anomalyco / anomalyco/opencode
How to validate release attestation (json) ?
Open
@nexxeln is already working on this.
Since Aug 27, 2026.
- Dominant language
- TypeScript
- Stars
- 209k
- Forks
- 27.5k
- PR merge metrics
- PR metrics pending
Description
Description
Either i have missed something, but i could not find documentation on how to verify the released binaries
I guess it should be something with cosign, or gh attestation verify, but i cannot get it to work
$ gh attestation verify opencode-linux-x64-baseline.tar.gz \
--bundle attestation.json \
-R anomalyco/opencode
Loaded digest sha256:5f375b83a33ac67af12e0767baa3b987c8b9034c8f400f4a2e245c1cf371e897 for file://opencode-linux-x64-baseline.tar.gz
no attestations found with predicate type: https://slsa.dev/provenance/v1
Error: no attestations found with predicate type: https://slsa.dev/provenance/v1
How can i verify this binary before using it ?
Plugins
No response
OpenCode version
No response
Steps to reproduce
No response
Screenshot and/or share link
No response
Operating System
No response
Terminal
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.