tap: attesto 0.5.0 + attesto-local-vault 2.0.1

Mirrored from attesto-v1 ops/get-host/homebrew/ (commit f21339ce); hashes from the KMS-signed channel manifests on get.attesto.eu. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-24 15:09:50 +02:00
commit c8f90135ac
3 changed files with 310 additions and 0 deletions
@@ -0,0 +1,64 @@
+# attesto/attesto — Homebrew tap
+
+Homebrew tap for [Attesto](https://attesto.eu): the `attesto` verifier CLI and
+the `attesto-local-vault` container wrapper. Artifacts are served from the
+signed download host [get.attesto.eu](https://get.attesto.eu).
+
+## Install
+
+```sh
+brew tap attesto/attesto https://git.rotz.ai/attesto/homebrew-attesto.git
+brew install attesto              # the CLI (offline verifier)
+brew install attesto-local-vault  # the Local Vault container wrapper
+```
+
+## What is signed, and how to verify independently
+
+Every release channel on get.attesto.eu carries a `SHA256SUMS` manifest and a
+cosign signature over it (`SHA256SUMS.sig`). The `sha256` stanzas in the
+formulas of this tap are copied verbatim from those **signed** manifests —
+never computed locally. Homebrew then enforces the same hashes on every
+install.
+
+You do not have to trust this tap. Verify the manifests yourself:
+
+```sh
+curl -fsSLO https://get.attesto.eu/cosign.pub
+
+# CLI channel
+curl -fsSLO https://get.attesto.eu/0.5.0/SHA256SUMS
+curl -fsSLO https://get.attesto.eu/0.5.0/SHA256SUMS.sig
+cosign verify-blob --key cosign.pub --insecure-ignore-tlog \
+  --signature SHA256SUMS.sig SHA256SUMS
+
+# Local Vault channel
+curl -fsSLO https://get.attesto.eu/local-vault/2.0.1/SHA256SUMS
+curl -fsSLO https://get.attesto.eu/local-vault/2.0.1/SHA256SUMS.sig
+cosign verify-blob --key cosign.pub --insecure-ignore-tlog \
+  --signature SHA256SUMS.sig SHA256SUMS
+```
+
+then compare the listed hashes with the `sha256` values in `Formula/*.rb`.
+(`--insecure-ignore-tlog` is required because the release key is a KMS key
+and signatures are not uploaded to the Rekor transparency log.)
+
+The Local Vault container image itself is referenced **by digest**, not by a
+tag, so the wrapper can only ever run the exact image
+`git.attesto.eu/attesto/local-vault@sha256:5799e7f0669c9b42a55a338f4233cfa5afb5aa6a2627c2c50f7545a41bff1551`.
+
+## macOS honesty note
+
+`attesto-local-vault` requires Docker (Docker Desktop on macOS) at runtime —
+Homebrew does not install it for you. On macOS the vault and its Linux-only
+provider sandbox run **inside Docker Desktop's Linux VM**. Attesto's
+isolation claims apply within that VM; a native macOS process would not carry
+them, which is exactly why the macOS install is a container wrapper and never
+claims native isolation.
+
+## Where this tap comes from
+
+The contents of this repository are mirrored from `ops/get-host/homebrew/` in
+the main Attesto repository — that directory is the source of truth; changes
+land there first and are synced here at publish time (`sync_tap.sh`). The
+behavioral parity between the brew wrapper and the `install.sh` wrapper is
+enforced there by `tests/wrapper_sync_check.sh`.