發布日期：2025-10-01
你打包版本發布給同事下載，或反過來下載別人放上去的檔案，想確認沒被偷換——這正是 gh 新增的 release verify 與 release verify-asset 要處理的事。每個發行版能附上一份 attestation（證明文件，帶簽章與時間戳，把版本、git 標籤與檔案綁在一起）。
驗證最新的發行版，打 gh release verify；驗證特定版本，加上標籤打 gh release verify v1.2.3。手上某個附件檔案，想對到最新發行版，打 gh release verify-asset my-asset.zip；要對到特定版本，標籤也加進去，打 gh release verify-asset v1.2.3 my-asset.zip。
You've packaged a release for coworkers to download, or you're the one downloading something someone else uploaded, and you want to be sure it wasn't swapped for something else — that's what gh's new release verify and release verify-asset handle. Every release can carry an attestation, a signed, timestamped document that ties the release to its version, its git tag, and its files.
To verify the latest release, run gh release verify; to verify a specific one, add the tag: gh release verify v1.2.3. Got an asset file you want to match against the latest release? Run gh release verify-asset my-asset.zip; to match it against a specific release, add the tag too: gh release verify-asset v1.2.3 my-asset.zip.
Verify the latest release has a valid attestation: `gh release verify`
Verify a specific release by tag: `gh release verify v1.2.3`
Verify an asset from the latest release: `gh release verify-asset my-asset.zip`
Verify a local asset file originated from a specific release: `gh release verify-asset v1.2.3 my-asset.zip`