Verified:GitHub

glab-attestation

Verify GitLab software artifact attestations using the cosign binary.

Updated Mar 15, 2026

Search Tags:#provenance #gitlab #supply chain security #cosign #attestation #artifact verification

One-click install

npx skills add https://github.com/ProyectoG007/Skill.bat --skill glab-attestation-proyectog007

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: glab-attestation
Source: https://github.com/ProyectoG007/Skill.bat/tree/main/scripts/05_Dev_Tools/07.%20gitlab-cli-skills-1.11.0/glab-attestation
Command: npx skills add https://github.com/ProyectoG007/Skill.bat --skill glab-attestation-proyectog007

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps ensure the integrity and provenance of software artifacts within GitLab by verifying their attestations, crucial for software supply chain security.

Core Features & Use Cases

Artifact Verification: Verify the provenance of specific files or artifacts within a GitLab project.
Supply Chain Security: Enhance software supply chain security by confirming artifact authenticity.
Use Case: Before deploying a new version of a critical library, use this Skill to verify its attestation, ensuring it hasn't been tampered with and originates from a trusted source.

Quick Start

Verify the attestation for the file 'main.go' in the 'my-org/my-repo' GitLab project.

Frequently Asked Questions about glab-attestation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify GitLab artifact attestations for supply chain security?▼

To verify GitLab artifact attestations for supply chain security, you can use this Skill to check the provenance and authenticity of specific files within a GitLab project. It requires the cosign binary to perform the validation operations.

What is software artifact provenance checking and when do I need it?▼

Software artifact provenance checking confirms that a component originates from a trusted source and hasn't been tampered with. You need it before deploying critical libraries to ensure adherence to software supply chain security standards.

Do I need cosign to verify GitLab software attestations?▼

Yes, you need the cosign binary installed to verify GitLab software attestations using this Skill. Cosign handles the underlying cryptographic verification operations required to validate the artifact signatures.

Can I check the attestation of a specific file like main.go in a GitLab project?▼

Yes, you can check the attestation of a specific file like main.go in a GitLab project. The Skill allows you to target individual files within a repository, such as 'my-org/my-repo', to verify their provenance and authenticity.

How do I validate software components before deploying a new library version?▼

To validate software components before deploying a new library version, use this Skill to verify the artifact's attestation. This process ensures the component hasn't been tampered with and originates from a trusted source.