From eca8fe8218a50a42aed9bedfbcf64e2c0e783043 Mon Sep 17 00:00:00 2001 From: Sawyer Cutler Date: Sat, 31 Oct 2026 15:39:09 -0700 Subject: [PATCH] docs(self-host): verify the image attestations --- docs/SELF_HOST.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/SELF_HOST.md b/docs/SELF_HOST.md index 569a2b82..0a55f7c7 100644 --- a/docs/SELF_HOST.md +++ b/docs/SELF_HOST.md @@ -38,6 +38,18 @@ and `DB_PORT` the database (default `5433`). newest release candidate), `latest` (the newest stable release), `main` (every merge), an exact version such as `0.1.0-rc.1`, or a full commit sha. +To check that the images were built by Builder's own workflow, verify their +attestations with the [GitHub CLI](https://cli.github.com) before starting, +where `` is the release you run: + +```sh +gh attestation verify oci://ghcr.io/corbitsdev/corbits-builder-hub: -R corbitsdev/corbits-builder +gh attestation verify oci://ghcr.io/corbitsdev/corbits-builder-sidecar: -R corbitsdev/corbits-builder +``` + +A release re-tags images built on `main` without rebuilding them, so the +attestation names `main` as its source, not the release tag. + ## Models Connect a provider in the UI under **Settings → Providers**, or set its key in