GitHub Artifact Attestations are generally available! #129761
Replies: 10 comments 7 replies
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
Hey, I just tried the attestation within my organization wich is on the 'Team' plan. I get the following error in the GitHub Actions log: I couldn't find any information about what plan level is the minimum. So I'm asking here: What plan level do I need to use this feature with a private repository? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @tschwaerzl, attestations for private repositories requires a GitHub Enterprise Cloud license. Thank you for pointing this out, we'll revisit our documentation to make this more explicit! |
Beta Was this translation helpful? Give feedback.
-
|
Hi - Any chance you know whether (and/or rough ballpark when) GitHub Artifact Attestations will be made available in GHES? Thank you in advance! |
Beta Was this translation helpful? Give feedback.
-
|
Hi @sstrullmyer, for us to leverage our root certificate authority and attest that a build is secure, it needs to take place on our systems. Due to the nature of the feature, it is not possible to offer it in an on-prem deployment. |
Beta Was this translation helpful? Give feedback.
-
|
Understood - thanks for the context and your reply! |
Beta Was this translation helpful? Give feedback.
-
|
I have some feedback.
For example, tflint's checksums.txt has attestations, but we can't notice that from GitHub Releases.
So we can't notice easily that we can verify assets using attestations. |
Beta Was this translation helpful? Give feedback.
-
I'm not sure why Attestation is under The Web UI of attestations is a bit hard to find. It's helpful if we can find it more easily. |
Beta Was this translation helpful? Give feedback.
-
|
Is there any way to verify the branch or tag creating artifacts? For example, I want to verify the release tag which created assets. The asset https://github.com/suzuki-shunsuke/test-github-artifact-attestation/releases/tag/v0.1.0-3 I want to verify if the downloaded artifact was really created by the tag |
Beta Was this translation helpful? Give feedback.
-
|
@suzuki-shunsuke Thank you for the feedback, and apologies for the late reply! We'll iterate on the UI, so stay tuned for some updates there. Attesting releases is something we're actively looking into: github/roadmap#943 |
Beta Was this translation helpful? Give feedback.
-
|
❤️ ❤️ ❤️❤️ ❤️ ❤️❤️ ❤️ ❤️❤️ ❤️ ❤️ |
Beta Was this translation helpful? Give feedback.
-
|
/feature-request It would have been nice to be able to search through attestations using a subject reference. As of now, the only way to search through attestations seems to be by correlating the date a package is published with the date of an attestation, which is difficult, as packages have an approximate time/date published that does not always match what is shown for attestations. Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
Important I also want this search feature 🙏 @alxivanov, regarding only matching by dates, -- in the mean-time if you want a workaround for matching builds and attestations you can take a look at this build workflow I use to comment the build attestation as a GHA step summary (kinda the reverse-search use-case):
|
Beta Was this translation helpful? Give feedback.
-
|
package.json |
Beta Was this translation helpful? Give feedback.
-
|
The "Verify" command that is shown on the individual attestation screen is invalid for non-SLSA attestations. Here's an example attestation that's affected. This is an in-toto attestation that uses the "Release" predicate type. The command shown does not include the The command as shown fails. The correct command for this attestation is: gh attestation verify --owner johnbillion --predicate-type "https://in-toto.io/attestation/release/v0.1" <filename-or-url> |
Beta Was this translation helpful? Give feedback.
-
|
Great callout, thank you! We fixed it. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks! |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Hi,
I‘m excited to announce that GitHub Artifact Attestations are now generally available!
Artifact Attestations allow you to guarantee the integrity of artifacts built inside GitHub Actions by creating and verifying signed attestations. With this release, you can now build an admission controller using GitHub‘s distribution of the Sigstore Policy Controller to validate attestations directly within your Kubernetes clusters.
👀 Want to learn more? Check out these resources:
Beta Was this translation helpful? Give feedback.
All reactions