From a1600cfcd36aceb5ae06dc8d6585f25061acb65e Mon Sep 17 00:00:00 2001
From: Juha Uotila <10782843+inffy@users.noreply.github.com>
Date: Fri, 4 Sep 2026 18:41:45 +0300
Subject: [PATCH] feat: add attestation to ISO build

---
 .../workflows/reusable-build-iso-anaconda.yml | 10 +++++++
 README.md                                     | 28 +++++++++++++++++--
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/reusable-build-iso-anaconda.yml b/.github/workflows/reusable-build-iso-anaconda.yml
index 4721039..870e40e 100644
--- a/.github/workflows/reusable-build-iso-anaconda.yml
+++ b/.github/workflows/reusable-build-iso-anaconda.yml
@@ -28,6 +28,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
     name: Build ISOs
@@ -42,6 +44,8 @@ jobs:
       contents: read
       packages: read
       id-token: write
+      attestations: write
+
 
     steps:
       - name: Checkout
@@ -126,6 +130,12 @@ jobs:
           (cd "${OUTPUT_DIRECTORY}" && sha256sum "${OUTPUT_NAME}.iso" | tee "${OUTPUT_NAME}.iso-CHECKSUM")
           echo "output_directory=$OUTPUT_DIRECTORY" >> "${GITHUB_OUTPUT}"
 
+      - name: Attestation
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        if: inputs.upload_r2 || (inputs.upload_artifacts && github.event_name != 'pull_request')
+        with:
+          subject-path: ${{ steps.rename.outputs.output_directory }}/${{ steps.image_ref.outputs.artifact_format }}.iso
+
       - name: Upload ISO to Job Artifacts
         if: inputs.upload_artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
diff --git a/README.md b/README.md
index d648534..7872f91 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # Aurora ISO Builder
 
-[![Build ISOs](https://github.com/ublue-os/aurora-iso/actions/workflows/build-iso-stable.yml/badge.svg)](https://github.com/ublue-os/aurora-iso/actions/workflows/build-iso-stable.yml)
+[![Build ISOs](https://github.com/get-aurora-dev/iso/actions/workflows/build-iso-stable.yml/badge.svg)](https://github.com/get-aurora-dev/iso/actions/workflows/build-iso-stable.yml)
 
 This repository is dedicated to building bootable Aurora ISOs using [Titanoboa](https://github.com/ublue-os/titanoboa) and the Anaconda installer with WebUI.
 
@@ -23,6 +23,30 @@ Pre-built ISOs are available at [getaurora.dev](https://getaurora.dev).
 
 Testing ISOs are available [here](https://docs.getaurora.dev/guides/iso-testing).
 
+## Verifying ISOs
+
+### 1. Integrity Check (Checksum)
+
+You can verify the SHA256 checksum of your downloaded ISO against the published checksum file:
+
+```bash
+sha256sum -c <iso-name>.iso-CHECKSUM
+```
+
+### 2. Provenance Attestation (GitHub Actions)
+
+All official ISOs built via GitHub Actions include signed cryptographic build provenance attestations. You can verify that the ISO was built and published directly by this repository using the [GitHub CLI (`gh`)](https://cli.github.com/):
+
+```bash
+gh attestation verify <iso-name>.iso --owner get-aurora-dev
+```
+
+Or by specifying the repository directly:
+
+```bash
+gh attestation verify <iso-name>.iso --repo get-aurora-dev/iso
+```
+
 ## Repository Structure
 
 ```
@@ -129,7 +153,7 @@ The workflow builds ISOs for:
 3. Format image reference
 4. Generate flatpak list dynamically from Brewfiles in common repo
 5. Build ISO with Titanoboa
-6. Generate checksums
+6. Generate checksums and build provenance attestations
 7. Upload to CloudFlare R2 test bucket (scheduled builds) or GitHub artifacts (configurable via inputs)
 
 #### Upload Behavior