Skip to content
Godot Development Tools

Verify a download

Every release publishes, next to the archives:

  • a SHA256SUMS file with the SHA-256 of each archive, and
  • a signed build provenance attestation for each archive, which says it was built from this repository by its release workflow.

The installers check the first for you. The second needs the GitHub CLI, so it is opt-in there (--verify-attestation). Here is how to do both by hand.

Archives are named gdt-v<version>-<target>.tar.gz (.zip on Windows), with <target> one of x86_64-pc-windows-msvc, aarch64-pc-windows-msvc, x86_64-unknown-linux-musl, aarch64-unknown-linux-musl, x86_64-apple-darwin or aarch64-apple-darwin.

Checksum

Section titled “Checksum”

Download the archive and SHA256SUMS from the release page into the same folder, then:

Terminal window
# Linux
sha256sum --check --ignore-missing SHA256SUMS


# macOS
shasum -a 256 --check --ignore-missing SHA256SUMS
Terminal window
# Windows: compare the two values by eye
(Get-FileHash .\gdt-v0.1.0-x86_64-pc-windows-msvc.zip -Algorithm SHA256).Hash
Select-String 'x86_64-pc-windows-msvc' .\SHA256SUMS

You want OK for your archive (or two identical hashes). Anything else: do not run it, and report it.

Build provenance

Section titled “Build provenance”
Terminal window
gh attestation verify gdt-v0.1.0-x86_64-unknown-linux-musl.tar.gz --repo roxguel/godot-dev-tools \
  --signer-workflow roxguel/godot-dev-tools/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0 \
  --deny-self-hosted-runners

This asks GitHub for the attestation of that exact file and checks its signature. The extra flags make the check strict: the attestation must come from this repository’s release workflow (--signer-workflow), for this very tag (--source-ref, so an older release cannot pass for a newer one) and from a GitHub-hosted runner. A pass means the archive is the output of that workflow; it does not replace reading the source. gh needs to be recent and signed in (gh auth login). The installers run the same command with --verify-attestation (-VerifyAttestation on Windows).

A checksum fetched from the same place as the archive proves the download was not corrupted; the attestation is what ties the archive to the build.

The installers themselves

Section titled “The installers themselves”

install.sh and install.ps1 are served from this site. Read them before running them; the page shows their SHA-256 so you can compare it with what you download:

Terminal window
curl -fsSL https://gdt.roxguel.dev/install.sh | sha256sum

Independent community project. Not affiliated with, endorsed by or sponsored by the Godot Foundation or the Godot Engine project. “Godot” is a trademark of the Godot Foundation; this site does not use the Godot logo.