STACKITGit/cli
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Formatting fix

Browse source 
Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>
This commit is contained in:
Fredrik Skogman 2024-11-18 15:17:34 +01:00
parent 601982faf1
commit 075691b03e
No known key found for this signature in database
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -131,7 +131,7 @@ Since version 2.50.0 `gh` has been producing [Build Provenance Attestation](http
There are two common ways to verify a downloaded release, depending if `gh` is aready installed or not. If `gh` is installed, it's trivial to verify a new release:
- **Option 1: Using `gh` if already installed:
- **Option 1: Using `gh` if already installed:**
```shell
$ % gh at verify -R cli/cli gh_2.62.0_macOS_arm64.zip
@ -144,7 +144,7 @@ REPO PREDICATE_TYPE WORKFLOW
cli/cli https://slsa.dev/provenance/v1 .github/workflows/deployment.yml@refs/heads/trunk
```
- **Option 2: Using Sigstore [`cosign`](https://github.com/sigstore/cosign):
- **Option 2: Using Sigstore [`cosign`](https://github.com/sigstore/cosign):**
To perform this, download the [attestation](https://github.com/cli/cli/attestations) for the downloaded release and use cosign to verify the authenticity of the downloaded release: