[guappa]

You don't. The whole point is that you can no longer sign anything. Microsoft signs for you.

And of course the signature means "this user can push to github" and nothing more.

[remram]

Hopefully the attestation is bound to a specific commit, so you can know the binaries came from the source?

Otherwise I don't get it.

[woodruffw]

Yes, it’s bound to a specific commit; we just don’t present that in the web UI yet. If you click on the transparency log entry, you’ll see the exact commit the attestation came from.

[guappa]

It doesn't seem to be from what I can see. Only states that the upload came from a gh runner.

[woodruffw]

See adjacent comment above.

[guappa]

Ok that's at least something.

But my CI can download and run code from everywhere, so that doesn't mean that I can know what is being uploaded just looking at the git repository alone.