Packaging and releasing CLIs

Publishing a Go command-line tool: GoReleaser, installers, checksums, signatures and versioning.

Packaging and releasing CLIs · 10 min read

Verify a downloaded binary: checksums, GPG, minisign, cosign

Learn what sha256sum, GPG, minisign and cosign each protect against, how to verify a release by hand, and how an installer should chain the checks.

Packaging and releasing CLIs · 11 min read

Reproducible Go builds: build twice, compare the hashes

Build the same Go commit in two directories, compare the bytes, and learn which flags and settings make the hashes match or differ.

Packaging and releasing CLIs · 11 min read

A GoReleaser v2 config for a small Go CLI, line by line

Write a .goreleaser.yaml for a one-binary Go CLI covering builds, archives, checksums, version ldflags and changelog, and publish to GitHub or GitLab.

Packaging and releasing CLIs · 10 min read

What a curl | sh installer for a Go binary should refuse

Write an install script for a Go release that stops on a bad checksum, odd version, plain http or unknown platform, and test each refusal.