You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Spoon CI/CD pipeline attests all released artifacts by publishing attestations to the [sigstore/rekor](https://www.sigstore.dev/) public-good instance as well as storing them in the [Github's attestation registry](https://github.com/INRIA/spoon/attestations). Attestations are published using Github's [attest-build-provenance](https://github.com/actions/attest-build-provenance) action as a step in the [jreleaser job](https://github.com/ludvigch/spoon/blob/master/.github/workflows/jreleaser.yml). A list of the attestations created for a release can be found in the summary of a job and the sigstore/rekor links for each attestation can be found in the log of the jreleaser job.
4
+
5
+
## Finding attestations
6
+
7
+
Rekor is searchable with the hash of an attested artifact, for example attestation for spoon-core-11.1.1-beta-11-jar-with-dependencies.jar can be found at
Github provides an [`attestations` tab](https://github.com/INRIA/spoon/attestations) for all repos and a [REST API Endpoint](https://docs.github.com/en/rest/users/attestations)
11
+
12
+
## Verifying attestations
13
+
14
+
The most straight-forward approach is to use GitHub CLI's [`gh attestation verify`](https://cli.github.com/manual/gh_attestation_verify) to verify the attestation of an artifact by running:
For example, let's verify the [spoon-core-11.1.1-beta-11-jar-with-dependencies.jar](https://repo1.maven.org/maven2/fr/inria/gforge/spoon/spoon-core/11.1.1-beta-11/spoon-core-11.1.1-beta-11-jar-with-dependencies.jar) artifact.
19
+
20
+
### Alternative 1: Using GitHub API
21
+
22
+
Install `gh`, see doc at <https://cli.github.com/>
<spanclass="k">case</span><spanclass="nf">X</span><spanclass="o">(</span><spanclass="n">_</span><spanclass="o">)</span><spanclass="o">-></span><spanclass="mi">0</span><spanclass="o">;</span><spanclass="c1">// an unnamed pattern does neither mention a type nor a name</span>
<p>If you plan to repeatedly run Spoon from the command line, it may be a good idea to combine all of your commands into a single bash script. An example of this can be found <ahref="https://github.com/INRIA/spoon/blob/master/doc/example_scripts/example_usage_script.sh">here</a>.</p>
0 commit comments