verify.ts

Overview

@file /verify <sha256> — attestation lookup by subject digest. Answers "did openaliro/openaliro's CI actually build this file", from GitHub's public attestations API, not from a SHA256SUMS.txt served next to the artifact it describes (a compromise that could replace the binary could replace that file in the same motion — scripts/security-attest.sh's own reasoning for why this control exists at all).

depends on attest.ts command.ts discord.ts followup.ts  ·  used by index.ts

flowchart TD
  handler --> defer
  handler --> lookupAttestation
  handler --> message
  handler --> optionString