chio release

Verify the signing identity and provenance of a Chio release, its attached evidence, and whether a node is ready to move to it.

On this page

All command families · Global flags

chio release

Verify Chio releases and check a node before it upgrades.

Command synopsistext

chio release [OPTIONS] <COMMAND>

chio release verify Verify a Chio release: the checksum, the signing identity, and the build provenance of the installed binary or of downloaded archives.
chio release check Check whether this node can move to a release before you stop it: store schemas, flag changes, and rollback.

Example

Verify the binary on your PATH and the formal proof report its release carries.

Terminalbash

chio release verify --evidence formal

Output

binary     /usr/local/bin/chio  chio 0.2.0  aarch64-apple-darwin
checksum   matches SHA256SUMS for v0.2.0
signed by  release.yml on backbay-labs/chio, issuer token.actions.githubusercontent.com
provenance SLSA v1, 5 subjects, tag v0.2.0
formal     proof report bound to v0.2.0, every gate passed
verified

chio release verify

Verify a Chio release: the checksum, the signing identity, and the build provenance of the installed binary or of downloaded archives.

Command synopsistext

chio release verify [OPTIONS] [ARCHIVE]...

[ARCHIVE]... Release archives to verify. Without one, the running chio binary.
--tag <TAG> Release to verify the archives against. Defaults to the version the archive or binary names.
--evidence <KIND> Also verify one attached evidence set. Repeat for several. Values formal, threat-coverage, reproducible, qualification, all.
--out <FILE> Write the verification report as JSON to this file.

Additional behavior

The signing identity (the release workflow and its OIDC issuer) and the Sigstore trust root are pinned in the CLI. With --evidence, also verify the signed evidence the release workflow attached: the formal proof report, the threat-coverage report, the reproducible-build attestation, and the qualification gates, each bound to the release’s source commit. Exit 0 when everything verifies, 1 when anything does not.

chio release check

Check whether this node can move to a release before you stop it: store schemas, flag changes, and rollback.

Command synopsistext

chio release check [OPTIONS] <VERSION>

<VERSION> Target release, such as 0.2.0. Required.
--state <DIR> State directory or store the node uses. Repeat for each; defaults to ~/.chio/state.
--unit <UNIT> systemd unit or service command line to check for renamed and removed flags. Repeat for each.

Additional behavior

Reads each state directory’s store identities and schema stamps without opening them for writing, then reports which stores the target release migrates, which flags it renames or removes from the service command lines in use, and whether a binary-only rollback stays possible afterwards. Exit 0 when the node is ready, 1 when something blocks the upgrade.