community.wiki

# How to upload and use releases

## Create a release

1. Open the repository where you want to publish release files.
2. Click **Releases**.
3. Select the option to upload or create a release.
4. Enter a release title.
5. Enter the release version.
6. Upload release asset files by dragging and dropping them into the upload area, or click the upload area and choose files from your computer.
7. Review the uploaded assets.
8. Save or publish the release.

## Use a release

1. Open the repository.
2. Click **Releases**.
3. Open the release you want to use.
4. Download the release assets you need.
5. Use checksum or signature files, such as `.sha256` or `.sig`, when the project provides them.

## Supported asset formats

Each uploaded file must be **100 MB or smaller**.

Most release archives, installers, packages, binaries, checksums, and signatures are supported.

### Show supported file extensions

`.zip` `.7z` `.rar` `.tar` `.tgz` `.gz` `.bz2` `.xz` `.exe` `.msi` `.msp` `.ipa` `.app` `.apk` `.aab` `.dmg` `.pkg` `.deb` `.rpm` `.jar` `.war` `.ear` `.nupkg` `.gem` `.whl` `.crate` `.vsix` `.bin` `.run` `.wasm` `.sha256` `.sig`

### Signing and checksums

A GPG public key must already be uploaded to NobGit under **Settings**> **Access**> **Git access**> **GPG keys**.

For each release asset, generate a detached signature and a checksum file:

- `<asset filename>.asc`
- `<asset filename>.sha256`

### Windows PowerShell example

```
$key = "211D7FF4C389F8CB80F25CC6FB2B56817DA609D6"
$asset = "release\project-1.0.0-win-x64.msi"

gpg --armor --local-user $key --detach-sign `
  --output "$asset.asc" `
  $asset

(Get-FileHash $asset -Algorithm SHA256).Hash.ToLower() + "  " + $asset | Set-Content "$asset.sha256"

gpg --verify "$asset.asc" $asset
```

### macOS Terminal example

```
key="211D7FF4C389F8CB80F25CC6FB2B56817DA609D6"
asset="release/project-1.0.0-macos-universal.dmg"

gpg --armor --local-user "$key" --detach-sign \
  --output "$asset.asc" \
  "$asset"

shasum -a 256 "$asset" > "$asset.sha256"

gpg --verify "$asset.asc" "$asset"
```

### Linux terminal example

```
key="211D7FF4C389F8CB80F25CC6FB2B56817DA609D6"
asset="release/project-1.0.0-linux-x64.tar.gz"

gpg --armor --local-user "$key" --detach-sign \
  --output "$asset.asc" \
  "$asset"

sha256sum "$asset" > "$asset.sha256"

gpg --verify "$asset.asc" "$asset"
```

Upload each asset with its matching signature and checksum:

```
project-1.0.0-win-x64.exe
project-1.0.0-win-x64.exe.asc
project-1.0.0-win-x64.exe.sha256

project-1.0.0-macos-universal.dmg
project-1.0.0-macos-universal.dmg.asc
project-1.0.0-macos-universal.dmg.sha256

project-1.0.0-linux-x64.tar.gz
project-1.0.0-linux-x64.tar.gz.asc
project-1.0.0-linux-x64.tar.gz.sha256
```

A successful local verification should report a good signature from the key owner.

The `.asc` filename must exactly match the asset filename plus `.asc`. NobGit pairs each asset and signature by filename.

```
Correct:
project-1.0.0-win-x64.msi
project-1.0.0-win-x64.msi.asc

Incorrect:
project.msi.asc
project-1.0.0.asc
```

- [Previous: commit to NobGit](How to commit to NobGit.md)

- [Next: Wiki](How to use Wiki.md)