[httpsphl]

What

• Build provenance. Each release attests both installers with actions/attest@v4 (SLSA provenance, signed through Sigstore). Anyone can check that a download came from this workflow, this repository and that commit:

  gh attestation verify Botloft_<version>_x64-setup.exe --repo httpsphl/botloft
  

  The workflow gets id-token, attestations and artifact-metadata write permissions for this.
• Verify your download. The draft's notes now open with the SHA-256 of both installers and that command. GitHub puts --notes before the notes it generates.
• Stage, attest, publish. release.yml stages, attests, then publishes. release.mjs stage prints the SHA-256 of what it staged; publish uploads what stage left and refuses without it, so the attested files are exactly the ones uploaded.
• Spec 15.5 and CLAUDE.md describe it.

Why not VirusTotal yet

0.6.0's setup window scored 2 of 71 on VirusTotal, both machine-learning detections (Microsoft Trojan:Win32/Wacatac.C!ml and Trapmine Malicious.moderate.ml.score); the NSIS -update.exe showed none. A "2/71" link would worry people more than reassure them, so it stays out of the notes until the false positive is cleared. Spec 15.5 records this.

Tests

• release.mjs stage locally (with a stand-in .sig) staged both installers and printed their SHA-256; publish without staged files stops before calling gh.
• Biome passes.

Still to see

• The attestation and the notes on the next release (0.6.1 or 0.7.0), and gh attestation verify on its setup.