---
title: Verifying Release Artifacts
description: How to verify the SBOM and SLSA provenance attestations on WendyOS release archives.
---

# Verifying WendyOS release artifacts

The `wendy` CLI and `wendy-agent` release archives (the `*.tar.gz` / `*.zip`
Go binaries) ship SPDX SBOMs and Sigstore-backed attestations — SLSA build
provenance and an SBOM attestation — generated by the `build.yml` workflow.

> **Scope:** coverage includes the Go CLI/agent archives and the
> `wendy-macos-runtime-guest-arm64` archive containing the Linux kernel and
> initramfs embedded in the macOS app. The WendyAgent `.app` release zip itself
> is not yet attested (tracked as a follow-up).

## SBOM files

Each release includes `*.spdx.json` SBOMs:

- `wendy-cli-<os>-<arch>-<version>.spdx.json` / `wendy-agent-linux-<arch>-<version>.spdx.json`
  — dependencies of each shipped binary (cataloged from the binary itself).
- `wendy-swift-<version>.spdx.json` — Swift package dependencies.
- `wendy-source-<version>.spdx.json` — whole-repo source dependencies.

Inspect one with any SPDX tool, e.g.:

```sh
syft convert wendy-cli-linux-amd64-<version>.spdx.json -o table
```

## Verifying provenance and SBOM attestations

Download a release archive, then verify it was built by this repo's workflow:

```sh
gh attestation verify wendy-cli-linux-amd64-<version>.tar.gz --repo wendylabsinc/WendyOS
```

Or with cosign (attestations are Sigstore bundles):

```sh
gh attestation download wendy-cli-linux-amd64-<version>.tar.gz \
  --repo wendylabsinc/WendyOS -o bundle.jsonl

cosign verify-blob-attestation \
  --new-bundle-format \
  --bundle bundle.jsonl \
  --certificate-identity-regexp 'https://github.com/wendylabsinc/WendyOS/.github/workflows/build.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  wendy-cli-linux-amd64-<version>.tar.gz
```

A successful verification confirms the artifact's SLSA build provenance and
that its SBOM was produced by the WendyOS release pipeline.

## Verifying the macOS runtime guest

The Linux kernel and initramfs embedded in WendyAgentMac are built and attested
as a separate release artifact:

```sh
gh attestation verify wendy-macos-runtime-guest-arm64-<version>.tar.gz \
  --repo wendylabsinc/WendyOS
```

This verifies the guest archive's provenance. It does not attest the enclosing
WendyAgent `.app` release zip.