Closed by default, signed supply chain.

A distroless, non-root, multi-architecture image; SBOM, keyless signature and attestation on the digest; a release re-tags the tested digest, never rebuilds

Verify what you download

The documentation's commands, as written: the checksum's signature with cosign, then each file by its checksum (SHA256SUMS, SHA256SUMS.sigstore.json).

v=$(gh release view -R flexwiz/flexway --json tagName -q .tagName | sed 's/^v//'); arch=amd64   # the latest
gh release download "v$v" -R flexwiz/flexway -p "flexway_${v}_linux_${arch}.tar.gz" -p 'SHA256SUMS*'
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/flexwiz/flexway/.github/workflows/release.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS
tar -xzf "flexway_${v}_linux_${arch}.tar.gz" && sudo install "flexway_${v}_linux_${arch}/flexway" /usr/local/bin/

For a given release, the first line becomes the one in its row of the table below. The installation guide

Every release and its files

Container image: this release's security documentation describes its signature, SBOM and attestation on the digest, without giving a command to verify them; the site does not write one in its place.