verified-release-skills

Set up a generic curl/PowerShell installer with checksum verification, README verification instructions, release-workflow checksum publishing, artifact attestations, and signed source refs. Use when a user says they want to make a project easy to install, add a curl | sh installer, harden an install.sh/install.ps1 flow, publish SHA256SUMS, verify release assets before extraction, use GitHub Release asset digests, add GitHub artifact attestations, configure Verified commits/tags, configure unattended file-backed SSH signing keys with 1Password backup, configure 1Password-agent signing, back signing keys up to 1Password, or capture a Deno/Helm/Syft-style installer verification pattern. Also use this when the repo has both an installer and downloadable GitHub Release artifacts such as .pkg, .dmg, .zip, .tar.gz, .exe, .msi, .deb, .rpm, .AppImage, .apk, or .aab; this skill covers both the installer path and release artifacts.

Set up verification for GitHub Release artifacts without adding a curl installer. Use when a repo publishes downloadable packages, examples, plugins, apps, archives, installers, or binaries such as .pkg, .dmg, .zip, .tar.gz, .deb, .rpm, .AppImage, .exe, .msi, .apk, .aab, or future iOS/mobile artifacts, and Codex should add SHA256SUMS, GitHub artifact attestations, immutable-release verification, release asset digest checks, signed source refs, and concise README verification instructions. Use this only when there is no install.sh/install.ps1 or installer path to create or harden; if the repo has both an installer and downloadable release artifacts, use setup-verified-installer instead.