Releases: charmbracelet/mods
v1.8.1
Changelog
Bug fixes
- bb7f141: fix: disable topp, topk, temp, if values < 0 (#550) (@caarlos0)
- 9b36cf8: fix: improve mcp timeout handling (#551) (@caarlos0)
- 7315d4f: fix: mkdir parent db directory (#553) (@caarlos0)
- 5fb2a82: fix: skip db init for
--version
and--help
cmds (#543) (@chenrui333)
Verifying the artifacts
First, download the checksums.txt
file, for example, with wget
:
wget 'https://github.com/charmbracelet/mods/releases/download/v1.8.1/checksums.txt'
Then, verify it using cosign
:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--cert 'https://github.com/charmbracelet/mods/releases/download/v1.8.1/checksums.txt.pem' \
--signature 'https://github.com/charmbracelet/mods/releases/download/v1.8.1/checksums.txt.sig' \
./checksums.txt
If the output is Verified OK
, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum
:
sha256sum --ignore-missing -c checksums.txt
Done! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.
v1.8.0
This release introduces an exciting new feature, and many other improvements.
MCP
The biggest change in this release is the addition of MCP support.
You can enable it by running mods --settings
, and adding something like this
to your configuration:
mcp-servers:
github:
command: docker
args:
- run
- "-i"
- "--rm"
- "-e"
- GITHUB_PERSONAL_ACCESS_TOKEN
- "ghcr.io/github/github-mcp-server"
It also adds more flags you can use to list the available tools, or disable
them:
--mcp-list
: List all configured MCP servers--mcp-list-tools
: List all tools by all MCP servers--mcp-disable
: Disable specific MCP servers. Tip: you can use*
to disable
all of them.
Other updates
In this release, we also refactored most of the code used to talk with LLMs.
We also added a lot of providers to the configuration template.
Speaking of providers, you can now use the --api
flag and the api
key in the
YAML settings to better filter which one you want to use, which is especially
useful if multiple APIs have the same models.
Changelog
New Features
- 2d68731: feat(config): add gemini-2-flash models and update aliases (#436) (@nathabonfim59)
- 9ad048a: feat(config): add o3-mini model and update model aliases (#433) (@nathabonfim59)
- 09df631: feat: add GitHub Models API to config template (#502) (@cedws)
- 6d9a0f4: feat: add claude-sonnet-3.7 to config template (#446) (@gwpl)
- 0e7d29c: feat: add gpt-4.5-preview to config template (#461) (@gwpl)
- 8c79d1d: feat: add groq's llama 4 config (@caarlos0)
- 364c419: feat: add o3-mine and o1 to config template (#444) (@gwpl)
- f1ec31a: feat: add sonnet-4 to config template (#503) (@caarlos0)
- d7a2c43: feat: allow to open prompt in the editor (#419) (@caarlos0)
- e92f508: feat: better handle api (#504) (@caarlos0)
- c48ad6b: feat: mcp support, openai update, refactor (#486) (@caarlos0)
Bug fixes
- e0ef5a8: fix(groq): Update Models (#455) (@jay-tau)
- ed83463: fix(sambanova): update models (#456) (@jay-tau)
- f0daa27: fix: Perplexity API Role Compatibility (Issue #448) (#454) (@minkiha)
- f849bf6: fix:
--model
not working (#523) (@jzyinq) - 6fe1fb9: fix: error message (@caarlos0)
- 0958dd2: fix: go version (@caarlos0)
- 03eb8aa: fix: lint (@caarlos0)
- 1c4b27b: fix: lint issues (@caarlos0)
- 894e61a: fix: missing required parameters for openai mcp tool call (#513) (@jzyinq)
- e191d29: fix: remove /api from ollama from config template (#517) (@lstep)
- 9a66018: fix: remove duplicate model key
o3-mini
from config template (#447) (@minkiha) - f65e6a8: fix: remove final dot to fix link to grab api key (#498) (@andreynering)
- 5361569: fix: show model picker if -m doesn't yield a valid model (#542) (@caarlos0)
- 39966c3: fix: update deepseek in config template (#425) (@caarlos0)
- 32b0a4b: fix: use sync.OnceValue (@caarlos0)
Dependency updates
Documentation updates
- 7966027: docs: add contributing guidelines (#526) (@bashbunni)
