4 ms·
The recommended way to do this is via artifact attestation: https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-
by kepano 5mo ago
The recommended way to do this is via artifact attestation:
https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations https://docs.github.com/en/actions/how-tos/secure-your-work/...
- dsp_person 5mo agoThanks that's interesting. The docs are aimed at developers, but I'm curious about the use case for the end user. So would a user have to do some kind of `gh attestation verify PATH/TO/YOUR/BUILD/ARTIFACT-BINARY ...`? (assuming the plugin dev provides an sbom?)
- kepano 5mo agoIn the near term artifact attestation will be visible to users in the directory, and part of the overall scorecard of a plugin.