# Release artifacts and verification
This page lists Weblate release artifacts and maintained distribution channels
and explains how to verify the artifacts that include published signatures,
attestations, and SBOMs. For supported versions and security update coverage,
see [Releases and supported versions](https://docs.weblate.org/hr/latest/security/releases.md). For dependency monitoring and container vulnerability
scanning, see [Dependencies](https://docs.weblate.org/hr/latest/security/dependencies.md).
## Release artifact inventory
Weblate releases and maintained distribution channels are published through
several channels. This inventory lists the artifacts described by this
repository and where their publishing evidence is maintained. For artifacts
maintained in Weblate-owned sibling repositories, the table cites the
repository where the build and release automation lives.
| Artifact or channel | Owning repository or location | Publishing target | Repository evidence | Notes |
|-------------------------------------------|-------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Source releases and GitHub release assets | `WeblateOrg/weblate` | [GitHub releases](https://github.com/WeblateOrg/weblate/releases) | `.github/workflows/setup.yml`, `scripts/create-release`,
`scripts/prepare-release`, and [Releasing Weblate](https://docs.weblate.org/hr/latest/contributing/release.md) | Release assets include Python distribution archives, release notes, and
the release SBOM. |
| Python package | `pyproject.toml`, `setup.py`, and `MANIFEST.in` | [weblate](https://pypi.org/project/weblate/) | The distribution workflow builds, validates, signs, and publishes the
package using PyPI trusted publishing. | The package metadata and dependencies are maintained in this repository. |
| Docker images | [Weblate Docker repository](https://github.com/WeblateOrg/docker) | [Docker Hub](https://hub.docker.com/r/weblate/weblate) and [GitHub Packages Docker registry](https://github.com/WeblateOrg/docker/pkgs/container/weblate) | [Weblate Dockerfile](https://github.com/WeblateOrg/docker/blob/main/Dockerfile), [Weblate Docker image workflow](https://github.com/WeblateOrg/docker/blob/main/.github/workflows/dockerimage.yml),
[Weblate Docker container CI workflow](https://github.com/WeblateOrg/docker/blob/main/.github/workflows/container-ci.yml), [Installing using Docker](https://docs.weblate.org/hr/latest/admin/install/docker.md),
[Releasing Weblate](https://docs.weblate.org/hr/latest/contributing/release.md), and `security.yaml` | The workflow builds multi-architecture images, runs container tests,
scans with Anchore and Trivy, and publishes to Docker Hub and GitHub
Packages. Published image digests are signed with Cosign, and the
build publishes BuildKit SBOM and provenance attestations. |
| Kubernetes Helm chart | [Weblate Helm repository](https://github.com/WeblateOrg/helm) | [Weblate Helm repository endpoint](https://helm.weblate.org) and [Artifact Hub](https://artifacthub.io/packages/helm/weblate/weblate) | [Weblate Helm chart](https://github.com/WeblateOrg/helm/blob/main/charts/weblate/Chart.yaml), [Weblate Helm release workflow](https://github.com/WeblateOrg/helm/blob/main/.github/workflows/helm-release.yaml),
[Weblate Helm test workflow](https://github.com/WeblateOrg/helm/blob/main/.github/workflows/helm-test.yaml),
[Weblate Helm dependency review workflow](https://github.com/WeblateOrg/helm/blob/main/.github/workflows/dependency-review.yml), and
[Installing on Kubernetes](https://docs.weblate.org/hr/latest/admin/install/kubernetes.md) | The chart release workflow uses Helm chart-releaser on changes under
`charts/**`. Chart testing lints and installs the chart. Chart
signing, chart provenance, and chart SBOM evidence were not found in the
inspected Helm workflows. |
| Dokumentacija | `docs/`, `docs/conf.py`, and `.readthedocs.yml` | [Weblate documentation](https://docs.weblate.org/) | `.github/workflows/docs.yml` and `.readthedocs.yml` | Read the Docs project settings are not stored in this repository. |
| Weblate Client package and releases | [Weblate Client repository](https://github.com/WeblateOrg/wlc) | [wlc](https://pypi.org/project/wlc/) and [Weblate Client GitHub releases](https://github.com/WeblateOrg/wlc/releases) | [Weblate Client distribution workflow](https://github.com/WeblateOrg/wlc/blob/main/.github/workflows/setup.yml),
[Weblate Client metadata](https://github.com/WeblateOrg/wlc/blob/main/pyproject.toml), and [Weblate klijent](https://docs.weblate.org/hr/latest/wlc.md) | The workflow builds and validates source and wheel artifacts, publishes
to PyPI using trusted publishing, creates GitHub releases for tags,
attaches package SBOM files to GitHub releases, and creates package
provenance and SBOM attestations. |
| Weblate Client Docker image | [Weblate Client repository](https://github.com/WeblateOrg/wlc) | [Weblate Client Docker image](https://hub.docker.com/r/weblate/wlc) and [Weblate Client GHCR registry](https://github.com/WeblateOrg/wlc/pkgs/container/wlc) | [Weblate Client Dockerfile](https://github.com/WeblateOrg/wlc/blob/main/Dockerfile), [Weblate Client Docker workflow](https://github.com/WeblateOrg/wlc/blob/main/.github/workflows/dockerimage.yml), and
[Weblate klijent](https://docs.weblate.org/hr/latest/wlc.md) | The workflow builds multi-architecture images, tests the command-line
client image, scans with Anchore and Trivy, and publishes to Docker Hub
and GitHub Packages. Published image digests are signed with Cosign,
CycloneDX image SBOMs are generated with Syft, and image provenance and
SBOM attestations are pushed to the registries. |
The development Docker files in `dev-docker/` are development and
testing infrastructure, not production release artifacts.
