Skip to main content

collect_release_attestations

libverify_github::attestation

Function collect_release_attestations 

Source 
pub fn collect_release_attestations(
    owner: &str,
    repo: &str,
    tag: &str,
    assets: &[ReleaseAsset],
    client: &GitHubClient,
) -> EvidenceState<Vec<ArtifactAttestation>>
Expand description

Collect and cryptographically verify attestations for release assets.

  1. Downloads .sha256 sidecar files (a few KB) to obtain digests
  2. Fetches attestation bundles from the GitHub Attestations REST API
  3. Verifies DSSE signatures using the certificate’s public key
  4. Confirms subject digests match the expected sidecar digests

No release binaries are downloaded.