# Install and verify

Get gitdr and prove the artifact you downloaded is the one that was built.

Every release ships signed. Don't skip the verify step, this is a backup tool, it runs
with credentials to your org.

## Container (works everywhere, including macOS)

```sh
docker run --rm ghcr.io/gitdr-io/gitdr:latest version
```

Wolfi base, non-root, read-only rootfs, no shell. Multi-arch (amd64, arm64). Pin by
digest in production, not by tag.

Verify the image signature (keyless, Sigstore):

```sh
cosign verify ghcr.io/gitdr-io/gitdr:latest \
  --certificate-identity-regexp 'https://github.com/gitdr-io/gitdr' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
```

## Binary

Static Linux binaries, amd64 and arm64, on the
[releases page](https://github.com/gitdr-io/gitdr/releases). Or via Go:

```sh
go install gitdr.io/gitdr/cmd/gitdr@latest
```

Verify a release download. The signature covers `checksums.txt`, which covers everything
else:

```sh
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem --signature checksums.txt.sig \
  --certificate-identity-regexp 'https://github.com/gitdr-io/gitdr' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt --ignore-missing
```

## Helm chart

```sh
helm install gitdr oci://ghcr.io/gitdr-io/charts/gitdr
```

The chart is an OCI artifact and is cosign-signed the same way as the image.

## What ships with a release

Binaries, container image, Helm chart, SHA-256 checksums, cosign signatures and
certificates, an SBOM per archive, and SLSA build provenance. All built from a tag by CI,
no human in the loop.