Verifying WendyOS release artifacts

The wendy CLI and wendy-agent release archives (the *.tar.gz / *.zip Go binaries) ship SPDX SBOMs and Sigstore-backed attestations — SLSA build provenance and an SBOM attestation — generated by the build.yml workflow.

Scope: coverage includes the Go CLI/agent archives and the wendy-macos-runtime-guest-arm64 archive containing the Linux kernel and initramfs embedded in the macOS app. The WendyAgent .app release zip itself is not yet attested (tracked as a follow-up).

SBOM files

Each release includes *.spdx.json SBOMs:

• wendy-cli-<os>-<arch>-<version>.spdx.json / wendy-agent-linux-<arch>-<version>.spdx.json — dependencies of each shipped binary (cataloged from the binary itself).
• wendy-swift-<version>.spdx.json — Swift package dependencies.
• wendy-source-<version>.spdx.json — whole-repo source dependencies.

Inspect one with any SPDX tool, e.g.:

syft convert wendy-cli-linux-amd64-<version>.spdx.json -o table

Verifying provenance and SBOM attestations

Download a release archive, then verify it was built by this repo's workflow:

gh attestation verify wendy-cli-linux-amd64-<version>.tar.gz --repo wendylabsinc/WendyOS

Or with cosign (attestations are Sigstore bundles):

gh attestation download wendy-cli-linux-amd64-<version>.tar.gz \
  --repo wendylabsinc/WendyOS -o bundle.jsonl

cosign verify-blob-attestation \
  --new-bundle-format \
  --bundle bundle.jsonl \
  --certificate-identity-regexp 'https://github.com/wendylabsinc/WendyOS/.github/workflows/build.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  wendy-cli-linux-amd64-<version>.tar.gz

A successful verification confirms the artifact's SLSA build provenance and that its SBOM was produced by the WendyOS release pipeline.

Verifying the macOS runtime guest

The Linux kernel and initramfs embedded in WendyAgentMac are built and attested as a separate release artifact:

gh attestation verify wendy-macos-runtime-guest-arm64-<version>.tar.gz \
  --repo wendylabsinc/WendyOS

This verifies the guest archive's provenance. It does not attest the enclosing WendyAgent .app release zip.