Skip to content

Releases: axodotdev/cargo-dist

Version 0.25.2-prerelease.3

08 Nov 22:37
Compare
Choose a tag to compare
Pre-release

Release Notes

Nothing Yet!

Install cargo-dist 0.25.2-prerelease.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.25.2-prerelease.3/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.25.2-prerelease.3/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/dist@0.25.2-prerelease.3

Download cargo-dist 0.25.2-prerelease.3

File Platform Checksum
cargo-dist-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
cargo-dist-x86_64-apple-darwin.tar.xz Intel macOS checksum
cargo-dist-x86_64-pc-windows-msvc.zip x64 Windows checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.25.2-prerelease.2

08 Nov 22:02
Compare
Choose a tag to compare
Pre-release

Release Notes

Nothing Yet!

Install cargo-dist 0.25.2-prerelease.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.25.2-prerelease.2/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.25.2-prerelease.2/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/dist@0.25.2-prerelease.2

Download cargo-dist 0.25.2-prerelease.2

File Platform Checksum
cargo-dist-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
cargo-dist-x86_64-apple-darwin.tar.xz Intel macOS checksum
cargo-dist-x86_64-pc-windows-msvc.zip x64 Windows checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.25.2-prerelease.0

08 Nov 19:06
Compare
Choose a tag to compare
Pre-release

Release Notes

Nothing Yet!

Install cargo-dist 0.25.2-prerelease.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.25.2-prerelease.0/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.25.2-prerelease.0/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/dist@0.25.2-prerelease.0

Download cargo-dist 0.25.2-prerelease.0

File Platform Checksum
cargo-dist-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
cargo-dist-x86_64-apple-darwin.tar.xz Intel macOS checksum
cargo-dist-x86_64-pc-windows-msvc.zip x64 Windows checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.25.1 (2024-11-01)

01 Nov 18:47
Compare
Choose a tag to compare

Release Notes

This release contains a few new features for further customizing the installer experience, both as a packager and the end user.

Artifact location installer customization

We now provide two new environment variables making it possible to customize just the base URL for fetching installers. Previously, the only customization for overriding the install URL overrode the full URL, including version-specific paths, which made it difficult to use for users who were proxying or mirroring GitHub paths. These new variables are branded with your app's name. For example:

  • {app_name}_INSTALLER_GITHUB_BASE_URL
  • {app_name}_INSTALLER_GHE_BASE_URL

These two variables will also be supported by a new version of axoupdater in order to allow overriding the GitHub API URL. Thank you to user @gaborbernat for inspiring this change and writing the axoupdater side!

You can learn more about this feature in the artifact location installer usage documentation.

Default glibc version override

Ordinarily, dist automatically detects the version of glibc used by your linux-gnu builds and uses this in the installers to detect if the end user's system will be compatible. In certain specific build environments, this autodetection isn't possible, so we've introduced a feature allowing the glibc version to be manually specified in the dist configuration. If provided, this replaces the fallback version that would otherwise be used.

Install cargo-dist 0.25.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.25.1/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.25.1/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/dist@0.25.1

Download cargo-dist 0.25.1

File Platform Checksum
cargo-dist-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
cargo-dist-x86_64-apple-darwin.tar.xz Intel macOS checksum
cargo-dist-x86_64-pc-windows-msvc.zip x64 Windows checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.25.0-prerelease.1 (2024-10-31)

31 Oct 21:37
Compare
Choose a tag to compare

Release Notes

This release contains a few new features.

Improvements to installer customization

We now provide two new environment variables making it possible to customize just the base URL for fetching installers. Previously, the only customization for overriding the install URL overrode the full URL, including version-specific paths, which made it difficult to use for users who were proxying or mirroring GitHub paths. These new variables are branded with your app's name. For example:

  • {app_name}_INSTALLER_GITHUB_BASE_URL
  • {app_name}_INSTALLER_GHE_BASE_URL

These two variables will also be supported by a new version of axoupdater in order to allow overriding the GitHub API URL.

Override default glibc version

Ordinarily, dist automatically detects the version of glibc used by your linux-gnu builds and uses this in the installers to detect if the end user's system will be compatible. In certain specific build environments, this autodetection isn't possible, so we've introduced a feature allowing the glibc version to be manually specified in the dist configuration. If provided, this replaces the fallback version that would otherwise be used.

Install cargo-dist 0.25.0-prerelease.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.25.0-prerelease.1/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.25.0-prerelease.1/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/dist@0.25.0-prerelease.1

Download cargo-dist 0.25.0-prerelease.1

File Platform Checksum
cargo-dist-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
cargo-dist-x86_64-apple-darwin.tar.xz Intel macOS checksum
cargo-dist-x86_64-pc-windows-msvc.zip x64 Windows checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.24.1 (2024-10-29)

29 Oct 18:22
Compare
Choose a tag to compare

Release Notes

Loosens the "cargo is broken" error reporting condition, letting us be more precise about cases where Cargo is present but Cargo metadata can't be parsed.

Install cargo-dist 0.24.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.24.1/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.24.1/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/dist@0.24.1

Download cargo-dist 0.24.1

File Platform Checksum
cargo-dist-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
cargo-dist-x86_64-apple-darwin.tar.xz Intel macOS checksum
cargo-dist-x86_64-pc-windows-msvc.zip x64 Windows checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.24.0 (2024-10-28)

28 Oct 17:23
Compare
Choose a tag to compare

Release Notes

It's been less than two weeks, and we're already back with a big dist release for you. This release has several major features, beginning with the biggest news that:

dist has a new name

Did the last paragraph give it away? Well, it's true: cargo-dist is now just dist. This reflects our growing support for packaging software built by tools beyond just Cargo. Our support for Cargo isn't going away of course, or becoming any less of a focus.

