jmgilman · Aug 20, 2026 · Aug 20, 2026
diff --git a/README.md b/README.md
@@ -13,4 +13,4 @@ This repository defines the reusable workflows and repository contract that Meig
 - [OCI image contract reference](docs/reference/oci-image-contract.md)
 - [Copyable Go release example](examples/go-release/)
 
-Consumer repositories call the reusable workflows at one full commit SHA. The current released pin is `5fb7584b465ab9c0ca4e1057c7b2ca694f950d59` (`v0.1.1`).
+Consumer repositories call the reusable workflows at one full commit SHA. The current released pin is `611195c21fdd44ff2cf95c6a8833f84d095270b0` (`v0.1.2`).
diff --git a/docs/how-to/configure-github-releases.md b/docs/how-to/configure-github-releases.md
@@ -2,7 +2,7 @@
 
 Use this guide to add the shared Meigma Go release workflows to a repository. The [GitHub Release contract](../reference/github-release-contract.md) defines the reusable workflow inputs, permissions, artifacts, and failure behavior.
 
-The documented workflow revision is `5fb7584b465ab9c0ca4e1057c7b2ca694f950d59` (`v0.1.1`).
+The documented workflow revision is `611195c21fdd44ff2cf95c6a8833f84d095270b0` (`v0.1.2`).
 
 ## Prerequisites
 
@@ -94,28 +94,29 @@ Do not overwrite an existing repository's `go.mod` or command source. Adapt its
 
 In the copied files, replace the example values with values from the consumer repository:
 
-- In `.goreleaser.yaml`, replace project name, build ID, archive ID, command path, and binary name `example` with the consumer's values.
+- In `.goreleaser.yaml`, replace project name, build ID, archive ID, nFPM ID, command path, binary name, vendor, homepage, maintainer, description, and license with the consumer's values.
 - Keep the `main.version` and `main.commit` linker variable names only if the command's `main` package defines both variables and uses them for `--version`. Otherwise, change the ldflags to the consumer command's real linker variables.
 - If you copied the sample source, replace module path `example.com/meigma/release-consumer` and the literal command name and output in `cmd/example/main.go`.
 - In `release-please-config.json`, replace package name `example` and choose the intended first release in `initial-version`.
 - In `.release-please-manifest.json`, keep `0.0.0` only for a repository that has never released. For an existing project, set `.` to its latest released version without the `v` prefix.
 - In `.github/workflows/release-please.yml`, replace `main` if the consumer's default branch is different.
-- In `melange.yaml` and `apko.yaml`, replace the package name, command path, description, license, source URL, and image annotations as described in [Configure OCI image publication](configure-oci-images.md).
+- In `melange.yaml` and `apko.yaml`, replace package name, vendor, homepage, maintainer, command path, description, license, source URL, and image annotations as described in [Configure OCI image publication](configure-oci-images.md).
 
 Do not replace these shared contract values:
 
-- reusable workflow revision `5fb7584b465ab9c0ca4e1057c7b2ca694f950d59`;
-- `checksum-signing-workflow-ref` value `meigma/release/.github/workflows/go-pre-publish.yml@5fb7584b465ab9c0ca4e1057c7b2ca694f950d59`;
+- reusable workflow revision `611195c21fdd44ff2cf95c6a8833f84d095270b0`;
+- `checksum-signing-workflow-ref` value `meigma/release/.github/workflows/go-pre-publish.yml@611195c21fdd44ff2cf95c6a8833f84d095270b0`;
 - variable name `MEIGMA_RELEASE_APP_CLIENT_ID`; or
 - secret name `MEIGMA_RELEASE_APP_PRIVATE_KEY`.
 
 To change the immutable revision later, follow [Upgrade GitHub Release workflows](upgrade-github-release-workflows.md). Update all reusable workflow references and the checksum signing identity together; do not edit one reference in isolation.
 
