IT-BAER/proxmorph v2.8.1

on GitHub

Added

• Release checksums and provenance: every release now publishes a SHA256SUMS manifest and a GitHub build-provenance attestation. The installer verifies the downloaded tarball against SHA256SUMS and refuses to install on a mismatch or when the manifest is missing (fail closed). Verify a release yourself with sha256sum -c and gh attestation verify before running; see the README "Verify before you run" section.
• PROXMORPH_RELEASE_BASE: point the installer at an internal mirror of the release artifacts (air-gapped or policy-controlled installs). Checksum verification still applies against the mirrored SHA256SUMS.
• README audit transparency: documented exactly what the installer changes on the system, the review-then-run clone path, and honest framing of what checksums vs. attestation guarantee.

Security

• The release download path is no longer trust-on-first-download: artifacts are integrity-checked against a published manifest before extraction as root.