Derek Parker 25e1565230
build: add goreleaser release automation with cosign signing (#4278)
Adds goreleaser-based release automation integrated with GitHub Releases.

On pushing a v* tag, the release workflow cross-compiles dlv for 8
platforms (linux/darwin/windows × amd64/arm64/386/ppc64le where
supported), packages them as .tar.gz/.zip archives, generates a SHA256
checksums file, signs checksums.txt with cosign keyless signing via
GitHub Actions OIDC, and publishes everything to GitHub Releases.

A workflow_dispatch trigger supports dry-run testing without publishing.

Changes:
- .goreleaser.yaml: goreleaser v2 config for builds, archives,
  checksums, cosign signing, and GitHub Release publishing
- .github/workflows/release.yml: release workflow with tag push and
  manual dispatch triggers
- _scripts/make.go: make build now delegates to goreleaser
  --single-target so local and release builds share identical config
- Documentation/installation/README.md: document binary release
  download and cosign verification
- CONTRIBUTING.md: document goreleaser v2 as a build prerequisite

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-09 17:24:42 +01:00
..

Installation

The following instructions are known to work on Linux, macOS, Windows and FreeBSD.

With Go version 1.16 or later:

# Install the latest release:
$ go install github.com/go-delve/delve/cmd/dlv@latest

# Install from tree head:
$ go install github.com/go-delve/delve/cmd/dlv@master

# Install a specific version or pseudo-version:
$ go install github.com/go-delve/delve/cmd/dlv@v1.7.3
$ go install github.com/go-delve/delve/cmd/dlv@v1.7.4-0.20211208103735-2f13672765fe

See Versions and Pseudo-versions for how to format the version suffixes.

Download a binary release

Pre-built binaries for Linux, macOS, and Windows are available on the GitHub Releases page.

Download the archive for your platform, extract it, and place dlv in your $PATH.

To verify a release with cosign, verify the signed checksum file and then check your archive against it:

# Verify the signed checksum file (validates both signature and signer identity)
cosign verify-blob \
  --certificate checksums.txt.cert \
  --signature checksums.txt.sig \
  --certificate-identity-regexp "https://github.com/go-delve/delve/.github/workflows/release.yml@refs/tags/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt

# Verify your archive matches the checksum
sha256sum -c --ignore-missing checksums.txt

Alternatively, clone the git repository and build:

$ git clone https://github.com/go-delve/delve
$ cd delve
$ go install github.com/go-delve/delve/cmd/dlv

See go help install for details on where the dlv executable is saved.

If during the install step you receive an error similar to this:

found packages native (proc.go) and your_operating_system_and_architecture_combination_is_not_supported_by_delve (support_sentinel.go) in /home/pi/go/src/github.com/go-delve/delve/pkg/proc/native

It means that your combination of operating system and CPU architecture is not supported, check the output of go version.

macOS considerations

On macOS make sure you also install the command line developer tools:

$ xcode-select --install

If you didn't enable Developer Mode using Xcode you will be asked to authorize the debugger every time you use it. To enable Developer Mode and only have to authorize once per session use:

sudo /usr/sbin/DevToolsSecurity -enable

You might also need to add your user to the developer group:

sudo dscl . append /Groups/_developer GroupMembership $(whoami)

Compiling macOS native backend

You do not need the macOS native backend and it has known problems. If you still want to build it:

  1. Run xcode-select --install
  2. On macOS 10.14 manually install the legacy include headers by running /Library/Developer/CommandLineTools/Packages/macOS_SDK_headers_for_macOS_10.14.pkg
  3. Clone the repo into $GOPATH/src/github.com/go-delve/delve
  4. Run make install in that directory (on some versions of macOS this requires being root, the first time you run it, to install a new certificate)

The makefile will take care of creating and installing a self-signed certificate automatically.