FEATURE
gh adds a release verify command so you can confirm a release hasn't been tampered with
You've packaged a release for coworkers to download, or you're the one downloading something someone else uploaded, and you want to be sure it wasn't swapped for something else — that's what gh's new release verify and release verify-asset handle. Every release can carry an attestation, a signed, timestamped document that ties the release to its version, its git tag, and its files.
To verify the latest release, run gh release verify; to verify a specific one, add the tag: gh release verify v1.2.3. Got an asset file you want to match against the latest release? Run gh release verify-asset my-asset.zip; to match it against a specific release, add the tag too: gh release verify-asset v1.2.3 my-asset.zip.