All release binaries are built in public via GitHub Actions. Every artifact includes a SHA-512 checksum file (.sha512sum).

Before using a downloaded binary, verify its integrity:

# On Linux / macOS
sha512sum -c clang-format-22_linux-amd64.sha512sum

# On Windows (PowerShell)
(Get-FileHash clang-format-22_windows-amd64.exe -Algorithm SHA512).Hash -eq (Get-Content clang-format-22_windows-amd64.exe.sha512sum).Split()[0]

The checksums in each release are generated by CI from the same build that produced the binaries — there is no manual upload step.

If you prefer not to trust pre-built binaries, you have two options:

1. Build from source yourself — Use python build.py (see README) to reproduce any build on your own machine.
2. Fork and run CI — Fork this repository and run the GitHub Actions workflow on your own fork. The binaries you download from your fork’s releases page were produced by your own CI.

If you discover a vulnerability in a binary or in the build process, please report it privately via GitHub Security Advisories:

👉 Report a security vulnerability

Do not open a public issue. We treat reports seriously and will respond as quickly as possible.

This repository does not write or maintain the clang tools themselves — it only builds them from upstream LLVM source. If you find a bug in clang-format, clang-tidy, etc., report it to LLVM.