diff --git a/README.md b/README.md index 8be9aff0..bd8177e1 100644 --- a/README.md +++ b/README.md @@ -93,10 +93,10 @@ Docker Linux packages also include Docker Buildx when installed using the You can also download the latest binary from the [GitHub releases page](https://github.com/docker/buildx/releases/latest). We generate [SLSA3 provenance](slsa.dev) using the OpenSSF's [slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) during the release process. To verify a relase binary: 1. Install the verification tool from [slsa-framework/slsa-verifier#installation](https://github.com/slsa-framework/slsa-verifier#installation). -2. Download the provenance file `attestation.intoto.jsonl`. -3. Run: +2. Download the provenance file `attestation.intoto.jsonl` from the [GitHub releases page](https://github.com/docker/buildx/releases/latest). +3. Run the verifier: ```shell -slsa-verifier -artifact-path buildx-v1.darwin-amd64 -provenance attestation.intoto.jsonl -source github.com/docker/buildx -branch master +slsa-verifier -artifact-path -provenance attestation.intoto.jsonl -source github.com/docker/buildx -branch master ``` Rename the relevant binary and copy it to the destination matching your OS: