From ce43e573acb11635fd5f4f22a4c302919ccb9704 Mon Sep 17 00:00:00 2001
From: Peter Jausovec <peter.jausovec@solo.io>
Date: Fri, 25 Sep 2026 16:01:31 +0200
Subject: [PATCH] add linux binary attestation

Signed-off-by: Peter Jausovec <peter.jausovec@solo.io>
---
 .github/workflows/release-linux.yml | 22 ++++++++++++++++++++++
 .github/workflows/release.yml       |  2 ++
 2 files changed, 24 insertions(+)

diff --git a/.github/workflows/release-linux.yml b/.github/workflows/release-linux.yml
index c810fe54..e17bd513 100644
--- a/.github/workflows/release-linux.yml
+++ b/.github/workflows/release-linux.yml
@@ -230,3 +230,25 @@ jobs:
           name: release-binary-linux-${{ matrix.arch }}
           path: release/agentdesktop-*
           if-no-files-found: error
+
+  attest-linux-binaries:
+    needs: build-linux-binaries
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - name: Download Linux binaries
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: release
+          pattern: release-binary-linux-*
+          merge-multiple: true
+
+      - name: Attest Linux binaries
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: |
+            release/agentdesktop-linux-amd64
+            release/agentdesktop-linux-arm64
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bb7021b2..1bf287a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -58,6 +58,7 @@ jobs:
       contents: read
       packages: write
       id-token: write
+      attestations: write
     uses: ./.github/workflows/release-linux.yml
     with:
       version: ${{ needs.setup.outputs.version }}
@@ -121,5 +122,6 @@ jobs:
             - Helm chart: `oci://${{ env.CHART_REGISTRY }}/agentdesktop-controller:${{ needs.setup.outputs.version }}`
             - Agentdesktop binaries for amd64 and arm64 on Linux, macOS, and Windows are attached below.
             - Signed Windows MSI installers for amd64 and arm64 are attached below.
+            - Linux binaries include keyless Sigstore build provenance. Verify a downloaded binary with `gh attestation verify <FILE> --repo ${{ github.repository }}`.
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}