Installation

mibare is an end-user application, not a library, so install it as a standalone tool rather than as a project dependency. Its primary entry point is the mibare command.

Stable release

Install mibare into an isolated environment with your preferred tool installer:

uv tool install mibare

pipx install mibare

Or run it without installing:

uvx mibare

Homebrew (macOS/Linux):

brew install hasansezertasan/tap/mibare

Scoop (Windows):

scoop bucket add hasansezertasan https://github.com/hasansezertasan/scoop-bucket
scoop install hasansezertasan/mibare

Verify release provenance

The release workflow uses two complementary attestation mechanisms:

• GitHub build attestations record SLSA provenance for distributions when they are built, including workflow and source information. Their Sigstore bundles are also attached to the GitHub Release.

• PyPI publication attestations identify the Trusted Publisher that uploaded each distribution. The publishing action enables these by default for Trusted Publishing to PyPI or TestPyPI. They are available through PyPI’s per-file provenance APIs and UI, rather than as GitHub release bundles.

The publication claim does not replace the structured build-provenance claim. Both refer to the distribution bytes transferred from the build job, without an intervening rebuild. See PyPI’s attestation documentation for the index-hosted publication claim.

After downloading a wheel or source distribution, verify its GitHub build attestation against this repository’s release workflow and main ref:

gh attestation verify <downloaded-distribution> \
  --repo hasansezertasan/mibare \
  --signer-workflow hasansezertasan/mibare/.github/workflows/release.yml \
  --source-ref refs/heads/main

To use the matching provenance bundle downloaded from the GitHub Release instead of fetching the attestation from GitHub’s API, add --bundle:

gh attestation verify <downloaded-distribution> \
  --bundle <downloaded-provenance-bundle> \
  --repo hasansezertasan/mibare \
  --signer-workflow hasansezertasan/mibare/.github/workflows/release.yml \
  --source-ref refs/heads/main

Fully offline verification also needs trusted-root material; see GitHub’s offline verification guide.

GitHub build attestations are available for public repositories on current GitHub plans. Private and internal repositories require GitHub Enterprise Cloud and the repository variable ENABLE_PRIVATE_ATTESTATIONS=true. This opt-in applies to GitHub build attestations, not PyPI’s publication attestations. PyPI’s default attestation path requires Trusted Publishing and uses public Sigstore infrastructure; publication with an API token or an explicit attestation opt-out does not generate those attestations automatically.

From source

The source files for mibare can be downloaded from the GitHub repo.

You can either clone the public repository:

git clone https://github.com/hasansezertasan/mibare.git

Or download the tarball:

mkdir mibare
curl -fL https://github.com/hasansezertasan/mibare/tarball/main | tar -xz --strip-components=1 -C mibare

Once you have a copy of the source, you can install it with:

cd mibare
uv tool install .