Skip to content

Commit a203454

Browse files
committed
update the description
1 parent c1969f0 commit a203454

2 files changed

Lines changed: 6 additions & 16 deletions

File tree

pkg/cmd/release/verify-asset/verify_asset.go

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -40,20 +40,14 @@ func NewCmdVerifyAsset(f *cmdutil.Factory, runF func(*VerifyAssetConfig) error)
4040

4141
cmd := &cobra.Command{
4242
Use: "verify-asset [<tag>] <file-path>",
43-
Short: "Verify that a given asset originated from a specific GitHub Release.",
43+
Short: "Verify that a given asset originated from a release",
4444
Long: heredoc.Doc(`
4545
Verify that a given asset file originated from a specific GitHub Release using cryptographically signed attestations.
4646
47-
## Understanding Verification
48-
4947
An attestation is a claim made by GitHub regarding a release and its assets.
5048
51-
## What This Command Does
52-
53-
This command checks that the asset you provide matches an attestation produced by GitHub for a particular release.
54-
It ensures the asset's integrity by validating:
55-
* The asset's digest matches the subject in the attestation
56-
* The attestation is associated with the specified release
49+
This command checks that the asset you provide matches a valid attestation for the specified release (or the latest release, if no tag is given).
50+
It ensures the asset's integrity by validating that the asset's digest matches the subject in the attestation and that the attestation is associated with the release.
5751
`),
5852
Args: cobra.MaximumNArgs(2),
5953
Example: heredoc.Doc(`

pkg/cmd/release/verify/verify.go

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,19 +42,15 @@ func NewCmdVerify(f *cmdutil.Factory, runF func(config *VerifyConfig) error) *co
4242

4343
cmd := &cobra.Command{
4444
Use: "verify [<tag>]",
45-
Short: "Verify the attestation for a GitHub Release.",
45+
Short: "Verify the attestation for a release",
4646
Args: cobra.MaximumNArgs(1),
4747
Long: heredoc.Doc(`
4848
Verify that a GitHub Release is accompanied by a valid cryptographically signed attestation.
4949
50-
## Understanding Verification
51-
5250
An attestation is a claim made by GitHub regarding a release and its assets.
5351
54-
## What This Command Does
55-
56-
This command checks that the specified release (or the latest release, if no tag is given) has a valid attestation.
57-
It fetches the attestation for the release and prints out metadata about all assets referenced in the attestation, including their digests.
52+
This command checks that the specified release (or the latest release, if no tag is given) has a valid attestation.
53+
It fetches the attestation for the release and prints metadata about all assets referenced in the attestation, including their digests.
5854
`),
5955
Example: heredoc.Doc(`
6056
# Verify the latest release

0 commit comments

Comments
 (0)