- 5af2154: docs: add googe api key instructions (#481) (@SlowCloud)
- c10c5e9: docs: update (@caarlos0)
Other work
- a36ca67: Feature/gemini thinking params (#533) (@micke754)
- 30057f9: ci: fix lint jobs (@caarlos0)
- 24c667d: ci: fix lint settings (@caarlos0)
- cb28deb: ci: sync dependabot config (#439) (@charmcli)
- e071253: ci: sync dependabot config (#440) (@charmcli)
- eedeaab: ci: sync dependabot config (#490) (@charmcli)
- 33e112e: ci: sync golangci-lint config (#489) (@github-actions[bot])
- 0cabbaf: ci: sync golangci-lint config (#518) (@github-actions[bot])
- b47f5c6: feat(config_template.yml): add groq's llama4 to config (#473) (@olivertzeng)
- e7fef9d: refactor: use anthropic sdk (#487) (@caarlos0)
Verifying the artifacts
First, download the checksums.txt
file, for example, with wget
:
wget 'https://github.com/charmbracelet/mods/releases/download/v1.8.0/checksums.txt'
Then, verify it using cosign
:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--cert 'https://github.com/charmbracelet/mods/releases/download/v1.8.0/checksums.txt.pem' \
--signature 'https://github.com/charmbracelet/mods/releases/download/v1.8.0/checksums.txt.sig' \
./checksums.txt
If the output is Verified OK
, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum
:
sha256sum --ignore-missing -c checksums.txt
Done! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.
v1.7.0
o1 and better Copilot support
This release brings improved support for GitHub Copilot, adds support for o1 models, SambaNova Cloud, and adds a couple of quality-of-life improvements.
You can use mods --settings
to set up Copilot, o1, and SambaNova. You can generally copy the relevant parts from here.
Happy modding!
Changelog
New Features
- f33015d: feat(copilot): improved support for AccessToken and Enterprise API (#406) (@nathabonfim59)
- 34d8469: feat: Add support for user request parameter (#362) (@fabio42)
- cb0323e: feat: add SambaNova Cloud (#356) (@jay-tau)
- b7e6af6: feat: add
-R
shorthand to--role
(#405) (@gy-mate) - 9b63a4a: feat: add api-key-cmd to run external command to get API_KEY (#398) (@sedlund)
- e5e4bdd: feat: add support for o1 models in openai and azure (#368) (@sheldonhull)
- 1fd9561: feat: copilot support (#345) (@caarlos0)
- 5e3e9f3: feat: make --delete repeatable (@caarlos0)
Bug fixes
- 85a717d: fix: add latest claude and ollama models to config template (@gwpl)
- b52d41e: fix: bad help (@caarlos0)
- 6349292: fix: do not send empty format message (@caarlos0)
- 83c3cf3: fix: duplicated output when --raw (@caarlos0)
- d528dd5: fix: respect --raw in --list (@caarlos0)
- c4461d4: fix: short flag not found error (@caarlos0)
- 9386f44: fix: update perplexity in config_template.yml (#411) (@rocapp)
Documentation updates
- 2178cd7: docs:
-s
is not for--settings
(#355) (@mamachanko)
Other work
- 286558b: ci: update (@caarlos0)
- 1eafd32: refactor(cache): improve caching system and add expiring cache (#408) (@nathabonfim59)
- 6c77df5: refactor: rename cacheDir do dir (@caarlos0)
Verifying the artifacts
First, download the checksums.txt
file, for example, with wget
:
wget 'https://github.com/charmbracelet/mods/releases/download/v1.7.0/checksums.txt'
Then, verify it using cosign
:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--cert 'https://github.com/charmbracelet/mods/releases/download/v1.7.0/checksums.txt.pem' \
--signature 'https://github.com/charmbracelet/mods/releases/download/v1.7.0/checksums.txt.sig' \
./checksums.txt
If the output is Verified OK
, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum
:
sha256sum --ignore-missing -c checksums.txt
Done! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.
v1.6.0
More models!
New models joined the crew: Groq's Llama3.1, Cerebras Llama3.1, DeepSeek's lineup, and Google Gemini.
Check out the configuration template and update your settings (mods --settings
) if you need to use them!
