Repository: cli/cli
File: pkg/cmd/attestation/verify/verify.go (Go)

Code before:
		Use:   "verify [<file-path> | oci://<image-uri>] [--owner | --repo]",
		Args:  cmdutil.ExactArgs(1, "must specify file path or container image URI, as well as one of --owner or --repo"),
		Short: "Verify an artifact's integrity using attestations",
		Long: heredoc.Docf(`
			Verify the integrity and provenance of an artifact using its associated
			cryptographically signed attestations.

			## Understanding Verification

			An attestation is a claim (i.e. a provenance statement) made by an actor
			(i.e. a GitHub Actions workflow) regarding a subject (i.e. an artifact).

			In order to verify an attestation, you must provide an artifact and validate:
			* the identity of the actor that produced the attestation
			* the expected attestation predicate type (the nature of the claim)

			By default, this command enforces the %[1]s%[2]s%[1]s
			predicate type. To verify other attestation predicate types use the
			%[1]s--predicate-type%[1]s flag.

			The "actor identity" consists of:
			* the repository or the repository owner the artifact is linked with
			* the Actions workflow that produced the attestation (a.k.a the
			  signer workflow)

			This identity is then validated against the attestation's certificate's
			SourceRepository, SourceRepositoryOwner, and SubjectAlternativeName
			(SAN) fields, among others.

			It is up to you to decide how precisely you want to enforce this identity.

			At a minimum, this command requires either:
			* the %[1]s--owner%[1]s flag (e.g. --owner github), or
			* the %[1]s--repo%[1]s flag (e.g. --repo github/example)

			The more precisely you specify the identity, the more control you will
			have over the security guarantees offered by the verification process.

			Ideally, the path of the signer workflow is also validated using the
			%[1]s--signer-workflow%[1]s or %[1]s--cert-identity%[1]s flags.

			Please note: if your attestation was generated via a reusable workflow then
			that reusable workflow is the signer whose identity needs to be validated.
			In this situation, you must also use either the %[1]s--signer-workflow%[1]s or
			the %[1]s--signer-repo%[1]s flag.

			For more options, see the other available flags.

			## Loading Artifacts And Attestations

			To specify the artifact, this command requires:

Review comment (suggestion):
```suggestion
			This identity is then validated against the attestation certificate's
```

Code after:
		Use:   "verify [<file-path> | oci://<image-uri>] [--owner | --repo]",
		Args:  cmdutil.ExactArgs(1, "must specify file path or container image URI, as well as one of --owner or --repo"),
		Short: "Verify an artifact's integrity using attestations",
		Long: heredoc.Docf(`
			Verify the integrity and provenance of an artifact using its associated
			cryptographically signed attestations.

			## Understanding Verification

			An attestation is a claim (i.e. a provenance statement) made by an actor
			(i.e. a GitHub Actions workflow) regarding a subject (i.e. an artifact).

			In order to verify an attestation, you must provide an artifact and validate:
			* the identity of the actor that produced the attestation
			* the expected attestation predicate type (the nature of the claim)

			By default, this command enforces the %[1]s%[2]s%[1]s
			predicate type. To verify other attestation predicate types use the
			%[1]s--predicate-type%[1]s flag.

			The "actor identity" consists of:
			* the repository or the repository owner the artifact is linked with
			* the Actions workflow that produced the attestation (a.k.a the
			  signer workflow)

			This identity is then validated against the attestation's certificate's
			SourceRepository, SourceRepositoryOwner, and SubjectAlternativeName
			(SAN) fields, among others.

			It is up to you to decide how precisely you want to enforce this identity.

			At a minimum, this command requires either:
			* the %[1]s--owner%[1]s flag (e.g. --owner github), or
			* the %[1]s--repo%[1]s flag (e.g. --repo github/example)

			The more precisely you specify the identity, the more control you will
			have over the security guarantees offered by the verification process.

			Ideally, the path of the signer workflow is also validated using the
			%[1]s--signer-workflow%[1]s or %[1]s--cert-identity%[1]s flags.

			Please note: if your attestation was generated via a reusable workflow then
			that reusable workflow is the signer whose identity needs to be validated.
			In this situation, you must use either the %[1]s--signer-workflow%[1]s or
			the %[1]s--signer-repo%[1]s flag.

			For more options, see the other available flags.

			## Loading Artifacts And Attestations

			To specify the artifact, this command requires: