LUKSbox

## Verify your download

### Cryptographic provenance (GitHub / Sigstore attestation)

Every artifact below is signed via [GitHub Artifact
Attestations](https://docs.github.com/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds),
which uses Sigstore under the hood. The signature proves
the artifact was produced by this exact workflow run on
this exact commit SHA, no human had a chance to swap it
after the fact.

Verify with the GitHub CLI (one-liner):

```bash
# Install gh once if you don't have it:
# sudo apt install gh | sudo dnf install gh | brew install gh
gh attestation verify --owner penthertz
# Prints "Loaded digest ..." then "PASS" with the
# workflow run + commit SHA the artifact came from.
```

### Offline check (no `gh` needed)

Every artifact also has a SHA-256 in `SHA256SUMS.txt`
(attached to this release):

```bash
# Linux / macOS:
sha256sum -c SHA256SUMS.txt # Linux
shasum -a 256 -c SHA256SUMS.txt # macOS
```

```powershell
# Windows (PowerShell):
Get-FileHash luksbox-*.msi -Algorithm SHA256
# then compare to the `*.msi` row in SHA256SUMS.txt
```

### Trust chain summary

Artifacts on this release page are uploaded o