Changelog
New Features
- 3dc0a94: feat: add DeepSeek models to config template (#312) (@ArthurHeymans)
- c6e7308: feat: add cerebras llama3.1 (#339) (@jay-tau)
- e144464: feat: add groq's Llama3.1 and updated Llama3 models (#338) (@jay-tau)
- e9af3b6: feat: support for Google Gemini (#314) (@cloudbridgeuy)
- 6c20fa7: feat: use go 1.21 (@caarlos0)
Bug fixes
- 89c240e: fix: Correct baseURL configuration for Anthropic API (#309) (@nanbingxyz)
- 79ee7d5: fix: broken after glamour/glow update (@caarlos0)
- 17538ff: fix: error handling (@caarlos0)
- c3d358f: fix: error handling (@caarlos0)
- 8d4f845: fix: lint issue (@caarlos0)
- f834b65: fix: lint issues (#327) (@caarlos0)
- 5fe5c3a: fix: ollama config (#318) (@cerisara)
- 96a7150: fix: output correct model if ContinueLast (#320) (@sedlund)
- 40a0456: fix: raw output being rendered twice (#346) (@caarlos0)
Documentation updates
Verifying the artifacts
First, download the checksums.txt
file, for example, with wget
:
wget 'https://github.com/charmbracelet/mods/releases/download/v1.6.0/checksums.txt'
Then, verify it using cosign
:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--cert 'https://github.com/charmbracelet/mods/releases/download/v1.6.0/checksums.txt.pem' \
--signature 'https://github.com/charmbracelet/mods/releases/download/v1.6.0/checksums.txt.sig' \
./checksums.txt
If the output is Verified OK
, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum
:
sha256sum --ignore-missing -c checksums.txt
Done! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.
v1.5.0
UX improvements and more models
This release improve UX around --continue
and interactive mode as well as adds more models. Read on for details.
Interactive mode: now more interactive
This release improves interactive mode, making it even easier to explore full gamut of available models in realtime. To run Mods in interactive mode use the -M
/--ask-model
flag.
Moar models
This release adds more models to the standard configuration as well as first class support for Cohere.
Shall we continue?
The --continue
flag can be used to pick up the last conversation. This release improves things so that it will automatically use the same model.
Changelog
New Features
- 249ff08: feat(groq): Add Gemma2 (#304) (@jay-tau)
- 0bf7d1c: feat: add Mistral provider to config template (#305) (@philippgille)
- cddda66: feat: add claude-3.5-sonnet to configuration templates (#297) (@gwpl)
- 14fd43c: feat: add gpt-4o-mini to default configuration (@caarlos0)
- fe8a551: feat: add support for Cohere (#294) (@maxbrunet)
- ef92366: feat: allow to customize huh theme (#278) (@caarlos0)
- 04f45ae: feat: better -M forms (#261) (@caarlos0)
- 14e1f48: feat: continue using the same model (#292) (@caarlos0)
- 6b6b82a: feat: make GPT-4o the default model (#307) (@philippgille)
Bug fixes
- 6ea3ee2: fix: add api-key and api-key-env fields to config template (#303) (@philippgille)
- ff9a598: fix: use default max input settings (@caarlos0)
Documentation updates
- 73266f8: docs: fix install instructions (#293) (@emmceemoore)
- 23957ce: docs: v1.5 tape file (@caarlos0)
Bonus
Verifying the artifacts
First, download the checksums.txt
file, for example, with wget
:
wget 'https://github.com/charmbracelet/mods/releases/download/v1.5.0/checksums.txt'
Then, verify it using cosign
:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--cert 'https://github.com/charmbracelet/mods/releases/download/v1.5.0/checksums.txt.pem' \
--signature 'https://github.com/charmbracelet/mods/releases/download/v1.5.0/checksums.txt.sig' \
./checksums.txt
If the output is Verified OK
, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum
:
sha256sum --ignore-missing -c checksums.txt
Done! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.
v1.4.1
Changelog
Bug fixes
- 8520cea: fix: add man page (#291) (@caarlos0)
- 2efc3d9: fix: do not show examples in subcommands (#289) (@caarlos0)
- 5722fe6: fix: improve completion cmd handling (#290) (@caarlos0)
Documentation updates
- 6abdbfb: docs(readme): fix typo (@meowgorithm)
- 956198c: docs: fix winget command with full package ID (#284) (@darkvertex)
- bf1dab7: docs: how to get completions (#288) (@caarlos0)
Other work
- 510bf64: README Edits (#285) (@maaslalani)
- 7af4a43: build: update gitignore (@caarlos0)
- a004009: build: update goreleaser config (@caarlos0)
Verifying the artifacts
First, download the checksums.txt
file, for example, with wget
:
wget 'https://github.com/charmbracelet/mods/releases/download/v1.4.1/checksums.txt'
Then, verify it using cosign
:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--cert 'https://github.com/charmbracelet/mods/releases/download/v1.4.1/checksums.txt.pem' \
--signature 'https://github.com/charmbracelet/mods/releases/download/v1.4.1/checksums.txt.sig' \
./checksums.txt
If the output is Verified OK
, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum
:
sha256sum --ignore-missing -c checksums.txt
Done! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.
