Skip to content
Navigation Menu
Sign in
Products
Platform
GitHub
Repository hosting, code review, and collaboration
Copilot
AI coding agent for tasks, projects, and automated work
Build & Ship
Actions
CI/CD and automation
Code Quality
Quality analysis, fixes, and enforcement
Codespaces
Cloud development environments
Secure
Code Security
Vulnerability detection and remediation
Secret Protection
Secret scanning and leak prevention
All Features
Developers
Learn
Documentation
Training
Certifications
Build
Build with Copilot
Customize Copilot
Integrations
Explore
Trending repos
GitHub Sponsors
Developer articles
Changelog
Changelog
Your source for the latest features, improvements, and fixes across GitHub products, all in one place.
Businesses
By Stage
Enterprises
Team
Startups
Nonprofits
By Industry
Healthcare
Financial services
Manufacturing
Government
See all industries
Evaluate GitHub
Why GitHub
Customer Stories
Business insights
Trust Center
Add-ons
GitHub Advanced Security
Enterprise-grade code security
Copilot for business
Enterprise-grade AI features
Premium Support
Enterprise-grade 24/7 support
Resources
Learn & Connect
Documentation
Resource center
Blog
Events & webinars
Community Forum
Customer Stories
Integrations
Support
Customer support
Training
GitHub Status
Company
About
Partners
Changelog
GitHub Universe
GitHub Universe
The event for developers, by developers — talks, workshops, and what’s next for GitHub.
Pricing
Search
/
Sign in
Sign up
Appearance settings
You signed in with another tab or window.
Reload
to refresh your session.
You signed out in another tab or window.
Reload
to refresh your session.
You switched accounts on another tab or window.
Reload
to refresh your session.
Dismiss alert
{{ message }}
kosli-dev
cli
Repository navigation
Code
Issues
17
(17)
Pull requests
8
(8)
Actions
Projects
Security and quality
Insights
More
items
feat: add kosli attest in-toto, recording attestations from bundle files
- #1362
#1362
Open
tooky
wants to merge 17 commits into
main
kosli-dev/cli:main
from
fm/
intoto-
bundle
kosli-dev/cli:fm/intoto-bundle
Copy head branch name to clipboard
Conversation
Commits
17
(17)
Checks
Files changed
Open
feat: add kosli attest in-toto, recording attestations from bundle files
#1362
tooky
wants to merge 17 commits into
main
kosli-dev/cli:main
from
fm/
intoto-
bundle
kosli-dev/cli:fm/intoto-bundle
Copy head branch name to clipboard
Commits
Commits on Nov 11, 2026
Check git_commit_info against the API's GitCommit schema
Show description for 75b643e
tooky
committed
75b643e
View commit details
Copy full SHA for 75b643e
Browse repository at this point
Read in-toto attestations and match them to an artifact
Show description for 36e4f08
tooky
committed
36e4f08
View commit details
Copy full SHA for 36e4f08
Browse repository at this point
Verify signed in-toto attestations with sigstore-go
Show description for a213c4e
tooky
committed
a213c4e
View commit details
Copy full SHA for a213c4e
Browse repository at this point
Map provenance and SBOM predicates onto Kosli's terms
Show description for 6b72452
tooky
committed
6b72452
View commit details
Copy full SHA for 6b72452
Browse repository at this point
Look up a commit's details on GitHub by its SHA
Show description for 7424c31
tooky
committed
7424c31
View commit details
Copy full SHA for 7424c31
Browse repository at this point
Share how attest sbom builds its attestation data
Show description for 93a6392
tooky
committed
93a6392
View commit details
Copy full SHA for 93a6392
Browse repository at this point
Add kosli attest in-toto, reading attestations from a bundle file
Show description for 59ddd13
tooky
committed
59ddd13
View commit details
Copy full SHA for 59ddd13
Browse repository at this point
Let attest sbom read an SBOM from a bundle or DSSE envelope
Show description for 4fe746c
tooky
committed
4fe746c
View commit details
Copy full SHA for 4fe746c
Browse repository at this point
no-mistakes(review): Drive provenance checks from Missing; drop unused fields
tooky
committed
2a220e0
View commit details
Copy full SHA for 2a220e0
Browse repository at this point
no-mistakes(ci): Root cause: the failure came from this PR's test, not from infrastructure. CI exports KOSLI_GITHUB_TOKEN, and viper binds it to --github-token. Two cases in TestAttestInTotoCommand…
Show description for 88b6ac5
tooky
committed
88b6ac5
View commit details
Copy full SHA for 88b6ac5
Browse repository at this point
no-mistakes(ci): Root cause: the failure came from this PR's own test. The case TestAttestInTotoCommandTestSuite/TestProvenanceWhenTheStatementLacksDetails/"reads the commit's details from a local …
Show description for 2103ac7
tooky
committed
2103ac7
View commit details
Copy full SHA for 2103ac7
Browse repository at this point
Check an SBOM attestation's subject even when no signer is pinned
Show description for 8dce16f
tooky
committed
8dce16f
View commit details
Copy full SHA for 8dce16f
Browse repository at this point
Point attest sbom at attest in-toto for a file of several attestations
Show description for 7719a9e
tooky
committed
7719a9e
View commit details
Copy full SHA for 7719a9e
Browse repository at this point
Say that a GitHub Enterprise commit lookup needs --github-base-url
Show description for 290b885
tooky
committed
290b885
View commit details
Copy full SHA for 290b885
Browse repository at this point
Record nothing when any attestation in the file fails verification
Show description for 5195238
tooky
committed
5195238
View commit details
Copy full SHA for 5195238
Browse repository at this point
no-mistakes(document): Restore Verifier doc comment in intoto
tooky
committed
5aa2ad0
View commit details
Copy full SHA for 5aa2ad0
Browse repository at this point
Tell a signature that cannot be checked apart from a bad one
Show description for 8cda42f
tooky
committed
8cda42f
View commit details
Copy full SHA for 8cda42f
Browse repository at this point
You can’t perform that action at this time.
