Sign and checksum the desktop binaries

[DenisDrobyshev]

Three standalone executables are attached to every release, and people download and run them. Nothing currently lets a downloader tell whether the file they received is the file this workflow produced.

The wheel already has this. pypa/gh-action-pypi-publish emits a PEP 740 attestation on publish — verified on a sibling project:

GET https://pypi.org/integrity/stadion-rl/0.1.0/stadion_rl-0.1.0-py3-none-any.whl/provenance
→ 200, publisher DrobyshevDev/stadion via publish.yml, one bundle, Rekor entry present

So the artefact installed inside a virtualenv is verifiable, and the artefact executed directly on someone's machine is not. That is the wrong way round.

What this adds

SHA256SUMS, one file in the format sha256sum -c reads directly, attached alongside the binaries.

A signed build-provenance attestation over all three executables — which workflow, at which commit, produced those exact bytes. A downloader verifies it without trusting the release page:

gh attestation verify glia-shell-linux --repo DrobyshevDev/glia

Permissions

id-token: write and attestations: write are scoped to the attach job rather than declared at the top of the file, so the three matrix builds keep read-only credentials. The build jobs run PyInstaller over third-party dependencies; they are the last place to widen a token.

Verified

YAML parses; job graph is build, attach; the attach job resolves to contents: write, id-token: write, attestations: write with steps Download all binaries → Checksums → Attest the binaries → Attach to release.

Not verifiable before merge: the attestation itself only exists once a release is published. Worth watching the next glia release and running the verify command above on the artefact.