bazel-central-registry icon indicating copy to clipboard operation
bazel-central-registry copied to clipboard
verified publisher icon bazelbuild

Implement support for module attestations

Open fweikert opened this issue 10 months ago • 1 comments

Context: https://github.com/bazelbuild/bazel-central-registry/discussions/2721

  1. Implement optional attestation support: Attestations are checked and mirrored, but are still optional (regressions are disallowed, though).
  2. Update documentation.
  3. Implement UI support to show which module versions have attestations.
  4. Widely advertise attestation support once the generator GitHub action is ready to be used.
  5. [TBD] Enforce existence of attestations for all future module versions after a migration period.

Mirroring happens during post-submit -> https://github.com/bazelbuild/continuous-integration/issues/2177.

fweikert avatar Feb 18 '25 20:02 fweikert

Note: There are PRs with multiple modules, e.g. https://github.com/bazelbuild/bazel-central-registry/pull/3798/files

fweikert avatar Feb 21 '25 17:02 fweikert

Successfully accepted our first PR with attestations: https://github.com/bazelbuild/bazel-central-registry/pull/4306

fweikert avatar Apr 11 '25 21:04 fweikert

UI hint has been implemented in https://github.com/bazel-contrib/bcr-ui/pull/162

fweikert avatar Jun 16 '25 13:06 fweikert