Security

Every release publishes, under https://downloads.factorhouse.io/fh/<tag>/:

File	What it is
fh_<version>_<os>_<arch>.tar.gz, .zip	The archives
<archive>.sbom.json	SPDX 2.3 software bill of materials for that archive
fh_<version>_vulnerability-report.txt	govulncheck and grype results for every platform build
fh_<version>_grype.json	grype results as JSON, one entry per platform
fh_<version>_govulncheck.json	govulncheck results as JSON, one stream per platform
checksums.txt	SHA-256 of every file above
checksums.txt.sig, checksums.txt.pem	Keyless cosign signature and certificate over checksums.txt

The latest report is always at fh_vulnerability-report.txt.

Verify a download

Use the versioned directory: checksums.txt names the versioned files.

v=0.9.1
base=https://downloads.factorhouse.io/fh/v$v
for f in checksums.txt checksums.txt.sig checksums.txt.pem fh_${v}_darwin_arm64.tar.gz; do
  curl -sSfO "$base/$f"
done

cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github.com/factorhouse/factor-cli/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

shasum -a 256 --ignore-missing -c checksums.txt

Verified OK and <archive>: OK mean the archive is the one the release workflow built and signed.

Scan it yourself

The SBOM lists every Go module linked into the binary, with versions:

curl -sSfO "$base/fh_${v}_darwin_arm64.tar.gz.sbom.json"
grype sbom:fh_${v}_darwin_arm64.tar.gz.sbom.json

How releases are gated

A release fails if govulncheck finds a vulnerability reachable from fh's code, or gosec reports a medium or higher issue. grype results are published, not gating: they include modules that are linked but never called. Dependencies with a fixed version available are bumped before the next release.