Integrity Verification

Qlty publishes cryptographic attestations for all CLI releases, allowing you to verify that the binary you downloaded was built by Qlty and hasn’t been tampered with. These attestations are powered by Sigstore and published as GitHub artifact attestations.

How it works

When we release a new version of the Qlty CLI, our GitHub Actions workflow:

Builds the CLI binaries for each supported platform
Generates a cryptographic attestation for each build artifact
Publishes the attestations to GitHub’s attestation store

These attestations cryptographically prove that the binary was built from our official repository using our CI/CD pipeline.

Verifying the CLI

You can verify any Qlty CLI release with the GitHub CLI (gh) before you install it. The check doesn’t depend on your machine’s certificate store, so it holds even when that store is out of date.

Use gh 2.67.0 or later, signed in with gh auth login, even for public repositories. Older versions can report success for an archive that has no attestation. Install gh from a source that checks its own packages, such as Homebrew, winget, or a signed package repository.

Example (macOS Apple Silicon):

VERSION=0.660.0
TARGET=aarch64-apple-darwin

# Work in a new empty directory, so a failed step can't leave
# files from an earlier run behind
WORK="$(mktemp -d)"
ARCHIVE="$WORK/qlty-$TARGET.tar.xz"

# Install only if the download, the attestation check and the extraction
# all succeed. This replaces the qlty on your PATH, or installs to
# ~/.qlty/bin if you have none.
if curl -fL "https://github.com/qltysh/qlty/releases/download/v$VERSION/qlty-$TARGET.tar.xz" -o "$ARCHIVE" &&
  gh attestation verify "$ARCHIVE" --owner qltysh &&
  tar -xJf "$ARCHIVE" -C "$WORK"; then
  DEST="$(dirname "$(command -v qlty || echo "$HOME/.qlty/bin/qlty")")"
  mkdir -p "$DEST"
  install -m 755 "$WORK/qlty-$TARGET/qlty" "$DEST/qlty"
else
  echo "Download, attestation check or extraction failed. Not installing." >&2
fi

# Confirm which qlty runs, and its version
command -v qlty && qlty --version

If you installed to ~/.qlty/bin for the first time, add it to your PATH. For other platforms, set TARGET to x86_64-apple-darwin, x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, x86_64-unknown-linux-musl or aarch64-unknown-linux-musl. See all archives on GitHub releases. Example (Windows, PowerShell):

$Version = "0.660.0"
$Zip = "qlty-x86_64-pc-windows-msvc.zip"

# Work in a new empty directory, so a failed step can't leave
# files from an earlier run behind
$Work = New-Item -ItemType Directory -Path (Join-Path $env:TEMP ([guid]::NewGuid()))
$Archive = Join-Path $Work $Zip

Invoke-WebRequest -UseBasicParsing "https://github.com/qltysh/qlty/releases/download/v$Version/$Zip" -OutFile $Archive

# Install only if the attestation verifies and the archive extracts. This
# replaces the qlty.exe on your PATH, or installs to ~\.qlty\bin if you have none.
gh attestation verify $Archive --owner qltysh
if ($LASTEXITCODE -eq 0) {
  Expand-Archive $Archive -DestinationPath (Join-Path $Work "qlty") -ErrorAction Stop
  $Existing = Get-Command qlty -ErrorAction SilentlyContinue
  $Dest = if ($Existing) { Split-Path $Existing.Source } else { Join-Path $HOME ".qlty\bin" }
  New-Item -ItemType Directory -Force -Path $Dest | Out-Null
  Copy-Item (Join-Path $Work "qlty\qlty.exe") (Join-Path $Dest "qlty.exe") -Force -ErrorAction Stop
  if (-not $Existing) { $env:Path = "$Dest;$env:Path" }
} else {
  Write-Error "Attestation verification failed. Not installing."
}

qlty --version

If you installed to ~\.qlty\bin for the first time, the script adds it to PATH for the current session only. Add it to your user PATH to keep it.

Checking an installed binary

To check a qlty you already have, download and verify the archive for the version you installed, then compare the binaries. Set VERSION yourself rather than running qlty --version: if the binary was replaced, running it could expose your tokens.

VERSION=0.660.0
TARGET=aarch64-apple-darwin
WORK="$(mktemp -d)"
ARCHIVE="$WORK/qlty-$TARGET.tar.xz"

if curl -fL "https://github.com/qltysh/qlty/releases/download/v$VERSION/qlty-$TARGET.tar.xz" -o "$ARCHIVE" &&
  gh attestation verify "$ARCHIVE" --owner qltysh &&
  tar -xJf "$ARCHIVE" -C "$WORK"; then
  shasum -a 256 "$WORK/qlty-$TARGET/qlty" "$(command -v qlty)"
else
  echo "Download, attestation check or extraction failed. Nothing to compare." >&2
fi

If the two checksums differ, reinstall with the steps above, and rotate any Qlty tokens that machine could read. A VERSION that doesn’t match the installed release also makes them differ, so check it first.

Verifying upgrades

qlty upgrade --verify-attestations downloads each release’s archive and checks its attestation before installing it, on macOS and Linux. It needs gh 2.67.0 or later, signed in. From v0.662.0, the upgrade stops if the attestation can’t be verified, and on Windows the command refuses and points to this page. Without the flag, qlty upgrade runs the installer script, which does not check attestations. See upgrade.

Verifying the Docker image

Each platform image in ghcr.io/qltysh/qlty has its own attestation. The multi-platform tag does not, so verify a platform digest:

docker buildx imagetools inspect ghcr.io/qltysh/qlty:0.660.0
gh attestation verify oci://ghcr.io/qltysh/qlty@sha256:<platform digest> --owner qltysh

Successful verification

A successful verification will display output similar to:

Loaded digest sha256:abc123... for file qlty-aarch64-apple-darwin.tar.xz
Loaded 1 attestation from GitHub API
✓ Verification succeeded!

This confirms the binary was signed by GitHub Actions and built from the official Qlty repository.

Getting Started

Everyday Commands

Key Concepts

Workflow Integration

Additional Information

Reference

All Commands

Integrity Verification

How it works

Verifying the CLI

Checking an installed binary

Verifying upgrades

Verifying the Docker image

Successful verification

Learn more

​How it works

​Verifying the CLI

​Checking an installed binary

​Verifying upgrades

​Verifying the Docker image

​Successful verification

​Learn more

How it works

Verifying the CLI

Checking an installed binary

Verifying upgrades

Verifying the Docker image

Successful verification

Learn more