-Keep `checksum-signing-workflow-ref` in `owner/repository/workflow@revision` form without a URL prefix. The publisher adds `https://github.com/` and passes the resulting exact certificate identity to `release-cli verify bundle` with `--identity`. For example, the documented input becomes `--identity https://github.com/meigma/release/.github/workflows/go-pre-publish.yml@5fb7584b465ab9c0ca4e1057c7b2ca694f950d59`.
+Keep `checksum-signing-workflow-ref` in `owner/repository/workflow@revision` form without a URL prefix. The publisher adds `https://github.com/` and passes the resulting exact certificate identity to `release-cli verify bundle` with `--identity`. For example, the documented input becomes `--identity https://github.com/meigma/release/.github/workflows/go-pre-publish.yml@611195c21fdd44ff2cf95c6a8833f84d095270b0`.
 
 The copied GoReleaser configuration builds Darwin, Linux, and Windows archives
-for amd64 and arm64. Confirm that the consumer command supports those targets
-before releasing it. Keep both `changelog.disable: true` and
+for amd64 and arm64. It also packages each canonical Linux binary as DEB, RPM,
+and APK without rebuilding it. Confirm that the consumer command supports those
+targets before releasing it. Keep both `changelog.disable: true` and
 `release.disable: true`: Release Please owns the release notes and initial
 draft, and GoReleaser must not publish a release.
 
@@ -211,7 +212,7 @@ gh release view "$TAG" \
   --json tagName,isDraft,isPrerelease,publishedAt,url
 ```
 
-The final result must report the expected tag, `"isDraft": false`, and `"isPrerelease": false`. The release contains six platform archives, six archive SBOMs, `checksums.txt`, and `checksums.txt.sigstore.json`.
+The final result must report the expected tag, `"isDraft": false`, and `"isPrerelease": false`. The release contains six platform archives, six native Linux packages, twelve SBOMs, `checksums.txt`, and `checksums.txt.sigstore.json`.
 
 To stop before publication and inspect the populated draft, follow [Rehearse and recover GitHub Releases](rehearse-and-recover-github-releases.md).
 
@@ -241,14 +242,14 @@ On Linux, use:
 sha256sum --check checksums.txt
 ```
 
-Every listed archive and SBOM must report `OK`.
+Every listed archive, native package, and SBOM must report `OK`.
 
 Verify that the checksum manifest was signed by the canonical reusable pre-publish workflow revision:
 
 ```bash
 mise exec -- cosign verify-blob \
   --bundle checksums.txt.sigstore.json \
-  --certificate-identity 'https://github.com/meigma/release/.github/workflows/go-pre-publish.yml@5fb7584b465ab9c0ca4e1057c7b2ca694f950d59' \
+  --certificate-identity 'https://github.com/meigma/release/.github/workflows/go-pre-publish.yml@611195c21fdd44ff2cf95c6a8833f84d095270b0' \
   --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
   checksums.txt
 ```
@@ -264,10 +265,39 @@ while IFS= read -r entry; do
   mise exec -- gh attestation verify "$asset" \
     --repo "$REPOSITORY" \
     --signer-workflow meigma/release/.github/workflows/publish-github-release.yml \
-    --signer-digest 5fb7584b465ab9c0ca4e1057c7b2ca694f950d59 \
+    --signer-digest 611195c21fdd44ff2cf95c6a8833f84d095270b0 \
     --source-ref "refs/tags/$TAG" \
     --deny-self-hosted-runners
 done < checksums.txt
 ```
 
-Each invocation must exit successfully. The signer workflow names the reusable publisher rather than the consumer caller, and `--signer-digest` binds it to the canonical revision. GitHub attestations cover the twelve payloads in `checksums.txt`; the checksum manifest and Cosign bundle are control files and are not attestation subjects.
+Each invocation must exit successfully. The signer workflow names the reusable publisher rather than the consumer caller, and `--signer-digest` binds it to the canonical revision. GitHub attestations cover the 24 payloads in `checksums.txt`; the checksum manifest and Cosign bundle are control files and are not attestation subjects.
+
+## 8. Install a native Linux package
+
+Choose the package for the host architecture from the downloaded release
+directory. Package filenames follow
+`<project>_<version>_linux_<architecture>.<format>`.
+
+Install the DEB on Debian or Ubuntu:
+
+```bash
+sudo dpkg -i "<project>_<version>_linux_<architecture>.deb"
+```
+
+Install the RPM on Fedora or another RPM-based distribution:
+
+```bash
+sudo rpm -i "<project>_<version>_linux_<architecture>.rpm"
+```
+
+Install the APK on Alpine:
+
+```bash
+sudo apk add --allow-untrusted "<project>_<version>_linux_<architecture>.apk"
+```
+
+Run the installed command's version or health check after installation. These
+standalone packages are not signed with a native package-manager key and are
+not distributed through a package repository. Verify `checksums.txt`, its
+Cosign signature, and the package's GitHub attestation before installation.
diff --git a/docs/how-to/configure-oci-images.md b/docs/how-to/configure-oci-images.md
@@ -2,7 +2,7 @@
 
 Use this guide to add signed, multi-architecture GHCR images to a repository that already uses the Meigma Go release workflows. The [OCI image contract](../reference/oci-image-contract.md) defines the reusable workflow interfaces, image contents, tags, signatures, attestations, and recovery behavior.
 
-The documented workflow revision is `5fb7584b465ab9c0ca4e1057c7b2ca694f950d59` (`v0.1.1`).
+The documented workflow revision is `611195c21fdd44ff2cf95c6a8833f84d095270b0` (`v0.1.2`).
 
 ## Prerequisites
 
@@ -20,7 +20,7 @@ Record the consumer repository and immutable workflow revision:
 
