Add support for attestations in the host phase#2000
Add support for attestations in the host phase#2000mistydemeo merged 1 commit intoaxodotdev:mainfrom
Conversation
samypr100
force-pushed
the
attest-improvements
branch
2 times, most recently
from
e689d9e to
67eb13f
Compare
|
This makes sense to me, and thank you for adding tests! Question for you - do you think these make sense as two separate settings? It feels like they're pretty linked, since the |
Good question, happy to change it. |
|
Good point - leaving it open for other expansion could be useful. I was thinking about what else you might want to attest in that step, but now that I think about it, the custom build steps do mean that there are hypothetically extra artifacts produced in local builds that the user might want attested. That being the case, I'm happy for these to be separate steps. |
samypr100
force-pushed
the
attest-improvements
branch
2 times, most recently
from
f75fbbf to
e32411b
Compare
|
@mistydemeo Anything I could do to help move this forward? 🙏 |
|
Sorry to have taken so long! I'll try to get this merged tonight. Just for a little transparency, I'm preparing for a big move in a few weeks, and it turns out dealing with all of that stuff takes up most of my after-work energy and brainpower. 😅 |
No worries, moving is a nightmare. Take your time 📦. |
mistydemeo
left a comment
mistydemeo
left a comment
There was a problem hiding this comment.
Looking good! Sorry it took me so long to review. Just one quick request, then I think we're good to go.
samypr100
force-pushed
the
attest-improvements
branch
from
b54ea61 to
456b330
Compare
## Summary Similar to #8685, this adds attestations for uv release artifacts. The changes on this PR would add attestations for * `dist-manifest.json` * `uv-installer.ps1` * `uv-installer.sh` * All `*.tar.gz` and `*.zip` uv binary files ## Test Plan ~(clarifying note: I'm aware this file is managed cargo dist and this will not work without allow-dirty at this time)~ ~Currently cargo dist targets generation in `build_local_artifacts` which is not used here, plus we'd ideally want to attest the GH downloads / artifacts.~ (edit: fixed by axodotdev/cargo-dist#2000) At a glance, this release workflow seems to work successfully: e.g. Example Run: https://github.com/samypr100/uv/actions/runs/13229100555 e.g. Example Release: https://github.com/samypr100/uv/releases/tag/0.5.29 --------- Co-authored-by: Aria Desires <aria.desires@gmail.com>
2 participants
Closes #1754
Two integration tests were added to confirm functionality behaves as expected.
Originally opened in astral-sh#45