Verify a release
Validate Wrightbench installers with checksums, an SPDX SBOM and code signatures.
Each stable GitHub release publishes installers alongside SHA256SUMS and an SPDX JSON software bill of materials.
Verify a SHA-256 digest
Download the installer and SHA256SUMS from the same release. Compute the installer digest and compare it with the matching line in the checksum file.
shasum -a 256 Wrightbench-<version>-mac-arm64.dmgInspect the SBOM
The wrightbench-<version>.spdx.json asset describes the packaged application's production dependency inventory in SPDX JSON format.
Check the code signature
macOS builds are Developer ID signed and notarized, and Windows installers carry a timestamped Authenticode signature. Gatekeeper and SmartScreen check these automatically; to inspect them yourself:
spctl --assess --type open --context context:primary-signature -v Wrightbench-<version>-mac-arm64.dmgThe output must say accepted with source=Notarized Developer ID.