 ```bash
 export REPOSITORY="$(gh repo view --json nameWithOwner --jq .nameWithOwner)"
-export RELEASE_REVISION=5fb7584b465ab9c0ca4e1057c7b2ca694f950d59
+export RELEASE_REVISION=611195c21fdd44ff2cf95c6a8833f84d095270b0
 export IMAGE="ghcr.io/${REPOSITORY,,}"
 ```
 
@@ -112,7 +112,7 @@ permissions:
 Pin every reusable workflow to the same full revision:
 
 ```text
-5fb7584b465ab9c0ca4e1057c7b2ca694f950d59
+611195c21fdd44ff2cf95c6a8833f84d095270b0
 ```
 
 Make `github-release` depend on `oci-publish`. That ordering keeps the GitHub Release in draft state when registry publication, signing, or attestation fails.

diff --git a/docs/how-to/rehearse-and-recover-github-releases.md b/docs/how-to/rehearse-and-recover-github-releases.md
@@ -2,7 +2,7 @@
 
 Use this guide to populate a draft GitHub Release without publishing it, then resume publication through the same tag and draft. Complete [Configure GitHub Releases](configure-github-releases.md) first. The [GitHub Release contract](../reference/github-release-contract.md) defines the checks that each run enforces.
 
-The documented workflow revision is `5fb7584b465ab9c0ca4e1057c7b2ca694f950d59` (`v0.1.1`).
+The documented workflow revision is `611195c21fdd44ff2cf95c6a8833f84d095270b0` (`v0.1.2`).
 
 `release-cli publish github` owns draft discovery, tag and commit binding, expected-asset upload, asset convergence, and the optional undraft operation. It never creates a release, re-drafts a public release, or deletes an asset.
 
@@ -106,7 +106,7 @@ gh run watch "$RELEASE_RUN_ID" \
   --exit-status
 ```
 
-At the documented current revision, a successful draft-only run leaves the Release workflow green, the release unpublished with six platform archives, six archive SBOMs, `checksums.txt`, and `checksums.txt.sigstore.json`, and GHCR unchanged. With `publish-release: false`, the workflow runs `release-cli publish github --no-undraft`; the CLI converges and verifies the expected asset set, then confirms that the release remains a draft. The run also retains the verified multi-architecture layout, signed APK repository, apko lock, and image SBOMs in the `oci-image` workflow artifact. When rehearsing another revision, use the target contracts in [Upgrade GitHub Release workflows](upgrade-github-release-workflows.md).
+At the documented current revision, a successful draft-only run leaves the Release workflow green, the release unpublished with six platform archives, six native Linux packages, twelve SBOMs, `checksums.txt`, and `checksums.txt.sigstore.json`, and GHCR unchanged. With `publish-release: false`, the workflow runs `release-cli publish github --no-undraft`; the CLI converges and verifies the expected asset set, then confirms that the release remains a draft. The run also retains the verified multi-architecture layout, signed APK repository, apko lock, and image SBOMs in the `oci-image` workflow artifact. When rehearsing another revision, use the target contracts in [Upgrade GitHub Release workflows](upgrade-github-release-workflows.md).
 
