Markdown from .wiki

Releases

Repositories/Releases.md

Open wiki source repository

How to upload and use releases

Create a release

Open the repository where you want to publish release files.
Click Releases.
Select the option to upload or create a release.
Enter a release title.
Enter the release version.
Upload release asset files by dragging and dropping them into the upload area, or click the upload area and choose files from your computer.
Review the uploaded assets.
Save or publish the release.

Use a release

Open the repository.
Click Releases.
Open the release you want to use.
Download the release assets you need.
Use checksum or signature files, such as .sha256 or .sig, when the project provides them.

Supported asset formats

Each uploaded file must be 100 MB or smaller.

Most release archives, installers, packages, binaries, checksums, and signatures are supported.

Show supported file extensions

.zip .7z .rar .tar .tgz .gz .bz2 .xz .exe .msi .msp .ipa .app .apk .aab .dmg .pkg .deb .rpm .jar .war .ear .nupkg .gem .whl .crate .vsix .bin .run .wasm .sha256 .sig

Signing and checksums

A GPG public key must already be uploaded to NobGit under Settings> Access> Git access> GPG keys.

For each release asset, generate a detached signature and a checksum file:

<asset filename>.asc
<asset filename>.sha256

Windows PowerShell example

$key = "211D7FF4C389F8CB80F25CC6FB2B56817DA609D6"
$asset = "release\project-1.0.0-win-x64.msi"

gpg --armor --local-user $key --detach-sign `
  --output "$asset.asc" `
  $asset

(Get-FileHash $asset -Algorithm SHA256).Hash.ToLower() + "  " + $asset | Set-Content "$asset.sha256"

gpg --verify "$asset.asc" $asset

macOS Terminal example

key="211D7FF4C389F8CB80F25CC6FB2B56817DA609D6"
asset="release/project-1.0.0-macos-universal.dmg"

gpg --armor --local-user "$key" --detach-sign \
  --output "$asset.asc" \
  "$asset"

shasum -a 256 "$asset" > "$asset.sha256"

gpg --verify "$asset.asc" "$asset"

Linux terminal example

key="211D7FF4C389F8CB80F25CC6FB2B56817DA609D6"
asset="release/project-1.0.0-linux-x64.tar.gz"

gpg --armor --local-user "$key" --detach-sign \
  --output "$asset.asc" \
  "$asset"

sha256sum "$asset" > "$asset.sha256"

gpg --verify "$asset.asc" "$asset"

Upload each asset with its matching signature and checksum:

project-1.0.0-win-x64.exe
project-1.0.0-win-x64.exe.asc
project-1.0.0-win-x64.exe.sha256

project-1.0.0-macos-universal.dmg
project-1.0.0-macos-universal.dmg.asc
project-1.0.0-macos-universal.dmg.sha256

project-1.0.0-linux-x64.tar.gz
project-1.0.0-linux-x64.tar.gz.asc
project-1.0.0-linux-x64.tar.gz.sha256

A successful local verification should report a good signature from the key owner.

The .asc filename must exactly match the asset filename plus .asc. NobGit pairs each asset and signature by filename.

Correct:
project-1.0.0-win-x64.msi
project-1.0.0-win-x64.msi.asc

Incorrect:
project.msi.asc
project-1.0.0.asc

Community