cargo-dist/pull/2350)
## cargo-zigbuild and cargo-auditable
It's now possible to use cargo-auditable together with cross-compilation via cargo-zigbuild. In previous versions of dist, these two features were mutually exclusive.
• impl @mistydemeo [feat(auditable)：remove zigbuild limitation](https://github.com/axodotdev/cargo-dist/pull/2318)
## Fixes
• impl @eegli [fix：double escape windows path in receipt](https://github.com/axodotdev/cargo-dist/pull/2313)
• impl @woodruffw [ps1：peek the inner exception on download failure](https://github.com/axodotdev/cargo-dist/pull/2392)
• impl @mistydemeo [feat(ci)：migrate from attest-build-provenance@v3 to attest@v4](https://github.com/axodotdev/cargo-dist/pull/2357)
• impl @OpenSauce [chore(deps)：bump github actions](https://github.com/axodotdev/cargo-dist/pull/2322)
## Install cargo-dist 0.32.0
### Install prebuilt binaries via shell script
```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-installer.sh | sh
```
### Install prebuilt binaries via powershell script
```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-installer.ps1 | iex"
```
### Install prebuilt binaries via Homebrew
```sh
brew install axodotdev/tap/cargo-dist
```
### Install prebuilt binaries into your npm project
```sh
npm install @axodotdev/dist@0.32.0
```
## Download cargo-dist 0.32.0
| File | Platform | Checksum |
|--------|----------|----------|
| [cargo-dist-aarch64-apple-darwin.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-aarch64-apple-darwin.tar.xz) | Apple Silicon macOS | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-aarch64-apple-darwin.tar.xz.sha256) |
| [cargo-dist-x86_64-apple-darwin.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-x86_64-apple-darwin.tar.xz) | Intel macOS | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-x86_64-apple-darwin.tar.xz.sha256) |
| [cargo-dist-x86_64-pc-windows-msvc.zip](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-x86_64-pc-windows-msvc.zip.sha256) |
| [cargo-dist-aarch64-unknown-linux-gnu.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-aarch64-unknown-linux-gnu.tar.xz) | ARM64 Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-aarch64-unknown-linux-gnu.tar.xz.sha256) |
| [cargo-dist-x86_64-unknown-linux-gnu.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-x86_64-unknown-linux-gnu.tar.xz) | x64 Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-x86_64-unknown-linux-gnu.tar.xz.sha256) |
| [cargo-dist-aarch64-unknown-linux-musl.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-aarch64-unknown-linux-musl.tar.xz) | ARM64 MUSL Linux | [checksum](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-aarch64-unknown-linux-musl.tar.xz.sha256) |
| [cargo-dist-x86_64-unknown-linux-musl.tar.xz](https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/car |
| 0.31.0 | 2026年2月23日 | — | 64位元 ZIP 更新紀錄Release Notes
This release includes several new features, including the major introduction of mirrors that installers can fallback to.
Simple hosting (aka mirrors)
This release adds a new hosting method, simple, which supports static file hosting. This allows you to host your artifacts on the hosting provider of your choice so long as it follows a similar URL structure to GitHub Releases hosting. It can also be used alongside GitHub hosting; if you specify more than one hosting provider, the secondary hosting source will be used as a mirror. The priority is determined by the order of the keys in your config. For example, this will use GitHub first and fall back to your static host if GitHub is unavailable:
hosting = ["github", "simple"]
simple-download-url = "https://static.myapp.com/{tag}"
And this will use your static host first and fall back to GitHub if necessary:
hosting = ["simple", "github"]
simple-download-url = "https://static.myapp.com/{tag}"
For more information, see the docs.
Note: currently, dist won't upload artifacts to static hosts; it expects you to handle that, either manually or via writing a custom job.
- impl @Gankra Add "simple" hosting style
- impl @mistydemeo feat(homebrew): mirror support with multi-urls
Disabling npm-shrinkwrap.json for npm installers
Currently, the npm installer includes an npm-shrinkwrap.json to specify the exact versions of its runtime dependencies as used at the time dist was released. Since some users would prefer looser dependency specification, this release provides an option to disable this. For more information, see the docs.
npm-shrinkwrap = false
- impl @mistydemeo feat: option to skip npm-shrinkwrap.json generation
Configurable build directory for generic projects
Until now, generic (non-Rust) project support has assumed that artifacts are always written to the root of the project directory. This path is now configurable using the out-dir setting in your dist.toml. For example, if your project generates a binary named example in a subdirectory called build, you can specify:
binaries = ["example"]
out-dir = "build"
- impl @CatBraaain support out_dir in config
Fixes
- impl @EliteTK + @Gankra Reduce risk of an interrupted installation leading to a partial installation
Install cargo-dist 0.31.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install axodotdev/tap/cargo-dist
Install prebuilt binaries into your npm project
npm install @axodotdev/dist@0.31.0
Download cargo-dist 0.31.0
─────────────────────────────────────────────────┬───────────────────┬─────────────
File │Platform │Checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-aarch64-apple-darwin.tar.xz │Apple Silicon macOS│checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-x86_64-apple-darwin.tar.xz │Intel macOS │checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-x86_64-pc-windows-msvc.zip │x64 Windows │checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-aarch64-unknown-linux-gnu.tar.xz │ARM64 Linux │checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-x86_64-unknown-linux-gnu.tar.xz │x64 Linux │checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-aarch64-unknown-linux-musl.tar.xz │ARM64 MUSL Linux │checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-x86_64-unknown-linux-musl.tar.xz │x64 MUSL Linux │checksum
─ |
| 0.30.3 | 2025年12月15日 | — | 64位元 ZIP 更新紀錄Release Notes
This release contains a few minor bugfixes. It also updates dependencies, including a rimraf upgrade that resolves a CVE in glob. This vulnerability was not exploitable in the way dist used rimraf.
Fixes
- impl @AThePeanut4 fix: invalid file permissions when running the shell installer under sudo
- impl @ryanobjc fix: macOS codesigning configuration not being respected
Thanks to @zachstence for handling the rimraf/glob upgrade!
Install cargo-dist 0.30.3
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.3/cargo-dist-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/axodotdev/cargo-dist/releases/download/v0.30.3/cargo-dist-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install axodotdev/tap/cargo-dist
Install prebuilt binaries into your npm project
npm install @axodotdev/dist@0.30.3
Download cargo-dist 0.30.3
─────────────────────────────────────────────────┬───────────────────┬─────────────
File │Platform │Checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-aarch64-apple-darwin.tar.xz │Apple Silicon macOS│checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-x86_64-apple-darwin.tar.xz │Intel macOS │checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-x86_64-pc-windows-msvc.zip │x64 Windows │checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-aarch64-unknown-linux-gnu.tar.xz │ARM64 Linux │checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-x86_64-unknown-linux-gnu.tar.xz │x64 Linux │checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-aarch64-unknown-linux-musl.tar.xz │ARM64 MUSL Linux │checksum
─────────────────────────────────────────────────┼───────────────────┼─────────────
cargo-dist-x86_64-unknown-linux-musl.tar.xz │x64 MUSL Linux │checksum
─────────────────────────────────────────────────┴───────────────────┴─────────────
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist
You can also download the attestation from GitHub and verify against that directly:
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> |
