Skip to content

Commit e9f6841

Browse files
authored
Add verification docs (#1431)
1 parent d6ddfc1 commit e9f6841

File tree

1 file changed

+18
-0
lines changed

1 file changed

+18
-0
lines changed

src/getting-started/installation.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,24 @@ Running `foundryup` will automatically install the latest stable version of the
2323
> ℹ️ **Note**
2424
> If you're using Windows, you'll need to install and use [Git BASH](https://gitforwindows.org/) or [WSL](https://learn.microsoft.com/en-us/windows/wsl/install) as your terminal, since Foundryup currently doesn't support Powershell or Command Prompt (Cmd).
2525
26+
#### Verify integrity and provenance of binaries
27+
28+
Foundry binaries are attested by using [GitHub artifact attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds). It is strongly recommended to verify the binaries installed using `foundryup` in order to check that they were built and distributed from Foundry repository.
29+
For example, `forge` binary integrity and provenance can be verified by running:
30+
```shell
31+
$ gh attestation verify --owner foundry-rs $(which forge)
32+
33+
✓ Verification succeeded!
34+
35+
The following 1 attestation matched the policy criteria
36+
37+
- Attestation #1
38+
- Build repo:..... foundry-rs/foundry
39+
- Build workflow:. .github/workflows/release.yml@refs/tags/stable
40+
- Signer repo:.... foundry-rs/foundry
41+
- Signer workflow: .github/workflows/release.yml@refs/tags/stable
42+
```
43+
2644
### Building from Source
2745

2846
#### Prerequisites

0 commit comments

Comments
 (0)