From e66957049283f122493a43857c4c6e2a5aba8074 Mon Sep 17 00:00:00 2001 From: Sami Alajrami Date: Thu, 11 Jan 2024 13:38:40 +0100 Subject: [PATCH] update attestation binding --- .../content/getting_started/attestations.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/docs.kosli.com/content/getting_started/attestations.md b/docs.kosli.com/content/getting_started/attestations.md index 8f43bf527..2f4f0cbca 100644 --- a/docs.kosli.com/content/getting_started/attestations.md +++ b/docs.kosli.com/content/getting_started/attestations.md @@ -14,9 +14,15 @@ Kosli allows you to report different types of attestations about an Artifact or Depending on your process requirements, some attestations will belong to an Artifact while others will belong to a Trail. When you report an attestation, you have the choice of where to attach it: -1. **To an Artifact using its fingerprint**: the attestation belongs only to the artifact with that fingerprint. -2. **To an Artifact using its template name**: the attestation belongs to any artifact reported with the specified template within a single trail. For instance, if multiple artifacts are reported as `backend` from the same trail, all of them would inherit the attestation that targets an artifact with the template name `backend` in that trail. -3. **To a trail**: the attestation belongs to a single trail and is not linked to a specific artifact. +1. **To a trail**: the attestation belongs to a single trail and is not linked to a specific artifact. +2. **To an Artifact**: the attestation belongs to a specific artifact. + +### Binding attestations to an artifact + +To bind an attestation to an artifact, you have two options: +1. **Binging with the fingerprint**: the attestation belongs only to the artifact with that fingerprint. This requires that the artifact has already been reported to Kosli. +2. **Binding with template name and git commit**: the attestation belongs to any artifact that **has been or will be** reported with the specified template name and a matching git commit. For instance, if multiple artifacts are reported as `backend` from the same trail, and an attestation has been reported targeting template name `backend`. The attestation will be bound to the `backend` artifacts that has the same git commit as the attestation. + {{< hint info >}}