v1.4.0
Anthropic, Ollama, and GPT-4o
mods v1.4 adds support for Anthropic and Ollama, adds ChatGPT's gpt-4o
model to the generated configuration file, and many other improvements! 💫
Installing ’n’ Upgrading
To grab the latest Mods grab a package or binary attached to this release below, or use a package manager:
# macOS or Linux
brew install charmbracelet/tap/mods
# Windows (with Winget)
winget install mods
# Windows (with Scoop)
scoop bucket add charm https://github.com/charmbracelet/scoop-bucket.git
scoop install mods
# Arch Linux (btw)
yay -S mods
Debian/Ubuntu
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://repo.charm.sh/apt/gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/charm.gpg
echo "deb [signed-by=/etc/apt/keyrings/charm.gpg] https://repo.charm.sh/apt/ * *" | sudo tee /etc/apt/sources.list.d/charm.list
sudo apt update && sudo apt install mods
Fedora/RHEL
echo '[charm]
name=Charm
baseurl=https://repo.charm.sh/yum/
enabled=1
gpgcheck=1
gpgkey=https://repo.charm.sh/yum/gpg.key' | sudo tee /etc/yum.repos.d/charm.repo
sudo yum install mods
You can also just install it with go
:
go install github.com/charmbracelet/mods@latest
Changelog
New Features
- 59edaf7: feat: --list-roles (#281) (@caarlos0)
- bf71c2a: feat: --role shell completions (#282) (@caarlos0)
- 76688b2: feat: add support for OpenAI gpt-40 (#262) (@bradyjoslin)
- 0c63172: feat: allow --dirs config|cache (#280) (@caarlos0)
- c256fe5: feat: anthropic and ollama support (#256) (@caarlos0)
- 584d275: feat: update groq models (#258) (@jay-tau)
- 1de46d4: feat: update perplexity models (#260) (@bradyjoslin)
Bug fixes
- 39c30fc: fix(readme): fix inconsistent markdown headings (#268) (@in03)
- c6edf9b: fix: --delete-older-than is weird with interactive list (#277) (@caarlos0)
- a13684e: fix: --dirs help (@caarlos0)
- 6f730ff: fix: do not make api call when --list, --delete, etc (#279) (@caarlos0)
- 6582595: fix: filter out System role messages for Anthropic API requests (#273) (@cloudbridgeuy)
- e64d1d2: fix: gpt-4o max tokens (@caarlos0)
- c74e892: fix: lint issues (@caarlos0)
- 6657059: fix: update modernc (@caarlos0)
Dependency updates
- 9ac0968: feat(deps): update bubbletea, bubbles, lipgloss (#271) (@caarlos0)
- f67535f: feat(deps): update openai (#272) (@caarlos0)
Documentation updates
Other work
Verifying the artifacts
First, download the checksums.txt
file, for example, with wget
:
wget 'https://github.com/charmbracelet/mods/releases/download/v1.4.0/checksums.txt'
Then, verify it using cosign
:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--cert 'https://github.com/charmbracelet/mods/releases/download/v1.4.0/checksums.txt.pem' \
--signature 'https://github.com/charmbracelet/mods/releases/download/v1.4.0/checksums.txt.sig' \
./checksums.txt
If the output is Verified OK
, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum
:
sha256sum --ignore-missing -c checksums.txt
Done! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.
v1.3.1
Changelog
Bug fixes
Verifying the artifacts
First, download the checksums.txt
file, for example, with wget
:
wget 'https://github.com/charmbracelet/mods/releases/download/v1.3.1/checksums.txt'
Then, verify it using cosign
:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--cert 'https://github.com/charmbracelet/mods/releases/download/v1.3.1/checksums.txt.pem' \
--signature 'https://github.com/charmbracelet/mods/releases/download/v1.3.1/checksums.txt.sig' \
./checksums.txt
If the output is Verified OK
, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum
:
sha256sum --ignore-missing -c checksums.txt
Done! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.
