The charmbracelet/crush nightly release now publishes signature metadata and checksum instructions so users can verify downloaded artifacts with cosign before trusting or installing them.
Scattered source updates, isolated context, and manual follow-up across multiple feeds.
Introduced a documented cryptographic verification path for nightly artifacts by shipping a checksums manifest with a Sigstore bundle and defining the exact command sequence to verify package authenticity and integrity.
Users and operators pulling the nightly release can confirm files are genuine and unaltered before use, which directly lowers operational risk from tampered or corrupted downloads during adoption or deployment. The release now links `checksums.txt` and `checksums.txt.sigstore.json` to a verified identity/issuer check via `cosign`, but teams should monitor whether automated install pipelines actually enforce this step and whether future releases keep publishing both files consistently.
Users and operators pulling the nightly release can confirm files are genuine and unaltered before use, which directly lowers operational risk from tampered or corrupted downloads during adoption or deployment. The release now links `checksums.txt` and `checksums.txt.sigstore.json` to a verified identity/issuer check via `cosign`, but teams should monitor whether automated install pipelines actually enforce this step and whether future releases keep publishing both files consistently.