Skip to main content

Install

github-comment is written in Go. So you only have to install a binary in your PATH.

There are some ways to install github-comment.

  1. Homebrew
  2. Scoop
  3. aqua
  4. mise
  5. GitHub Releases
  6. Build an executable binary from source code yourself using Go

Homebrew​

You can install github-comment using Homebrew.

brew install suzuki-shunsuke/github-comment/github-comment

Scoop​

You can install github-comment using Scoop.

scoop bucket add suzuki-shunsuke https://github.com/suzuki-shunsuke/scoop-bucket
scoop install github-comment

aqua​

You can install github-comment using aqua.

aqua g -i suzuki-shunsuke/github-comment

mise​

You can install github-comment v6.4.2 or later using mise with the packslip backend.

mise use packslip:github.com/suzuki-shunsuke/github-comment

Build an executable binary from source code yourself using Go​

go install github.com/suzuki-shunsuke/github-comment/v6/cmd/github-comment@latest

GitHub Releases​

You can download an asset from GitHub Releases. Please unarchive it and install a pre built binary into $PATH.

Verify downloaded assets from GitHub Releases​

You can verify downloaded assets using some tools.

  1. GitHub CLI
  2. Cosign
  3. Packslip github-comment >= v6.4.2
  4. slsa-verifier github-comment <= v6.4.1

1. GitHub CLI​

You can install GitHub CLI by aqua.

aqua g -i cli/cli
version=v6.4.2
asset=github-comment_${version#v}_darwin_arm64.tar.gz
gh release download -R suzuki-shunsuke/github-comment "$version" -p "$asset"
gh attestation verify "$asset" \
  -R suzuki-shunsuke/github-comment \
  --signer-workflow suzuki-shunsuke/go-release-workflow/.github/workflows/release.yaml

2. Cosign​

You can install Cosign by aqua.

aqua g -i sigstore/cosign
version=v6.4.2
checksum_file="github-comment_${version#v}_checksums.txt"
asset=github-comment_${version#v}_darwin_arm64.tar.gz
gh release download "$version" \
  -R suzuki-shunsuke/github-comment \
  -p "$asset" \
  -p "$checksum_file" \
  -p "${checksum_file}.sigstore.json"
cosign verify-blob \
  --bundle "${checksum_file}.sigstore.json" \
  --certificate-identity-regexp 'https://github\.com/suzuki-shunsuke/go-release-workflow/\.github/workflows/release\.yaml@.*' \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  "$checksum_file"
cat "$checksum_file" | sha256sum --ignore-missing -c -

For v6.4.1 or older, the signature and certificate are published as ${checksum_file}.sig and ${checksum_file}.pem instead of ${checksum_file}.sigstore.json. Download them and pass --signature "${checksum_file}.sig" --certificate "${checksum_file}.pem" to cosign verify-blob instead of --bundle.

3. Packslip​

github-comment >= v6.4.2

You can install packslip by aqua.

aqua g -i jdx/packslip
version=v6.4.2
asset=github-comment_${version#v}_darwin_arm64.tar.gz
gh release download -R suzuki-shunsuke/github-comment "$version" -p "$asset" -p packslip.sigstore.json
packslip verify packslip.sigstore.json \
    --pin ps1_4vy6kb5zu2owi6ez56hmilp2iy \
    --identity-prefix https://github.com/suzuki-shunsuke/go-release-workflow/.github/workflows/release.yaml@ \
    --artifact "$asset"
  • --pin requires the release to be signed from the repository suzuki-shunsuke/github-comment, identified by its repository ID rather than its name
  • --identity-prefix requires the release to be signed by the release workflow of suzuki-shunsuke/go-release-workflow

On success, packslip prints a line starting with ok:. Please make sure it shows the project and version you meant, e.g. github.com/suzuki-shunsuke/github-comment 6.4.2.

4. slsa-verifier​

note

This method works only for v6.4.1 or older. v6.4.2 or later don't publish multiple.intoto.jsonl, so please use GitHub CLI, Cosign, or Packslip instead.

You can install slsa-verifier by aqua.

aqua g -i slsa-framework/slsa-verifier
version=v6.4.1
asset=github-comment_${version#v}_darwin_arm64.tar.gz
gh release download -R suzuki-shunsuke/github-comment "$version" -p "$asset" -p multiple.intoto.jsonl
slsa-verifier verify-artifact "$asset" \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/suzuki-shunsuke/github-comment \
  --source-tag "$version"