# Release Channels + Verification

> Enterprise release distribution pathways for thoth and thothctl, including Homebrew, notarized PKG, signatures, SBOMs, and provenance verification.

Source: https://docs.atensecurity.com/docs/deployments/release-channels

Use this guide to choose the right `thoth/v*` release pathway and verify release authenticity before endpoint rollout.

## Choose an approved release

Choose a published release from [atensecurity/thoth releases](https://github.com/atensecurity/thoth/releases).
Use one approved version across a deployment ring and verify its artifacts
before installation. The monorepo release tag is `thoth/v<version>`; the public
repository publishes `v<version>`. SDK and provider versions are independent.
This guide describes verification steps; availability of a signed platform
artifact must be confirmed on the selected release before rollout.

## Channel 1: Homebrew (recommended for admin workstations)

```bash
brew tap atensecurity/tap
brew install thoth
```

Upgrade:

```bash
brew update
brew upgrade thoth
```

Validate:

```bash
thoth --version
thothctl --version
```

`thothctl` is installed with `thoth`; there is no separate `thothctl` formula.

## Channel 2: Notarized macOS PKG (recommended for MDM)

Download `thoth-macos-universal.pkg` from the matching `v*` release in `atensecurity/thoth`.

Install locally:

```bash
sudo installer -pkg thoth-macos-universal.pkg -target /
```

Validate Apple trust:

```bash
pkgutil --check-signature thoth-macos-universal.pkg
spctl --assess --type install --verbose=4 thoth-macos-universal.pkg
```

Post-install validation:

```bash
thoth --version
thothctl --version
thoth health --json
```

## Channel 3: Signed Windows MSI (recommended for Intune/enterprise Windows)

Download `Thoth-x64.msi` from the matching `v*` release in `atensecurity/thoth`.

Silent install:

```powershell
msiexec /i Thoth-x64.msi /qn /norestart ALLUSERS=1
```

Validate signature:

```powershell
Get-AuthenticodeSignature .\\Thoth-x64.msi | Format-List Status,SignerCertificate,TimeStamperCertificate
```

## Channel 4: Direct binaries (Linux/Windows/macOS automation)

Download platform-specific assets from `atensecurity/thoth` release `v<version>`:

- `thoth-linux-x86_64`
- `thoth-linux-arm64`
- `thoth.exe`
- `thothctl.exe`
- `thoth-macos-universal`
- matching `thothctl-*` binaries

Always verify checksums before install:

```bash
sha256sum -c checksums.sha256
```

Windows enterprise releases also include `SHA256SUMS` for MSI-focused distribution workflows.

## Required release artifact verification

## 1) Sigstore keyless signatures

Each asset has:

- `<asset>.sig`
- `<asset>.sigstore.json`

Verify one asset (example for `checksums.sha256`):

```bash
cosign verify-blob \
  --bundle checksums.sha256.sigstore.json \
  checksums.sha256
```

Use `sigstore-metadata.json` from the same release to validate expected certificate identity and OIDC issuer.

## 2) SBOMs

Artifacts included:

- `sbom.cdx.json` (CycloneDX)
- `sbom.spdx.json` (SPDX)

Sanity check:

```bash
jq -e '.bomFormat == "CycloneDX"' sbom.cdx.json
jq -e '.spdxVersion | startswith("SPDX-")' sbom.spdx.json
```

## 3) Provenance + manifest

Artifacts included:

- `provenance.json`
- `release-manifest.json`

Sanity check:

```bash
jq -e '.provenanceType == "release-artifact-provenance"' provenance.json
jq -e '.artifacts | length > 0' release-manifest.json
```

## 4) GitHub attestations

Verify attestation for a downloaded asset:

```bash
gh attestation verify checksums.sha256 --repo atensecurity/thoth
```

## MDM packaging recommendations

- Jamf: deploy notarized PKG + managed config + setup policy.
- Intune: deploy PKG/Win32 + managed config + setup script.
- Kandji: deploy notarized PKG + custom script for config enforcement.
- Santa: apply Team ID and designated requirement rules from `santa-metadata.json`.

## Related runbooks

- [Santa macOS Trust Policy](https://docs.atensecurity.com/docs/deployments/santa-macos)
- [Jamf Onboarding Overview](https://docs.atensecurity.com/docs/deployments/jamf-overview)
- [Kandji macOS Runbook](https://docs.atensecurity.com/docs/deployments/kandji-macos)
- [Intune Onboarding Overview](https://docs.atensecurity.com/docs/deployments/intune-overview)