CmdID

CmdID / Commands

gh-attestation

Download and verify artifact attestations to ensure their integrity and provenance. tldr-pages

On several platforms

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Download attestations for a local file associated with a specific repository

gh [at download path/to/artifact.bin --repo owner/repositoryIdentify

Download attestations for an OCI container image associated with an organization

gh [at download oci://image_uri --owner organization_nameIdentify

Verify a local artifact online against attestations from a specific repository

gh [at verify path/to/artifact.bin --repo owner/repositoryIdentify

Verify an artifact, requiring it was signed by a specific reusable workflow for enhanced security

gh [at verify path/to/artifact.bin --owner organization_name --signer-workflow owner/repository/path/to/workflow.ymlIdentify

Verify an artifact and output the detailed verification results as JSON for use in policy engines

gh [at verify path/to/artifact.bin --owner organization_name --format jsonIdentify

Perform a fully offline verification using a downloaded bundle and a custom trusted root file

gh [at verify path/to/artifact.bin --bundle path/to/bundle.jsonl --custom-trusted-root path/to/trusted_root.jsonlIdentify

Save the trusted root of signing certificates to a file for offline verification

gh [at trusted-root >path/to/trusted_root.jsonlIdentify