glab-attestation

Verify software attestations for artifacts in GitLab projects using glab.

43|5|Updated Jan 30, 2026

Search Tags:#security #provenance #gitlab #supply chain #attestation #artifact verification

One-click install

npx skills add https://github.com/vince-winkintel/gitlab-cli-skills --skill glab-attestation

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: glab-attestation
Source: https://github.com/vince-winkintel/gitlab-cli-skills/tree/main/glab-attestation
Command: npx skills add https://github.com/vince-winkintel/gitlab-cli-skills --skill glab-attestation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the need to verify the integrity and origin of software artifacts, crucial for maintaining supply chain security and trust.

Core Features & Use Cases

Artifact Verification: Use the verify command to check attestations for specific files within a GitLab project.
Provenance Tracking: Supports working with SLSA provenance specifications to understand artifact lineage.
Use Case: Before deploying a new version of a critical library, use this skill to verify its attestation and ensure it hasn't been tampered with and originates from a trusted source.

Quick Start

Verify the attestation for the file named 'my-artifact.zip' in the project 'my-group/my-project'.

Frequently Asked Questions about glab-attestation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify GitLab artifact attestations for supply chain security?▼

To verify GitLab artifact attestations, use the `glab attestation verify` command to check provenance and integrity for specific files within a GitLab project. This ensures artifacts originate from trusted sources and have not been tampered with.

What do I need to check SLSA provenance for a GitLab project file?▼

Checking SLSA provenance for a GitLab project file requires the cosign binary, access to GitLab.com, and the `glab attestation verify` command. You must specify the target file name and the project path to successfully validate the software lineage.

When should I verify software provenance before deploying a critical library?▼

Verify software provenance before deploying a critical library to ensure its attestation is valid, confirming the artifact hasn't been tampered with and originates from a trusted source. This maintains supply chain security and trust.

Does artifact verification with glab work outside of GitLab.com?▼

Artifact verification with glab is designed specifically for GitLab.com and requires the cosign binary. The Skill focuses on verifying attestations within GitLab projects to ensure supply chain security using these defined dependencies.