# V1 Artifact Verification Policy

pgContext V1 source files do not carry embedded signatures. The release is
authenticated by a GitHub-verified signed annotated tag, published SHA-256
checksums, and a Sigstore build-provenance attestation for the source archive.
Maintainers and users must also verify the immutable source commit recorded in
`PROVENANCE.json` before installing an artifact.

`SBOM.spdx.json` inventories the Rust dependency graph used by the source
candidate. The OCI image carries BuildKit provenance plus a Sigstore
attestation and must be selected by its published manifest digest rather than a
mutable convenience tag when reproducibility matters.

GitHub release immutability is intentionally disabled. Maintainers must never
replace a published asset or move a published version tag; corrections require
a new release version. Do not describe an individual file as having an embedded
signature; verification applies to the signed tag and build attestations.