Skip to content

feat: add Attestation to ISO build #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
inffy merged 1 commit into from
Sep 4, 2026
Merged

feat: add Attestation to ISO build #85

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .github/workflows/reusable-build-iso-anaconda.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
cancel-in-progress: true

permissions: {}

jobs:
build:
name: Build ISOs
Expand All @@ -42,6 +44,8 @@ jobs:
contents: read
packages: read
id-token: write
attestations: write


steps:
- name: Checkout
Expand Down Expand Up @@ -126,6 +130,12 @@ jobs:
(cd "${OUTPUT_DIRECTORY}" && sha256sum "${OUTPUT_NAME}.iso" | tee "${OUTPUT_NAME}.iso-CHECKSUM")
echo "output_directory=$OUTPUT_DIRECTORY" >> "${GITHUB_OUTPUT}"

- name: Attestation
uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
if: inputs.upload_r2 || (inputs.upload_artifacts && github.event_name != 'pull_request')
with:
subject-path: ${{ steps.rename.outputs.output_directory }}/${{ steps.image_ref.outputs.artifact_format }}.iso

- name: Upload ISO to Job Artifacts
if: inputs.upload_artifacts
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
Expand Down
28 changes: 26 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Aurora ISO Builder

[![Build ISOs](https://github.com/ublue-os/aurora-iso/actions/workflows/build-iso-stable.yml/badge.svg)](https://github.com/ublue-os/aurora-iso/actions/workflows/build-iso-stable.yml)
[![Build ISOs](https://github.com/get-aurora-dev/iso/actions/workflows/build-iso-stable.yml/badge.svg)](https://github.com/get-aurora-dev/iso/actions/workflows/build-iso-stable.yml)

This repository is dedicated to building bootable Aurora ISOs using [Titanoboa](https://github.com/ublue-os/titanoboa) and the Anaconda installer with WebUI.

Expand All @@ -23,6 +23,30 @@ Pre-built ISOs are available at [getaurora.dev](https://getaurora.dev).

Testing ISOs are available [here](https://docs.getaurora.dev/guides/iso-testing).

## Verifying ISOs

### 1. Integrity Check (Checksum)

You can verify the SHA256 checksum of your downloaded ISO against the published checksum file:

```bash
sha256sum -c <iso-name>.iso-CHECKSUM
```

### 2. Provenance Attestation (GitHub Actions)

All official ISOs built via GitHub Actions include signed cryptographic build provenance attestations. You can verify that the ISO was built and published directly by this repository using the [GitHub CLI (`gh`)](https://cli.github.com/):

```bash
gh attestation verify <iso-name>.iso --owner get-aurora-dev
```

Or by specifying the repository directly:

```bash
gh attestation verify <iso-name>.iso --repo get-aurora-dev/iso
```

## Repository Structure

```
Expand Down Expand Up @@ -129,7 +153,7 @@ The workflow builds ISOs for:
3. Format image reference
4. Generate flatpak list dynamically from Brewfiles in common repo
5. Build ISO with Titanoboa
6. Generate checksums
6. Generate checksums and build provenance attestations
7. Upload to CloudFlare R2 test bucket (scheduled builds) or GitHub artifacts (configurable via inputs)

#### Upload Behavior
Expand Down