Software provenance
Note
These release assets were transparently built for easy verification of their provenance.
Using GitHub actions and workflows, binaries are verified using GitHub attestation and VirusTotal scanning, at build time, so that you can be certain the release assets you are using were transparently built from the source code.
- GitHub attestation will show where when and how the binary was built - example
- VirusTotal scanning will show the binary is malware free before release - example
Tip
The sha256sum of the GitHub attestations and VirusTotal scan should be the same for any release assets.
GitHub artifact-attestations
Expand for details
Binaries built from the release of 3.17.1+ use actions/attest-build-provenance - Github Docs
For example: using gh cli - manual
gh attestation verify iperf3-amd64 -o userdocsVirusTotal scan results
Expand for details
Links to scan results