Release integrity

Checksums

Digests are read live from the SHA-256 sidecars attached to the latest GitHub release. Click a digest to expand it. The full machine-readable record is release-manifest.json.

SHA256SUMS.txt release-manifest.json Releases on GitHub

Release channel

No published release yet

Nothing to verify until a stable release ships

Implementation status

Linux x86-64

The release workflow publishes these two Linux artifacts with their checksums, signatures and a release manifest.

Artifact	SHA-256	Sidecars	Download
yume-amd64-linux.tar.xz	No published release	sha256 / sig	download
yumed-amd64-linux	No published release	sha256 / sig	download

The client bundle also carries its own manifest.json next to the binaries, recording the source commit and the SHA-256 of every file it contains.

Verifying

Both artifacts at once

Download SHA256SUMS.txt alongside the artifacts and check them together.

Shell

sha256sum -c SHA256SUMS.txt

Signatures

Publication requires detached armored signatures for both artifacts, the checksum list and the manifest.

GPG

gpg --verify SHA256SUMS.txt.sig SHA256SUMS.txt

SHA-256

Use the SHA-256 sidecars or aggregate list to check file integrity, and verify signatures to authenticate their origin.