Downloads / provenance
Know what you run.
Get releases from the project’s GitHub repository. Verify the archive checksum and its build provenance before installing.
No public binary release has been verified for this site yet. Build from source, or check GitHub releases. This page does not label an unverified download as certified.
Checking availability sends a request to the public GitHub API. A private repository, missing release, network failure or API limit can prevent a public listing.
Verification,
not a badge.
SHA-256 checks the downloaded bytes against a checksum. A GitHub artifact attestation establishes which repository and workflow produced an archive. Neither is an independent security audit.
1. Check the archive
Download the archive and its SHA256SUMS from the same release. On macOS:
shasum -a 256 -c SHA256SUMS --ignore-missing
On Linux use sha256sum --check --ignore-missing SHA256SUMS. Confirm the filename and digest match the file you downloaded.
2. Verify the build provenance
For releases that provide an attestation, use GitHub CLI to verify the downloaded archive:
gh attestation verify ./pizd-VERSION-TARGET.tar.gz \ --repo torxx666/pizd
Verify the archive itself: that is the release workflow’s attested subject. See GitHub’s verification guide.
Platform signing is separate. GitHub provenance is not Apple notarization or Windows Authenticode. No platform-signing or independent-certification claim is made here.
Build from source.
A Rust toolchain, Git and a native C/C++ build toolchain are required. Repository access is required. The release workflow pins its Rust version and records the exact source commit.
git clone https://github.com/torxx666/pizd.git cd pizd cargo build --release --locked ./target/release/pizd --version
Release questions
Which platforms are planned for the release workflow?
Linux x86-64 and ARM64, and macOS Intel and Apple Silicon. A platform is available only when its archive is actually present in a published release. Windows is not advertised as a verified prebuilt target.
Does “source available” mean unrestricted production use?
No. PIZD uses the Business Source License 1.1 with an Additional Use Grant. Read the actual license terms, including production and commercial-use conditions.
Why is there no direct binary button yet?
A public release could not be verified during this website update. The download listing stays empty until GitHub returns a published release with actual archive assets. Source builds remain available to users with repository access.
Is the downloaded version necessarily the benchmarked version?
No. The benchmarks page names its measured version and source snapshot. Release provenance identifies a separate build. Compare these identities before drawing conclusions about your binary.