PatentChecker releases (public artifacts)

This repository is a public distribution surface for PatentChecker release artifacts.

• Source code lives in a separate private repository.
• Tags in this repo exist only to anchor GitHub Releases.
• Each GitHub Release in this repo should contain:
  • runner_receipt.v0.1.json (image + digest + verification identity)
  • cosign.bundle.json (offline signature verification bundle)
  • sbom.spdx.json (SBOM)
  • provenance.slsa.json (SLSA provenance predicate)

Where to download

Use the GitHub Releases page for this repository.

Verification

The intended verification flow is:

1. Read runner_receipt.v0.1.json to get:
   • image reference (e.g. ghcr.io/omniscoder/patentchecker)
   • immutable digest (sha256:...)
   • signing identity + issuer
2. Verify the image signature with cosign.bundle.json (offline / air-gapped friendly).
3. Validate attestations (sbom.spdx.json, provenance.slsa.json) as needed.

PatentChecker customer-facing verification guidance is maintained alongside the product docs/site.