Skip to content
gitdr

Install and verify

Every release ships signed. Don’t skip the verify step, this is a backup tool, it runs with credentials to your org.

Container (works everywhere, including macOS)

Section titled “Container (works everywhere, including macOS)”
Terminal window
docker run --rm ghcr.io/gitdr-io/gitdr:latest version

Wolfi base, non-root, read-only rootfs, no shell. Multi-arch (amd64, arm64). Pin by digest in production, not by tag.

Verify the image signature (keyless, Sigstore):

Terminal window
cosign verify ghcr.io/gitdr-io/gitdr:latest \
  --certificate-identity-regexp 'https://github.com/gitdr-io/gitdr' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Binary

Section titled “Binary”

Static Linux binaries, amd64 and arm64, on the releases page. Or via Go:

Terminal window
go install gitdr.io/gitdr/cmd/gitdr@latest

Verify a release download. The signature covers checksums.txt, which covers everything else:

Terminal window
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem --signature checksums.txt.sig \
  --certificate-identity-regexp 'https://github.com/gitdr-io/gitdr' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt --ignore-missing

Helm chart

Section titled “Helm chart”
Terminal window
helm install gitdr oci://ghcr.io/gitdr-io/charts/gitdr

The chart is an OCI artifact and is cosign-signed the same way as the image.

What ships with a release

Section titled “What ships with a release”

Binaries, container image, Helm chart, SHA-256 checksums, cosign signatures and certificates, an SBOM per archive, and SLSA build provenance. All built from a tag by CI, no human in the loop.