4 hours ago
Hi Railway team,
I’m verifying the pinned Railway CLI v5.23.3 for Linux x86-64 with glibc (x86_64-unknown-linux-gnu). The verified npm installer’s filename pattern gives railway-v5.23.3-x86_64-unknown-linux-gnu.tar.gz for this target. The npm registry signature covers the wrapper tarball.
Could a Railway maintainer confirm the archive filename and provide the following?
- The official SHA-256 checksum for this exact release archive.
- A publisher-controlled URL for the checksum or a signed attestation that binds this archive to
v5.23.3, with verification instructions. - Any officially supported pinned installation procedure that verifies the native archive or executable before the CLI is first run.
Thanks.
1 Replies
4 hours ago
We publish the CLI's pre-built native binaries on the railwayapp/cli GitHub releases page, so the v5.23.3 release there is the publisher-controlled source to compare the archive name railway-v5.23.3-x86_64-unknown-linux-gnu.tar.gz and any assets published alongside it against.
We can't confirm from here which checksum files or signed attestations are attached to that release, so we're not quoting a SHA-256 value or verification command. The documented install routes are the install script, npm, Homebrew, the pre-built binaries, and building from source. Building from a pinned tag in that repository is the route where you can inspect what you run before first use.
Status changed to Awaiting User Response Railway • about 4 hours ago