Repository navigation

feat(ci): attest published image provenance and publish the digest as an asset (#354) - #384

Merged

mforce merged 16 commits into

mainfrom

feat/351-release-digest-asset

Aug 2, 2026

Commits on Aug 2, 2026
- feat(ci): attest published image provenance and publish the digest as an asset
  mforce
  committed
  14dfa8c
- fix(ci): document the verify command with the two flags it actually needs
  mforce
  committed
  183799f
- docs: stop describing tag resolution as buying immutability
  mforce
  committed
  d453893
- fix(ci): verify provenance in promote, and stop overstating what it proves
  mforce
  committed
  3981449
- fix(ci): correct the last copy of the overstated provenance claim
  mforce
  committed
  20a45e3
- fix(ci): pin provenance to main's ref, not just the workflow path
  mforce
  committed
  73e7984
- docs: teach the repair path and the field list about the source-ref pin
  mforce
  committed
  a1e1fce
- docs(ci): remove the last 'both flags' remnant
  mforce
  committed
  a686ad0
- docs: bound the fail-closed claim to registry credentials, not repo write
  mforce
  committed
  989c8b4
- docs: strip review sediment and stop re-arguing the same case four times
  mforce
  committed
  812d5e4
- docs: say that v0.0.1 supports neither obtain nor verify
  mforce
  committed
  805bb56
- docs: separate the two gates instead of collapsing them
  mforce
  committed
  a7359ab
- docs: neither gate survives a merge to main, and say it in one place
  mforce
  committed
  6948a1e
- docs: make the canonical pointer point at the right paragraph
  mforce
  committed
  4b5e5cf
- docs: attestation proves origin, not currency - a downgrade is still possible
  mforce
  committed
  de3fc98
- docs: step 3 must key off the digest it verified, and cannot stop a registry writer
  mforce
  committed
  97e65a6

Navigation Menu

Repository navigation

feat(ci): attest published image provenance and publish the digest as an asset (#354) - #384

feat(ci): attest published image provenance and publish the digest as an asset (#354)#384
mforce merged 16 commits into
mainfrom
feat/351-release-digest-asset

Commits on Aug 2, 2026

feat(ci): attest published image provenance and publish the digest as an asset

fix(ci): document the verify command with the two flags it actually needs

docs: stop describing tag resolution as buying immutability

fix(ci): verify provenance in promote, and stop overstating what it proves

fix(ci): correct the last copy of the overstated provenance claim

fix(ci): pin provenance to main's ref, not just the workflow path

docs: teach the repair path and the field list about the source-ref pin

docs(ci): remove the last 'both flags' remnant

docs: bound the fail-closed claim to registry credentials, not repo write

docs: strip review sediment and stop re-arguing the same case four times

docs: say that v0.0.1 supports neither obtain nor verify

docs: separate the two gates instead of collapsing them

docs: neither gate survives a merge to main, and say it in one place

docs: make the canonical pointer point at the right paragraph

docs: attestation proves origin, not currency - a downgrade is still possible

docs: step 3 must key off the digest it verified, and cannot stop a registry writer