Skip to content

Commit 7e4d3c4

Browse files
committed
docs: use real gh attestation verify output template and --owner flag
1 parent 2ee25cc commit 7e4d3c4

1 file changed

Lines changed: 15 additions & 2 deletions

File tree

packages/sdk/server-ai/PROVENANCE.md

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,30 @@ VERSION=0.16.1
1818
$ pip download --only-binary=:all: launchdarkly-server-sdk-ai==${VERSION}
1919
2020
# Verify provenance using the GitHub CLI
21-
$ gh attestation verify launchdarkly_server_sdk_ai-${VERSION}-py3-none-any.whl -R launchdarkly/python-server-sdk-ai
21+
$ gh attestation verify launchdarkly_server_sdk_ai-${VERSION}-py3-none-any.whl --owner launchdarkly
2222
```
2323

2424
Below is a sample of expected output.
2525

2626
```
2727
Loaded digest sha256:... for file://launchdarkly_server_sdk_ai-0.16.1-py3-none-any.whl
2828
Loaded 1 attestation from GitHub API
29+
30+
The following policy criteria will be enforced:
31+
- Predicate type must match:................ https://slsa.dev/provenance/v1
32+
- Source Repository Owner URI must match:... https://github.com/launchdarkly
33+
- Subject Alternative Name must match regex: (?i)^https://github.com/launchdarkly/
34+
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com
35+
2936
✓ Verification succeeded!
3037
31-
launchdarkly_server_sdk_ai-0.16.1-py3-none-any.whl was attested by a trusted GitHub Actions workflow
38+
The following 1 attestation matched the policy criteria
39+
40+
- Attestation #1
41+
- Build repo:..... launchdarkly/python-server-sdk-ai
42+
- Build workflow:. .github/workflows/release-please.yml
43+
- Signer repo:.... launchdarkly/python-server-sdk-ai
44+
- Signer workflow: .github/workflows/release-please.yml
3245
```
3346

3447
For more information, see [GitHub's documentation on verifying artifact attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#verifying-artifact-attestations-with-the-github-cli).

0 commit comments

Comments
 (0)