v1.3.0
Perplexity, RunPod, roles and more
Mods v1.3 introduces support for Perplexity and RunPod, improves the conversation list, allows to use remote roles, and has some performance improvements! We hope you enjoy it! 💫
Changelog
New Features
- d535b3f: feat(ui): provide suggested use for convo ID (#246) (@bashbunni)
- 51c32c5: feat: Add Perplexity API (#241) (@bradyjoslin)
- eef3c9d: feat: add hidden --memprofile (#249) (@caarlos0)
- 258577c: feat: allow to use role from URL/filepath (#245) (@caarlos0)
- 917260a: feat: render list inside a viewport (#228) (@caarlos0)
- 1335701: feat: support for RunPod (#242) (@rachfop)
Bug fixes
- 2d59b32: fix: actually hide hidden flags (@caarlos0)
- 3c0c9df: fix: do not create anim internals when --quiet (#250) (@caarlos0)
- ef910e7: fix: handle non-existent role (#244) (@caarlos0)
- 90fd02f: fix: high ram usage while loading (#252) (@caarlos0)
Documentation updates
Getting Mods
To grab the latest Mods grab a package or binary attached to this release below, or just use a package manager:
# macOS or Linux
brew install charmbracelet/tap/mods
# Windows (with Winget)
winget install mods
# Windows (with Scoop)
scoop bucket add charm https://github.com/charmbracelet/scoop-bucket.git
scoop install mods
# Arch Linux (btw)
yay -S mods
Debian/Ubuntu
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://repo.charm.sh/apt/gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/charm.gpg
echo "deb [signed-by=/etc/apt/keyrings/charm.gpg] https://repo.charm.sh/apt/ * *" | sudo tee /etc/apt/sources.list.d/charm.list
sudo apt update && sudo apt install mods
Fedora/RHEL
echo '[charm]
name=Charm
baseurl=https://repo.charm.sh/yum/
enabled=1
gpgcheck=1
gpgkey=https://repo.charm.sh/yum/gpg.key' | sudo tee /etc/yum.repos.d/charm.repo
sudo yum install mods
You can also just install it with go
:
go install github.com/charmbracelet/mods@latest
Verifying the artifacts
First, download the checksums.txt
file, for example, with wget
:
wget 'https://github.com/charmbracelet/mods/releases/download/v1.3.0/checksums.txt'
Then, verify it using cosign
:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--cert 'https://github.com/charmbracelet/mods/releases/download/v1.3.0/checksums.txt.pem' \
--signature 'https://github.com/charmbracelet/mods/releases/download/v1.3.0/checksums.txt.sig' \
./checksums.txt
If the output is Verified OK
, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum
:
sha256sum --ignore-missing -c checksums.txt
Done! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.
v1.2.2
Changelog
New Features
- 9ed50d9: feat: add groq to config template (#223) (@caarlos0)
- 34b834b: feat: allow to set stop (#226) (@caarlos0)
- e48f558: feat: system roles (#227) (@caarlos0)
Bug fixes
- fc5d998: fix(docs): typos (@bashbunni)
- 6258e8c: fix: --ask-model print api name too (#214) (@caarlos0)
- 11dbf2d: fix: allow to run --settings with an invalid yaml configuration (#225) (@caarlos0)
- e466173: fix: error when running format-as is empty` (#219) (@cloudbridgeuy)
- ffa5231: fix: include api name in errors (#231) (@bashbunni)
- f979f9e: fix: only set completion response format when api is openai (#213) (@caarlos0)
- ae7c540: fix: possible index out of range (@caarlos0)
- 297b0ef: fix: update log dep (@caarlos0)
- 977f568: fix: wrap stdin in codeblock (#215) (@caarlos0)
Documentation updates
Other work
- 11a9be0: Create CODEOWNERS (@maaslalani)
Verifying the artifacts
First, download the checksums.txt
file, for example, with wget
:
wget 'https://github.com/charmbracelet/mods/releases/download/v1.2.2/checksums.txt'
Then, verify it using cosign
:
cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--cert 'https://github.com/charmbracelet/mods/releases/download/v1.2.2/checksums.txt.pem' \
--signature 'https://github.com/charmbracelet/mods/releases/download/v1.2.2/checksums.txt.sig' \
./checksums.txt
If the output is Verified OK
, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum
:
sha256sum --ignore-missing -c checksums.txt
Done! You artifacts are now verified!
Thoughts? Questions? We love hearing from you. Feel free to reach out on Twitter, The Fediverse, or on Discord.