 ## 3. Inspect the populated draft
 
@@ -123,7 +123,7 @@ gh api "repos/$REPOSITORY/releases/$RELEASE_ID" \
   --jq '{id, tag_name, draft, prerelease, assets: [.assets[] | {name, state, digest}]}'
 ```
 
-For the documented current revision, the query must select exactly one release with the exact tag, `"draft": true`, `"prerelease": false`, and fourteen assets. Twelve asset names come from `checksums.txt`; the other two are the checksum manifest and its Cosign bundle. For an upgrade rehearsal, require the names and count defined by the target contract instead.
+For the documented current revision, the query must select exactly one release with the exact tag, `"draft": true`, `"prerelease": false`, and 26 assets. Twenty-four asset names come from `checksums.txt`; the other two are the checksum manifest and its Cosign bundle. For an upgrade rehearsal, require the names and count defined by the target contract instead.
 
 If this rehearsal query reports `"draft": false`, stop. A `publish-release: false` run requires the release to remain a draft, so `publish github --no-undraft` classifies an already-public release as indeterminate even when all assets match. Inspect how the release became public; do not rerun the rehearsal or ask the CLI to re-draft it.
 
@@ -320,7 +320,7 @@ If the repository does not need a correction, rerun the complete top-level workf
 For the documented current revision, the publisher requires a nonempty `checksums.txt`, the exact closed payload list, matching payload hashes, a regular Cosign bundle file, issuer `https://token.actions.githubusercontent.com`, and this certificate identity:
 
 ```text
-https://github.com/meigma/release/.github/workflows/go-pre-publish.yml@5fb7584b465ab9c0ca4e1057c7b2ca694f950d59
+https://github.com/meigma/release/.github/workflows/go-pre-publish.yml@611195c21fdd44ff2cf95c6a8833f84d095270b0
 ```
 
 For an upgrade rehearsal, replace the current-revision identity with the target value described in [Upgrade GitHub Release workflows](upgrade-github-release-workflows.md).

diff --git a/docs/how-to/upgrade-github-release-workflows.md b/docs/how-to/upgrade-github-release-workflows.md
@@ -178,7 +178,7 @@ Review the final diff and confirm that it contains no moving reusable workflow r
 
 After the upgrade reaches the default branch, perform the draft-only procedure in [Rehearse and recover GitHub Releases](rehearse-and-recover-github-releases.md). Do not enable either publisher until the target revision has populated and verified a draft and produced the expected OCI artifact.
 
-Use the linked guide for its release creation, exact run selection, draft lookup, resumption, and recovery mechanics. During an upgrade rehearsal, the target contract overrides every baseline constant in that guide. In particular, require the target asset names and count, the checksum certificate identity ending in `@$NEW_RELEASE_REVISION`, and the publisher `--signer-digest "$NEW_RELEASE_REVISION"`. Do not reject a target-compliant draft because it differs from the baseline fourteen-asset set or baseline revision.
+Use the linked guide for its release creation, exact run selection, draft lookup, resumption, and recovery mechanics. During an upgrade rehearsal, the target contract overrides every baseline constant in that guide. In particular, require the target asset names and count, the checksum certificate identity ending in `@$NEW_RELEASE_REVISION`, and the publisher `--signer-digest "$NEW_RELEASE_REVISION"`. Do not reject a target-compliant draft because it differs from the baseline 26-asset set or baseline revision.
 
 The rehearsal must produce these observable results: