This release is merely to allow attestations to be used, and you should be able to validate the binary origin with:
gh attestation verify ./dua-v2.39.1-aarch64-apple-darwin.tar.gz --repo Byron/dua-cli
And that seems to work!
The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/byron
- Source Repository URI must match:......... https://github.com/byron/dua-cli
- Subject Alternative Name must match regex: (?i)^https://github.com/byron/dua-cli/
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com
✓ Verification succeeded!
The following 1 attestation matched the policy criteria
- Attestation #1
- Build repo:..... Byron/dua-cli
- Build workflow:. .github/workflows/release.yml@refs/tags/v2.39.1
- Signer repo:.... Byron/dua-cli
- Signer workflow: .github/workflows/release.yml@refs/tags/v2.39.1
Commit Statistics
- 4 commits contributed to the release.
- 2 days passed between releases.
- 0 commits were understood as conventional.
- 0 issues like '(#ID)' were seen in commit messages