Skip to content

Latest commit

 

History

History
50 lines (34 loc) · 1.42 KB

SECURITY_VERIFICATION.md

File metadata and controls

50 lines (34 loc) · 1.42 KB

Binary Verification

This document provides guidance on verifying the authenticity of Azure Quick Review (azqr) binaries.

Checksum Verification

Each release includes SHA256 checksums. Verify your download:

Using our verification script (recommended)

# Download and run the verification script
curl -sL https://raw.githubusercontent.com/Azure/azqr/main/scripts/verify-checksum.sh -o verify-checksum.sh
chmod +x verify-checksum.sh
./verify-checksum.sh 2.7.3 win-amd64

Manual verification

# Download the checksum file
curl -sL https://github.com/Azure/azqr/releases/download/v.<version>/azqr-win-amd64.zip.sha256 -o azqr-win-amd64.zip.sha256

# Verify the checksum (Windows)
CertUtil -hashfile azqr-win-amd64.zip SHA256

# Verify the checksum (Linux/macOS)
sha256sum -c azqr-win-amd64.zip.sha256

Download Source

Only download from the official GitHub releases page.

Release Integrity

Check that the release is signed by Azure/azqr maintainers on GitHub.

Build Integrity

All binaries are built using GitHub Actions with:

  • Reproducible build environment
  • Pinned dependencies
  • Public build logs
  • Automated testing

You can verify the build process by:

  1. Checking the build workflow
  2. Reviewing the build logs
  3. Comparing source code with the tagged release