Verify packages using GitHub Artifact Attestations

[suzuki-shunsuke]

Feature Overview

• Look into GitHub Artifact attestations #2972
• Create GitHub Artifact Attestations in the release of aqua #3117
• https://github.blog/changelog/2024-06-25-artifact-attestations-is-generally-available/
• https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds

Verify packages using GitHub Artifact Attestations.

Why is the feature needed?

To install packages securely.

Workaround

No response

Example Code

Similar to Cosign and SLSA Provenance.

https://aquaproj.github.io/docs/reference/security/cosign-slsa

packages:
  - type: github_release
    repo_owner: terraform-linters
    repo_name: tflint
    asset: tflint_{{.OS}}_{{.Arch}}.{{.Format}}
    format: zip
    github_artifact_attestations:
      signer-workflow: terraform-linters/tflint/.github/workflows/release.yml

Note

• https://zenn.dev/shunsuke_suzuki/scraps/4809dd473addf9

[suzuki-shunsuke]

Seems like tflint provides GitHub Artifact Attestations.

• https://github.com/terraform-linters/tflint/attestations
• https://github.com/terraform-linters/tflint/releases/tag/v0.51.1
• release: Introduce Artifact Attestations terraform-linters/tflint#2038