GH-RELEASE-VERIFY-ASSET(1)

✨ GH-RELEASE-VERIFY-ASSET 💅

okay so bestie, this is a page from the GitHub CLI manual — gh-release-verify-asset(1), section 1 — and it's genuinely one of the cooler ones ngl. Let's get into it 🫶

---

🌸 NAME 🌸

gh-release-verify-asset — the icon, the moment: verify that a given asset originated from a release. that's it, that's the whole thing ✨

---

🎀 SYNOPSIS 🎀

gh release verify-asset [<tag>] <file-path> [flags]

bestie look at that — optional tag, required file-path, plus flags if you're feeling fancy 💅

---

🦋 DESCRIPTION 🦋

So here's the vibe: this command verifies that a given asset file originated from a specific GitHub Release, and it does it using cryptographically signed attestations. no cap. 🔥

An attestation is a claim made by GitHub regarding a release and its assets. think of it as GitHub signing off on "yeah, this came from here" 🖊️✨

This command checks that the asset you provide matches a valid attestation for the specified release (or the latest release, if no tag is given).

It ensures the asset's integrity by validating that the asset's digest matches the subject in the attestation, and that the attestation is actually associated with the release. so like, digest match = slay ✅, and the attestation is tied to the right release = also slay ✅. both checks, every time, periodt 💖

---

✨ OPTIONS ✨

• --format <string> — output format, and the only one on the list is {json}. that's the format menu, it has one item, and it ate 🍓
• -q, --jq <expression> — filter the JSON output using a jq expression. you've got JSON and you want specific JSON? this is the one, iykyk 🌈
• -t, --template <string> — format the JSON output using a Go template; see gh help formatting for the deets. peak customization energy 👑

---

💜 OPTIONS INHERITED FROM PARENT COMMANDS 💜

• -R, --repo <[HOST/]OWNER/REPO> — select another repository using the [HOST/]OWNER/REPO format. it comes from the parent command, but it's still family 🫶

---

🔥 EXIT CODES 🔥

Bestie, memorize these, they're important 😭

• 0: Successful execution — the good ending 🌸
• 1: Error — the other ending 💀
• 2: Command canceled
• 4: Authentication required — go log in bestie 🙈

NOTE: Specific commands may have additional exit codes. Refer to the command's help for more information.

---

🌈 EXAMPLE 🌈

Exhibit A through C, all verbatim, all iconic:

# Verify an asset from the latest release
$ gh release verify-asset ./dist/my-asset.zip

# Verify an asset from a specific release tag
$ gh release verify-asset v1.2.3 ./dist/my-asset.zip

# Verify an asset from a specific release tag and output the attestation in JSON format
$ gh release verify-asset v1.2.3 ./dist/my-asset.zip --format json

notice how the first one has no tag so it goes for the latest release, and the --format json one at the end is the full glam look ✨🧚

---

🧚 SEE ALSO 🧚

• gh-release(1) — the parent, the main character 👑

---

okay that's the whole page, you ate that 🍓💖 quick cute sign-off: this is GitHub CLI v2.102.0, dated Oct 2026, and you can find it filed right back under GH-RELEASE-VERIFY-ASSET(1) whenever you need it. mwah 💋🌟