About

rmqa.com is the home of rmqa, short for release manifest QA. It’s a small program that checks a software release before you publish it. You describe once what every release must contain, and rmqa opens the real archives and programs and tells you, file by file, what is missing or wrong.

Why It Exists

Build pipelines check that the code compiles and the tests pass. Almost nothing checks the finished release as a whole. So the mistakes that reach users are the boring ones: the arm64 archive holds the amd64 program, one download still has last week’s build inside, the macOS file was never uploaded, the checksums file was made before an archive was rebuilt, the license is missing from the Windows zip. Each step went green. The release is still wrong, and the first person to notice is a user filing an issue.

rmqa sits after the build and before the publish button, and it looks at what users will actually download.

How It’s Built

  • One binary. Written in Go with the standard library only. Nothing to install beside it, on Linux, macOS or Windows.
  • It opens everything. rmqa reads .tar.gz, .tgz, .tar.bz2, .tar, .zip and .gz archives, and identifies the programs inside by their headers: ELF on Linux and the BSDs, Mach-O on macOS (universal binaries too), PE on Windows.
  • A plain manifest. A short TOML file lists the platforms and what each download must hold. rmqa init writes it from a release you know is good.
  • Made for CI. Exit status 0 when the release is ready, 1 when it isn’t. GitHub Actions annotations, JSON and Markdown output, and a ready-made GitHub Action.
  • It checks itself. Every rmqa release is checked by rmqa before it’s published. The very first run caught a bug in rmqa, which the testing post tells.

License

All the code is open source under the Apache License 2.0, on GitHub. You can use it, change it and build it into your own products.

Questions People Ask

Is it free?

Yes. rmqa is free to use, and the code is free to take under the Apache License 2.0.

Does it replace signing, SBOMs or provenance?

No, and it works next to them. Signing tools prove who made a file. SBOM tools list what went into it. rmqa checks that the files you’re about to publish are the files you meant to publish: complete, for the right platforms, with the right version inside. Signature files are left out of the checksum coverage rule, so they don’t get flagged.

Which languages does it work with?

Any language that ships compiled programs: Go, Rust, C and C++, Zig, Swift, .NET with native builds, and the rest. rmqa looks at the files, not at how they were made.

Does it run my programs?

Only if you ask it to with run = ["--version"] in the manifest, and only the ones built for the machine rmqa runs on. They run in an empty temporary folder with a 15-second limit. Programs for other platforms are checked by reading their headers and searching for the version string.

What does it not do yet?

It can’t open .tar.xz, .tar.zst, .deb, .rpm, .msi or .dmg files yet. It checks them for presence, size and checksums only. It doesn’t verify signatures, and it doesn’t check container images or package registries.

What does the name mean?

rmqa stands for release manifest QA, and each word is part of the job. The release is the set of files people download. The manifest lists what that release must hold, the way a ship’s manifest lists its cargo. QA is the final look before it goes out. The program is rmqa, its manifest is rmqa.toml, and this site is rmqa.com, so the same four letters lead to all three.

Say it letter by letter, R-M-Q-A. Why the release checker is called rmqa has the longer story.

Can I suggest something?

Please do. The contact page has the address.