As a part of this, dist has moved towards a standalone CLI tool that doesn't have to be run as a cargo subcommand. You can now run dist init, dist build and more without needing to prefix it with cargo. We still install the Cargo plugin, though, so you're welcome to keep using cargo dist like always. As a part of being able to run without the Cargo plugin, there's one more big change:

dist runs without Cargo

dist no longer requires Cargo if you're not building Rust projects! This is a major change which should make it much more ergonomic for users of other languages. We do still require Cargo if your workspace contains at least one Rust project; this includes commands such as dist init and dist plan.

Unified checksum file

This change is completely unrelated to the new name, but it's a very nice one. We've always shipped individual checksum files for each artifact, but in this release we now also ship a unified checksum file which contains all of your hashes in a single place. It's named $HASH_STYLE.sum, for example sha256.sum, and is designed to be compatible with tools such as shasum and sha256sum.

Fixes

Install cargo-dist 0.24.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.24.0/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.24.0/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/dist@0.24.0

Download cargo-dist 0.24.0

File Platform Checksum
cargo-dist-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
cargo-dist-x86_64-apple-darwin.tar.xz Intel macOS checksum
cargo-dist-x86_64-pc-windows-msvc.zip x64 Windows checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.24.0-prerelease.2

23 Oct 21:06
Compare
Choose a tag to compare
Pre-release

Release Notes

Nothing Yet!

Install cargo-dist 0.24.0-prerelease.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.24.0-prerelease.2/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.24.0-prerelease.2/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/dist@0.24.0-prerelease.2

Download cargo-dist 0.24.0-prerelease.2

File Platform Checksum
cargo-dist-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
cargo-dist-x86_64-apple-darwin.tar.xz Intel macOS checksum
cargo-dist-x86_64-pc-windows-msvc.zip x64 Windows checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.24.0-prerelease.1

22 Oct 23:37
Compare
Choose a tag to compare
Pre-release

Release Notes

Nothing Yet!

Install cargo-dist 0.24.0-prerelease.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.24.0-prerelease.1/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.24.0-prerelease.1/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Install prebuilt binaries into your npm project

npm install @axodotdev/dist@0.24.0-prerelease.1

Download cargo-dist 0.24.0-prerelease.1

File Platform Checksum
cargo-dist-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
cargo-dist-x86_64-apple-darwin.tar.xz Intel macOS checksum
cargo-dist-x86_64-pc-windows-msvc.zip x64 Windows checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Version 0.23.0 (2024-10-15)

15 Oct 20:40
Compare
Choose a tag to compare

Release Notes

We're back from a longer-than-usual break between releases with a feature-filled release!

The new config format emerges

Over the past few months, we've been working towards a new config format. Up to now, aside from a few references in the documentation, these changes have been internal and haven't been visible to users. This release marks the first user-facing side of the new config format.

This new config format uses the dist-workspace.toml and dist.toml files that were originally created for non-Rust projects. It allows us to unify project configuration formats between languages, and allows you to configure cargo-dist without adding content to your root Cargo.toml. In this release, newly cargo initted Rust projects will use the new format. Existing projects will be given the option to opt into the new format, but by default will keep their existing format for now.

For more information, see the workspace docs.

Installer improvements

This release contains a suite of improvements to our installers.

"Unmanaged" install type

We now support a new install type, "unmanaged" installs. This is intended for users installing in ephemeral install methods such as CI, and disables several features that are unneeded in those environments. Specifically, it:

  • Disables updater-related tooling, including install receipt creation
  • Disables modification of the user's PATH, including modification of dotfiles
  • Forces a flat installation layout, installing all files into a single directory

For more information, see the installer usage docs.

Improved path modification options

While we've always provided options to turn off modifying the user's PATH in the installer, this behaviour was inconsistent between the shell and PowerShell installers. In this release, we've unified the behaviour. The current recommended path is to use environment variables; the variable controlling this is APPNAME_NO_MODIFY_PATH, where APPNAME is the name of your application. For example, AXOLOTLSAY_NO_MODIFY_PATH for an app named axolotlsay. The commandline flag, which was named inconsistently between platforms, has been deprecated.

We've also made a change to ensure that the user's preference for the "don't modify PATH" option is persisted across upgrades. This fixes an issue present in previous versions where it would only be respected on initial installation, not in calls to axoupdater.

For more information, see the installer usage docs.

npm packages can now use any archive format

In previous versions, enabling the npm installer would require your package to be distributed using .tar.gz archives on all platforms, including Windows. This release removes that restriction by rewriting a section of the npm installer code.

Axoupdater version checking

Users who implement an updater by using axoupdater as a library always need to make sure that library is up to date so that they're able to make use of the latest features. This release contains a version checker which detects if your software is using an out-of-date version of axoupdater which may cause problems, and will alert you that an update is needed during builds. For more information, see the documentation.

Standalone axoupdater installation fix

cargo-dist versions 0.21.1, 0.22.0 and 0.22.1 contain a bug which caused the standalone installer to fail to install when using the shell installer. End users who installed your software via installers generated with these versions will not have received a standalone installer along with your software. This bug is fixed beginning with this release. For more information, see the documentation.

Install cargo-dist 0.23.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.23.0/cargo-dist-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://axodotdev.artifacts.axodotdev.host/cargo-dist/v0.23.0/cargo-dist-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install axodotdev/tap/cargo-dist

Download cargo-dist 0.23.0

File Platform Checksum
cargo-dist-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
cargo-dist-x86_64-apple-darwin.tar.xz Intel macOS checksum
cargo-dist-x86_64-pc-windows-msvc.zip x64 Windows checksum
cargo-dist-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
cargo-dist-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
cargo-dist-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
cargo-dist-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo axodotdev/cargo-dist

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>