Docker Compose files, including the [Weblate Docker Compose repository](https://github.com/WeblateOrg/docker-compose) and
local override examples, are example deployment configurations rather than
release artifacts. Operators typically adapt them for their own deployments and
update Weblate primarily by selecting or pulling Docker image tags. They are
not covered by the release signatures, SBOMs, or provenance statements on this
page.
## Software Bill of Material
Weblate publishes a Software Bill of Material (SBOM) using the CycloneDX
format for released versions. The SBOM is available as a versioned
`weblate--sbom.cdx.json` file in the [GitHub release assets](https://github.com/WeblateOrg/weblate/releases/latest) and
is also attached to the release provenance using GitHub artifact attestations.
This can be used to review the dependencies for security issues or license
compliance.
The release SBOM records document-level metadata for the CISA 2025 minimum
elements, including the SBOM author, software producer, generation tools,
timestamp, generation context, and Weblate release component identity.
Dependency component details are emitted by the ecosystem SBOM generators used
during the release. Python component license and hash completeness therefore
depends on CycloneDX export support in **uv**.
## Verifying release artifacts
The Weblate release workflow publishes verification material for the Weblate
Python source distribution and wheel in [GitHub release assets](https://github.com/WeblateOrg/weblate/releases/latest). Release
assets include the package archives, Sigstore signature bundles, release notes,
and the release SBOM. The same package archives are uploaded to PyPI using
trusted publishing. The PyPI publishing action generates and uploads a
separate PyPI publish attestation for each archive. These attestations are
available in the provenance details for each release file on [weblate](https://pypi.org/project/weblate/).
Existing releases uploaded without attestations do not gain provenance
retroactively. The Sigstore bundle files remain available in GitHub release
assets.
Verify the files downloaded from GitHub release assets when you need the
published signatures, GitHub attestations, and SBOM. PyPI package files can be
compared to the matching GitHub release assets by filename and digest.
### Release signatures
Weblate package archives are cryptographically signed using Sigstore
signatures. The signature bundles are attached to the GitHub release next to
the signed `.tar.gz` and `.whl` files.
The verification can be performed using the [sigstore package](https://pypi.org/project/sigstore/). The following example verifies the wheel from the 5.4 release;
adjust the version and filenames for the release you are checking:
```sh
sigstore verify github \
--cert-identity https://github.com/WeblateOrg/weblate/.github/workflows/setup.yml@refs/tags/weblate-5.4 \
--bundle Weblate-5.4-py3-none-any.whl.sigstore \
Weblate-5.4-py3-none-any.whl
```
### Release attestations
The release workflow creates two kinds of [GitHub artifact attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations) for
the package archives:
* Build provenance attestations generated by
`.github/workflows/setup.yml` using
**actions/attest-build-provenance**.
* SBOM attestations generated by `.github/workflows/setup.yml` using
**actions/attest** with the CycloneDX release SBOM.
The attestations can be verified using **gh**. The following example
checks the build provenance attestation for the 5.4 wheel:
```sh
gh attestation verify Weblate-5.4-py3-none-any.whl \
--repo WeblateOrg/weblate \
--source-ref refs/tags/weblate-5.4 \
--signer-workflow WeblateOrg/weblate/.github/workflows/setup.yml
```
Use the CycloneDX predicate type to verify the SBOM attestation attached to the
same package artifact:
```sh
gh attestation verify Weblate-5.4-py3-none-any.whl \
--repo WeblateOrg/weblate \
--source-ref refs/tags/weblate-5.4 \
--signer-workflow WeblateOrg/weblate/.github/workflows/setup.yml \
--predicate-type https://cyclonedx.org/bom
```
### SBOM and checksums
The release SBOM is a CycloneDX JSON file named
`weblate--sbom.cdx.json` and is attached to GitHub release assets.
The SBOM attestation is attached to the package archives, not to the SBOM file
as a separate release artifact.
Weblate does not currently publish a separate checksum manifest such as
`SHA256SUMS` for release artifacts.
### Other release channels
The release artifact inventory does not currently identify signatures, SBOMs,
or provenance attestations for Helm charts. The verification instructions in
this section apply to the Weblate Python release artifacts published by this
repository. Docker image and Weblate Client supply-chain metadata is published
by their owning repositories.