Preflight

Supports SHA256, SHA1, and MD5 digests, and allows comma-separated hash lists or live URLs for handling rolling updates, as demonstrated in the examples for dealing with changing runnables.

Optional lookup with VirusTotal or file-based lists like Malshare adds an extra layer of security by flagging known malicious hashes, directly addressing supply chain threats beyond simple tampering.

Provides ready-to-use examples for GitHub Actions and Docker builds, enabling easy adoption into pipelines without major workflow changes, as shown in the secure Codecov and Istio installation guides.

Designed for custom lookup providers via pull requests, allowing teams to adapt it to specific security vendors or internal systems, though this requires Go development knowledge.