# Verifying your download

Source: https://zshot-cli.com/support/verify/
Markdown: https://zshot-cli.com/support/verify/index.md
Section: [Support](https://zshot-cli.com/support/)

Every ZShot release artifact is signed with [sigstore cosign](https://www.sigstore.dev/) so you can independently confirm the file you downloaded is the file we published. Each release also publishes a signed [CycloneDX](https://cyclonedx.org/) SBOM listing the compiled-in components, including the bundled Chromium and FFmpeg versions.

## What you need

- [`cosign`](https://docs.sigstore.dev/cosign/system_config/installation/) version 2.0 or newer (`brew install cosign` on macOS, or follow the cosign install docs on Linux).
- The release artifact (`.zip`, `.deb`, `.tar.gz`, SBOM, or Docker image).
- Our public key, served at [https://zshot-cli.com/cosign.pub](https://zshot-cli.com/cosign.pub) and referenced from each entry in `releases.json`.

You don't need a Sigstore account, an Apple ID, or any auth to verify — just the artifact, the bundle, and the public key.

## What's in the `.sig` file

Modern cosign emits a single [signing bundle](https://docs.sigstore.dev/cosign/signing/signing_with_blobs/) per artifact: a JSON blob containing the signature, the signer's certificate, and the entry in the public Rekor transparency log. The file extension we use is `.sig`, but the file content is a bundle. Verify it by passing it to `cosign verify-blob --bundle`, not `--signature`.

## Commands for the latest release

The commands below verify ZShot 0.49.1. Substitute another version or paste them into a script; the URL pattern is stable.

Each `.sig` file is a [sigstore signing bundle](https://docs.sigstore.dev/cosign/signing/signing_with_blobs/), a single JSON blob holding the signature, certificate, and Rekor transparency-log entry. Verify it with `cosign verify-blob --bundle`.

### macOS (.zip)

```sh
curl -LO https://releases.zshot-app.com/cli/zshot-0.49.1-macos.zip
curl -LO https://releases.zshot-app.com/cli/zshot-0.49.1-macos.zip.sig
cosign verify-blob \
  --key https://zshot-cli.com/cosign.pub \
  --bundle zshot-0.49.1-macos.zip.sig \
  zshot-0.49.1-macos.zip
```

### Linux x86_64 (.deb)

```sh
curl -LO https://releases.zshot-app.com/cli/zshot-0.49.1-linux-amd64.deb
curl -LO https://releases.zshot-app.com/cli/zshot-0.49.1-linux-amd64.deb.sig
cosign verify-blob \
  --key https://zshot-cli.com/cosign.pub \
  --bundle zshot-0.49.1-linux-amd64.deb.sig \
  zshot-0.49.1-linux-amd64.deb
```

### Linux arm64 (.deb)

```sh
curl -LO https://releases.zshot-app.com/cli/zshot-0.49.1-linux-arm64.deb
curl -LO https://releases.zshot-app.com/cli/zshot-0.49.1-linux-arm64.deb.sig
cosign verify-blob \
  --key https://zshot-cli.com/cosign.pub \
  --bundle zshot-0.49.1-linux-arm64.deb.sig \
  zshot-0.49.1-linux-arm64.deb
```

### Linux x86_64 (.tar.gz)

```sh
curl -LO https://releases.zshot-app.com/cli/zshot-0.49.1-linux-amd64.tar.gz
curl -LO https://releases.zshot-app.com/cli/zshot-0.49.1-linux-amd64.tar.gz.sig
cosign verify-blob \
  --key https://zshot-cli.com/cosign.pub \
  --bundle zshot-0.49.1-linux-amd64.tar.gz.sig \
  zshot-0.49.1-linux-amd64.tar.gz
```

### Linux arm64 (.tar.gz)

```sh
curl -LO https://releases.zshot-app.com/cli/zshot-0.49.1-linux-arm64.tar.gz
curl -LO https://releases.zshot-app.com/cli/zshot-0.49.1-linux-arm64.tar.gz.sig
cosign verify-blob \
  --key https://zshot-cli.com/cosign.pub \
  --bundle zshot-0.49.1-linux-arm64.tar.gz.sig \
  zshot-0.49.1-linux-arm64.tar.gz
```

### Docker image

```sh
cosign verify \
  --key https://zshot-cli.com/cosign.pub \
  scaleassembly/zshot:0.49.1
```

### Docker server image

```sh
cosign verify \
  --key https://zshot-cli.com/cosign.pub \
  scaleassembly/zshot-server:0.49.1
```

### SBOM (CycloneDX JSON)

```sh
curl -LO https://releases.zshot-app.com/cli/zshot-0.49.1.sbom.cdx.json
curl -LO https://releases.zshot-app.com/cli/zshot-0.49.1.sbom.cdx.json.sig
cosign verify-blob \
  --key https://zshot-cli.com/cosign.pub \
  --bundle zshot-0.49.1.sbom.cdx.json.sig \
  zshot-0.49.1.sbom.cdx.json
```

## What success looks like

A successful `cosign verify-blob` exits with status 0 and prints `Verified OK`. Any tampering — whether of the binary, bundle, or key — produces a non-zero exit and an explicit error.

For the Docker image, `cosign verify` prints the verified signature payload as JSON when the signature is valid. The signature itself lives in the registry as a sibling tag, so you don't need a separate `--bundle` argument. We sign the image manifest **digest** (not the tag), so `cosign verify` works against `scaleassembly/zshot:VERSION`, `scaleassembly/zshot:latest`, or `scaleassembly/zshot@sha256:DIGEST` — they all resolve to the same signed digest. The exact digest for each release is recorded in [the manifest](/releases.json) under `artifacts.docker.digest`.

## Older releases

The `bundle_url` for each historical release lives in [the release manifest](/releases.json). You can pull any past version's bundle with the same `cosign verify-blob --bundle` form — just swap in the older version number.

## Navigation

- [Examples](https://zshot-cli.com/examples/)
- [Download](https://zshot-cli.com/download/)
- [Purchase](https://zshot-cli.com/purchase/)
- [Reference](https://zshot-cli.com/reference/)
- [Support](https://zshot-cli.com/support/)
  - [Licenses](https://zshot-cli.com/support/licenses/)
  - [EULA](https://zshot-cli.com/support/eula/)
  - [Privacy Policy](https://zshot-cli.com/support/privacy_policy/)
  - [Open Source Licenses](https://zshot-cli.com/support/open_source_licenses/)
  - [FFmpeg Compliance](https://zshot-cli.com/support/ffmpeg_compliance/)
  - **Verifying your download**
  - [Feature Requests](https://zshot-cli.com/support/requests/)
- [Changelog](https://zshot-cli.com/changelog/)

Site index: https://zshot-cli.com/llms.txt