> ## Documentation Index
> Fetch the complete documentation index at: https://warden.buildlab.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Releases and verification

> What a release contains, how it is built, and how to check that what you downloaded is what was published.

Releases live in the **public distribution repository**,
[`Abhishek-Mallick/warden-dist`](https://github.com/Abhishek-Mallick/warden-dist/releases),
tagged `vX.Y.Z`. That repository carries release archives and checksums and no source:
Warden's source repository is private, and a private repository's assets cannot be
downloaded anonymously. See [Homebrew](https://warden.buildlab.in/install/homebrew.md#where-the-binaries-come-from).

## What a release contains

| Asset | Contents |
| - | - |
| `warden_<version>_darwin_arm64.tar.gz` | macOS, Apple silicon |
| `warden_<version>_darwin_amd64.tar.gz` | macOS, Intel |
| `warden_<version>_linux_amd64.tar.gz` | Linux, x86-64 |
| `warden_<version>_linux_arm64.tar.gz` | Linux, arm64 |
| `checksums.txt` | SHA-256 of every archive |

Each archive holds `warden`, `warden-mcp`, the README, `LICENSE.md` (the terms the binaries are offered under), and `THIRD-PARTY-NOTICES.md` (the open-source notices their linked libraries require). The container image for the same version is `ghcr.io/abhishek-mallick/warden:<version>`.

## Verify a download

```bash theme={null}
VERSION=0.1.0
PLATFORM=darwin_arm64

curl -LO https://github.com/Abhishek-Mallick/warden-dist/releases/download/v${VERSION}/warden_${VERSION}_${PLATFORM}.tar.gz
curl -LO https://github.com/Abhishek-Mallick/warden-dist/releases/download/v${VERSION}/checksums.txt

# macOS
shasum -a 256 -c checksums.txt --ignore-missing
# Linux
sha256sum -c checksums.txt --ignore-missing

tar -xzf warden_${VERSION}_${PLATFORM}.tar.gz
sudo install warden_${VERSION}_${PLATFORM}/warden /usr/local/bin/warden
sudo install warden_${VERSION}_${PLATFORM}/warden-mcp /usr/local/bin/warden-mcp
warden version
```

Homebrew does this for you: the formula carries the checksum for your platform and refuses an archive that does not match.

## How releases are built

A pushed tag runs the release workflow:

1. **Four native runners** build macOS and Linux binaries for both CPU architectures. Native rather than cross-compiled because Warden links PostgreSQL's C parser, and a cgo build needs a toolchain for its target.
2. Each runner **runs the binary it just built** (`warden version`) before uploading it, so an archive that cannot execute never reaches a release.
3. Checksums are computed over the published archives, and the release is created with them in the public distribution repository. The private repository gets a matching tag and release notes with no assets, so the history of what shipped stays with the code that produced it.
4. **Container images** are built natively per architecture and merged into one multi-architecture tag. On the first release the package must be made public by hand, once — GitHub has no API for package visibility.
5. **The Homebrew formula** is rendered from the release's own checksums and pushed to the tap. If the tap token is missing, the release stands and the formula step is skipped with a message.

Everything is reproducible from the repository: `scripts/brew-formula.sh` renders the formula, and `.github/workflows/release.yml` is the whole pipeline.

## Versioning

Pre-1.0, and the surface that may change is called out in [the offerings overview](https://warden.buildlab.in/offerings/overview.md#versioning-and-support):

* **Stable:** the HTTP API shapes, the policy file, the configuration file, and the certification contract.
* **Unstable:** every `internal/` package, and details of the operator view.

> [!NOTE]
>
> **Not signed or notarised yet.** Binaries carry no code signature, so macOS Gatekeeper may complain about one downloaded through a browser. Homebrew installs are unaffected. Signing and provenance attestation are on the roadmap.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.