CodexandClaude Fable 5
c8f90135ac
Mirrored from attesto-v1 ops/get-host/homebrew/ (commit f21339ce); hashes from the KMS-signed channel manifests on get.attesto.eu. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
65 lines
2.7 KiB
Markdown
65 lines
2.7 KiB
Markdown
# attesto/attesto — Homebrew tap
|
|
|
|
Homebrew tap for [Attesto](https://attesto.eu): the `attesto` verifier CLI and
|
|
the `attesto-local-vault` container wrapper. Artifacts are served from the
|
|
signed download host [get.attesto.eu](https://get.attesto.eu).
|
|
|
|
## Install
|
|
|
|
```sh
|
|
brew tap attesto/attesto https://git.rotz.ai/attesto/homebrew-attesto.git
|
|
brew install attesto # the CLI (offline verifier)
|
|
brew install attesto-local-vault # the Local Vault container wrapper
|
|
```
|
|
|
|
## What is signed, and how to verify independently
|
|
|
|
Every release channel on get.attesto.eu carries a `SHA256SUMS` manifest and a
|
|
cosign signature over it (`SHA256SUMS.sig`). The `sha256` stanzas in the
|
|
formulas of this tap are copied verbatim from those **signed** manifests —
|
|
never computed locally. Homebrew then enforces the same hashes on every
|
|
install.
|
|
|
|
You do not have to trust this tap. Verify the manifests yourself:
|
|
|
|
```sh
|
|
curl -fsSLO https://get.attesto.eu/cosign.pub
|
|
|
|
# CLI channel
|
|
curl -fsSLO https://get.attesto.eu/0.5.0/SHA256SUMS
|
|
curl -fsSLO https://get.attesto.eu/0.5.0/SHA256SUMS.sig
|
|
cosign verify-blob --key cosign.pub --insecure-ignore-tlog \
|
|
--signature SHA256SUMS.sig SHA256SUMS
|
|
|
|
# Local Vault channel
|
|
curl -fsSLO https://get.attesto.eu/local-vault/2.0.1/SHA256SUMS
|
|
curl -fsSLO https://get.attesto.eu/local-vault/2.0.1/SHA256SUMS.sig
|
|
cosign verify-blob --key cosign.pub --insecure-ignore-tlog \
|
|
--signature SHA256SUMS.sig SHA256SUMS
|
|
```
|
|
|
|
then compare the listed hashes with the `sha256` values in `Formula/*.rb`.
|
|
(`--insecure-ignore-tlog` is required because the release key is a KMS key
|
|
and signatures are not uploaded to the Rekor transparency log.)
|
|
|
|
The Local Vault container image itself is referenced **by digest**, not by a
|
|
tag, so the wrapper can only ever run the exact image
|
|
`git.attesto.eu/attesto/local-vault@sha256:5799e7f0669c9b42a55a338f4233cfa5afb5aa6a2627c2c50f7545a41bff1551`.
|
|
|
|
## macOS honesty note
|
|
|
|
`attesto-local-vault` requires Docker (Docker Desktop on macOS) at runtime —
|
|
Homebrew does not install it for you. On macOS the vault and its Linux-only
|
|
provider sandbox run **inside Docker Desktop's Linux VM**. Attesto's
|
|
isolation claims apply within that VM; a native macOS process would not carry
|
|
them, which is exactly why the macOS install is a container wrapper and never
|
|
claims native isolation.
|
|
|
|
## Where this tap comes from
|
|
|
|
The contents of this repository are mirrored from `ops/get-host/homebrew/` in
|
|
the main Attesto repository — that directory is the source of truth; changes
|
|
land there first and are synced here at publish time (`sync_tap.sh`). The
|
|
behavioral parity between the brew wrapper and the `install.sh` wrapper is
|
|
enforced there by `tests/wrapper_sync_check.sh`.
|