Verifying WendyOS release artifacts

The wendy CLI and wendy-agent release archives (the *.tar.gz / *.zip Go binaries) ship SPDX SBOMs and Sigstore-backed attestations — SLSA build provenance and an SBOM attestation — generated by the build.yml workflow.

Scope: coverage is currently the Go CLI/agent archives. The macOS WendyAgent .app release zip is not yet attested (tracked as a follow-up).

SBOM files

Each release includes *.spdx.json SBOMs:

• wendy-cli-<os>-<arch>-<version>.spdx.json / wendy-agent-linux-<arch>-<version>.spdx.json — dependencies of each shipped binary (cataloged from the binary itself).
• wendy-swift-<version>.spdx.json — Swift package dependencies.
• wendy-source-<version>.spdx.json — whole-repo source dependencies.

Inspect one with any SPDX tool, e.g.:

syft convert wendy-cli-linux-amd64-<version>.spdx.json -o table

Verifying provenance and SBOM attestations

Download a release archive, then verify it was built by this repo's workflow:

gh attestation verify wendy-cli-linux-amd64-<version>.tar.gz --repo wendylabsinc/WendyOS

Or with cosign (attestations are Sigstore bundles):

gh attestation download wendy-cli-linux-amd64-<version>.tar.gz \
  --repo wendylabsinc/WendyOS -o bundle.jsonl

cosign verify-blob-attestation \
  --new-bundle-format \
  --bundle bundle.jsonl \
  --certificate-identity-regexp 'https://github.com/wendylabsinc/WendyOS/.github/workflows/build.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  wendy-cli-linux-amd64-<version>.tar.gz

A successful verification confirms the artifact's SLSA build provenance and that its SBOM was produced by the WendyOS release pipeline.