Verify the llmt CLI

Checksums and the signing public key are published here so you can confirm the llmt-cli release you downloaded is exactly the one we built — before you install it.

Latest release: v0.2.0

Release artifacts (v0.2.0)

Each release publishes three files: the checksum list, its detached minisign signature, and the minisign public key that signed it.

  • SHA256SUMS — SHA-256 of the wheel and sdist, in sha256sum -c format.
  • SHA256SUMS.minisig — detached minisign signature of SHA256SUMS.
  • llmt-cli-pubkey — the minisign public key (the trust root; the secret key is never published).

Stable "latest" aliases without the version are also served: /cli/SHA256SUMS, /cli/SHA256SUMS.minisig, /cli/llmt-cli-pubkey.

Verify a download

Fetch the three files above into the folder holding your downloaded wheel/sdist, then check the signature and the hashes: 

# 1. verify the checksum file was signed by our key
minisign -Vm SHA256SUMS -P "$(cat llmt-cli-pubkey)"

# 2. verify the artifacts match the (now-trusted) checksums
sha256sum -c SHA256SUMS

Both must pass. If either fails, do not install the artifact — re-download and, if it still fails, report it. The same SHA256SUMS file is shipped inside each release build (dist/SHA256SUMS), so the copy here and the copy you build from source are byte-for-byte identical.

Install

Once verified, install from PyPI (the llmt-cli distribution provides the llmt command): 

pip install llmt-cli==0.2.0
llmt --version