mirror of
https://github.com/intel/llvm.git
synced 2026-02-07 07:39:11 +08:00
da0e5359fc
This job uses the new artifact attestations: https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/ This will allow users to verify that the sources came from a specific workflow run in the llvm-project repository. Currently, this job does not automatically upload sources to the release page, but rather it attaches them the workflow run as artifacts. The release manager is expected to download, verify, and sign the sources before uploading them to the release page. We may be able to automatically upload them in the future once we have a process for signing the binaries within the github workflow. Technically, though, the binaries are being signed as part of the attestation process, but the only way to verify the signatures is using the gh command line tool, and I don't think it is best to rely on that, since the tool may not be easily available on all systems.