Skip to content

UID2-6764: enable SLSA provenance attestation #402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BehnamMozafari merged 3 commits into from
May 12, 2026
Merged

UID2-6764: enable SLSA provenance attestation #402

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1b1c11b
UID2-6764: grant id-token and attestations write for SLSA provenance
BehnamMozafari May 8, 2026
9306bea
UID2-6764: also grant artifact-metadata:write for attest@v4 storage r…
BehnamMozafari May 11, 2026
44840dd
UID2-6764: document image provenance verification
BehnamMozafari May 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/workflows/release-docker-image.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,14 @@ on:

jobs:
Image:
permissions:
contents: write
security-events: write
packages: write
pull-requests: write
id-token: write
attestations: write
artifact-metadata: write
uses: IABTechLab/uid2-shared-actions/.github/workflows/shared-publish-java-to-docker-versioned.yaml@v3
with:
release_type: ${{ inputs.release_type }}
Expand Down
17 changes: 17 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,3 +40,20 @@ mvn clean compile exec:java -Dvertx-config-path=conf/local-config.json
mvn clean compile exec:java -Dvertx-config-path=conf/integ-config.json
```

## Verifying image provenance

Every non-snapshot image published by this repo's release workflow ships with a [SLSA v1.0](https://slsa.dev/spec/v1.0/) build-provenance attestation, signed by GitHub's [Sigstore](https://www.sigstore.dev/) instance via the OIDC identity of the [shared publish workflow](https://github.com/IABTechLab/uid2-shared-actions). The attestation cryptographically binds the image digest to the source commit, the signing workflow, and the runner that built it.

To verify an image, install [`gh`](https://cli.github.com/) (≥ 2.49) and run:

```bash
gh attestation verify \
oci://ghcr.io/iabtechlab/uid2-optout:<tag> \
--owner IABTechLab \
--signer-repo IABTechLab/uid2-shared-actions
```

A successful run prints `✓ Verification succeeded!` followed by the SLSA provenance fields — including `sourceRepositoryDigest` (the source commit), `workflow.path` (the signing workflow), and the runner identity.

Snapshot tags (`-SNAPSHOT` suffix) deliberately skip attestation. `gh attestation verify` returns `no attestations found` against a snapshot — that's expected.

Loading