Verify a release
Verify a Deplo image before running it.
Every Deplo image published to ghcr.io/deplocloud/deplo is signed. Verification
checks that the exact image came from Deplo's release workflow. It is optional,
but useful before running an image in production.
The signature uses Sigstore and a short-lived certificate, not a long-lived signing key.
Releases built from 31 August 2026 onward carry an attestation. Older tags predate it and will report that none was found.
Verify the image
Install the GitHub CLI
Use the GitHub CLI, version 2.49 or newer. It can run on any machine; it only needs access to the registry.
Run the check
Replace the version with the one you are about to install:
gh attestation verify oci://ghcr.io/deplocloud/deplo:0.1.0 --repo DeploCloud/deploRead the result
A good result names the checked digest and build workflow:
Loaded digest sha256:<digest> for oci://ghcr.io/deplocloud/deplo:0.1.0
Verification succeeded!Any other result is a failure.
The server agent
Nothing to do by hand. install-agent.sh compares the agent binary against its published
SHA-256 before it runs it, and refuses to continue on a mismatch. That check is part of the
installer, on every install and every update.
If verification fails
Do not run the image. A failure means the image is not the one Deplo published, or the tag now points at something else.
- Re-run the command against a specific digest rather than a tag, in case a local mirror or a proxy is serving something stale.
- Pull again from
ghcr.iodirectly. - If it still fails, report it privately through Deplo's security policy. Never in a public issue.
Next steps
Did this page help you?