@candledottv/cli 0.11.4 → 0.11.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -1
- package/dist/index.js +6526 -5106
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -108,9 +108,15 @@ grep candle-darwin-arm64 SHA256SUMS | shasum -a 256 -c
|
|
|
108
108
|
|
|
109
109
|
```
|
|
110
110
|
gh attestation verify candle-darwin-arm64 --repo candledottv/agentic \
|
|
111
|
-
--
|
|
111
|
+
--cert-identity https://github.com/candledottv/agentic/.github/workflows/release.yaml@refs/tags/cli-v0.6.1
|
|
112
112
|
```
|
|
113
113
|
|
|
114
|
+
`--cert-identity` is the signing certificate's subject, the workflow file and the release tag in
|
|
115
|
+
one string, so it pins both: an attestation minted by the same workflow for a different tag does
|
|
116
|
+
not verify. Pass it on its own: `gh` treats its identity flags (`--cert-identity`, its regex form
|
|
117
|
+
and the two signer flags) as mutually exclusive, and the signer-workflow flag alone would accept
|
|
118
|
+
any tag's attestation.
|
|
119
|
+
|
|
114
120
|
```
|
|
115
121
|
curl -fsSLO https://github.com/candledottv/agentic/releases/download/cli-v0.6.1/candle-darwin-arm64.sigstore.json
|
|
116
122
|
cosign verify-blob --new-bundle-format --bundle candle-darwin-arm64.sigstore.json \
|