{"id":78626,"date":"2024-06-25T09:08:55","date_gmt":"2024-06-25T16:08:55","guid":{"rendered":"https:\/\/github.blog\/changelog\/2024-06-25-artifact-attestations-is-generally-available"},"modified":"2025-04-30T06:13:12","modified_gmt":"2025-04-30T13:13:12","slug":"artifact-attestations-is-generally-available","status":"publish","type":[3521],"link":"https:\/\/github.blog\/changelog\/2024-06-25-artifact-attestations-is-generally-available","title":{"rendered":"Artifact Attestations is generally available"},"content":{"rendered":"\n

GitHub Artifact Attestations is generally available<\/span><\/a><\/h2>\n

We’re thrilled to announce the general availability of GitHub Artifact Attestations! Artifact Attestations allow you to guarantee the integrity of artifacts built inside GitHub Actions by creating and verifying signed attestations. With this release, you can now easily verify these artifacts before you deploy them in your Kubernetes cluster. Powered by Sigstore<\/a>, Artifact Attestations help you secure your software’s supply chain by creating an unforgeable link between artifacts and their build process.<\/p>\n

“Over the past nine months, Trail of Bits has worked closely with GitHub to make Homebrew<\/a> one of the earliest public adopters<\/a> of Artifact Attestations. Software, and especially open source software, is more complicated and interconnected than ever, and we believe strongly that GitHub’s new Artifact Attestations feature is a huge and necessary step towards addressing the problem of complex, opaque, software supply chains.”<\/em> – William Woodruff, Engineering Director, Trail of Bits<\/p><\/blockquote>\n

 <\/p>\n

“Using Artifact Attestations, we finished a project in under a week that we originally scoped out for months to complete.”<\/em> – Mike Place, Director of Software Engineering at Elastic<\/p><\/blockquote>\n

Adding provenance to a GitHub Actions workflow is simple! You just need to invoke the new attest-build-provenance<\/code> Action<\/a> with the path to your artifact:<\/p>\n

permissions:\n  id-token: write\n  contents: read\n  attestations: write\n\n#\n# (build your artifact)\n#\n\n- name: Generate artifact attestation\n  uses: actions\/attest-build-provenance@v1\n  with:\n    subject-path: 'PATH\/TO\/ARTIFACT'\n<\/code><\/pre>\n
Then verify it with our CLI tool<\/a>:<\/p>\n
gh attestation verify PATH\/TO\/ARTIFACT -o myorganization\n<\/code><\/pre>\n
Enhance your SDLC’s security with a Kubernetes admission controller<\/span><\/a><\/h3>\n
With general availability we are also releasing a new way to build a Kubernetes admission controller<\/a> that can validate attestations directly within your Kubernetes clusters. This means that only properly attested artifacts can be deployed, adding an extra layer of security and compliance to your software development lifecycle (SDLC). By integrating Artifact Attestations into your GitHub Actions workflows, you enhance the security of your development and deployment processes, protecting against supply chain attacks and unauthorized modifications.<\/p>\n
Setting up an admission controller for GitHub Artifact Attestations involves deploying the Sigstore Policy Controller, adding a TrustRoot<\/code> and ClusterImagePolicy<\/code> to your cluster, and enforcing those policies on a per-namespace basis. Quickly deploy your own admission controller using our Helm charts<\/a>.<\/p>\n
Learn more about the Kubernetes admission controller<\/a><\/p>\n
Get Started<\/span><\/a><\/h3>\n
To start using the new features, check out our documentation<\/a> and watch the video below for a step-by-step guide on integrating artifact attestations into your workflows. This feature supports both public and private repositories, making it easier than ever to secure your projects.<\/p>\n
\n\t\t\t